Re: [Add] Googles Experimental DoH Endpoint

["Robert Mortimer" <[e-mail]>]

Google have said that they'll stop this behaviour and that in future DoH will only be via the 8.8.8.8 address I've not seen any announcement saying that they've actually made this restriction yet. Just that they plan to.


-- 
Robm
873
  "Ask not what I can do for the stupid, 
         but what the stupid can do for me" - Graeme Garden
On 17/05/2019 13:54:15, Winfield, Alister <alister.winfield=[e-mail]> wrote:
**Reposting this here seems on topic for both doh and add **
 
Oh by the way I noticed this and it seems counter to the claim of DoH only running on 8.8.8.8.
 
 
To keep it short I’ve removed the SSL setup step from the example.
 
 
$ openssl s_client -connect search.google.com:443 -servername search.google.com
…
---
 
GET /experimental?dns=AAABAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB HTTP/1.1
host: dns.google.com
 
HTTP/1.1 200 OK
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Access-Control-Allow-Origin: *
Date: Tue, 14 May 2019 13:49:53 GMT
Expires: Tue, 14 May 2019 13:49:53 GMT
Cache-Control: private, max-age=20595
Content-Type: application/dns-message
Server: HTTP server (unknown)
Content-Length: 49
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Alt-Svc: quic=":443"; ma=2592000; v="46,44,43,39"
 
??wwwexamplecom?
                Ps]??"^C
$ 
 
 
Tried a few more gmail.google.com, www.youtube.com, news.google.com 
 
So I guess it’s their entire web estate
 
As the obvious thing to test Firefox seems to have no official way to do this but I suspect it would be trivial to allow it. Plus malicious applications / malware etc don’t care about rules so expect them to be using this fact already.
 
--
Alister Winfield.
 
Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD