Users in Malaysia using Google or Cloudflare DNS to evade blocking, are having their requests hijacked and diverted to local ISP DNS servers.
  • Findmysec@infosec.pubEnglish
    5·
    5 months ago

    How would they do DPI on DNS packets routed using DoH? It looks like HTTPS traffic, it’s encrypted, and other than size and frequency I don’t see how they can gey anything out of it. Yeah they’ll get the SNI with eCH but that’s supported by FF and by a lot of providers using DoH