DNS over HTTPS causes an uproar

D

DelJo63

The design is quite simple; send the DNS request encrypted to the server and read the encrypted reply. However, the side effect kills both causal and legally mandated filtering.

DNS-over-HTTPS (DoH) protocol (IETF RFC8484) is being implemented my Mozilla and challenged by the UK and several ISPs. It will kill all adblockers and filtering techniques and create great privacy.

Take a look at the ZDNET article here for details.
 
Last edited by a moderator:
To counteract the loss of filtering of websites and adverts, you can use the HOSTS file.

The HOSTS File:

It takes precedence over your DNS servers, so your DNS servers may say facebook.com is linked to a specific IP address, but you can have facebook.com go anywhere you want. The Windows Hosts file can be used to block websites, redirect them, create shortcuts to websites, create your own local domains, and more. An effective filter would look like

This would cause all requests for FB to look on your PC for the FB server, and as it is not there, cause the request to see 404 Not Found.


see https://www.makeuseof.com/tag/6-surprising-uses-for-the-windows-hosts-file/

https://en.wikipedia.org/wiki/Hosts_(file

Internet resource blocking
Entries in the hosts file may be used to block online advertising,
or the domains of known malicious resources and servers that contain spyware,
adware, and other malware. This may be achieved by adding entries for those
sites to redirect requests to another address that does not exist or to a harmless
destination such as the local machine. Commercial software applications may be used
to populate the hosts file with entries of known undesirable Internet resources
automatically. In addition, user-created hosts files which block nuisance servers
are publicly available.​

edit %systemroot%\system32\drivers\etc\hosts

ipconfig /flushdns

then ping one of the newest entries you added

One site has been dedicated to entries for adblocking:
http://winhelp2002.mvps.org/hostsfaq.htm
http://winhelp2002.mvps.org/hosts2.htm

While this is effective, the sure size of the file has adverse effects in DNS lookups, as the file is read (searched) for every DNS request. Additionally, the permissions must be strictly set and monitored to avoid trojans and virus' from altering the file

  • The right solution would be to have DNS resolution rewritten to bring the file into memory and search it there.

  • The SIGHUP signal (kill 1 $pid) could then be used to reread the file and rebuild the memory representation of it.
 
Back