📝 Correction | DNS page doesn't mention DNS-over-TLS profiles, particularly opportunistic mode #2060

New Issue

2020-09-21T05:41:06Z

Mikaela commented

2020-09-21 05:41:06 +00:00

(Migrated from github.com)

Description

In https://www.privacytools.io/providers/dns/#dns-definitions, there are definitions which don't include DNS-over-TLS having two modes, opportunistic/automatic and manual. In opportunistic mode DoT is attempted with DNS server provided by DHCP and wihle it is vulnerable for downgrade and MITM (due to certificate validation skipping), it doen't have the issue of centralising everything to a single encrypted DNS provider that is hardcoded in apps (which is often said about Firefox).

https://tools.ietf.org/html/rfc7858#section-4.1

Why I am making the suggestion

This is an important difference between DoT and DoH, and I view PrivacyTools as being in a good position to inform users about it.

My connection with the software

I was one of the original authors of the DNS page and I think this information was removed as a part of some cleanup (or maybe it never got past draft). I have no connection to the RFCs or their authors that I know of.

I will keep the issue up-to-date if something I have said changes or I remember a connection with the software.

## Description In https://www.privacytools.io/providers/dns/#dns-definitions, there are definitions which don't include DNS-over-TLS having two modes, opportunistic/automatic and manual. In opportunistic mode DoT is attempted with DNS server provided by DHCP and wihle it is vulnerable for downgrade and MITM (due to certificate validation skipping), it doen't have the issue of centralising everything to a single encrypted DNS provider that is hardcoded in apps (which is often said about Firefox). * https://tools.ietf.org/html/rfc7858#section-4.1 ## Why I am making the suggestion This is an important difference between DoT and DoH, and I view PrivacyTools as being in a good position to inform users about it. ## My connection with the software I was one of the original authors of the DNS page and I think this information was removed as a part of some cleanup (or maybe it never got past draft). I have no connection to the RFCs or their authors that I know of. - [x] I will keep the issue up-to-date if something I have said changes or I remember a connection with the software.

This repo is archived. You cannot comment on issues.