undefined | Better HN

0 pointsbluejekyll6y ago0 comments

Can you describe the threat model your trying to account for?

The reason I made that statement has to do with the means by which DNS can easily be circumvented and direct encrypted connections used instead. This means using DNS introspection as a means for security doesn't buy you much, DoH just makes that more apparent.

0 comments

JohnFen6y ago

The threat model is anything that is trying to phone home without approval. This includes calling command-and-control servers, trackers for ads, data exfiltrators, etc.

All of these use domain names to set up the communications, for obvious reasons, so being able to thwart those lookups is of great value.

You're right, that all by itself is insufficient, but it's still very important.

j / k navigate · click thread line to collapse

0 pointsbluejekyll6y ago0 comments

Can you describe the threat model your trying to account for?

0 comments

JohnFen6y ago

The threat model is anything that is trying to phone home without approval. This includes calling command-and-control servers, trackers for ads, data exfiltrators, etc.

All of these use domain names to set up the communications, for obvious reasons, so being able to thwart those lookups is of great value.

You're right, that all by itself is insufficient, but it's still very important.

j / k navigate · click thread line to collapse