Re: [hrpc] "Paul Vixie and Peter Lowe on Why DoH is Politically Motivated"

[Vittorio Bertola <[e-mail]>]

> Il 15/11/2021 20:20 Eric Rescorla <[e-mail]> ha scritto:
> 
> However, at present, it is generally possible to filter DoH because
> DoH and ordinary HTTPS are usually on different hosts and therefore
> you can use SNI. It's true that it's possible to co-host DoH in such a
> way that it is indistinguishable from non-DoH HTTPS traffic, but it is
> *also* possible to co-host DoT and HTTPS in this way, provided that
> (1) you use a non-standard port and (2) you use ECH. The point here is
> that either DoH or DoT can be run in a way that makes it hard to filter
> if that's what you're trying to do.
> 
That's exactly why the difference between DoT and DoH is political way more than technical: I trust you that both may be used in ways that make them hard to block, but for DoT it is an unintended consequence, while for DoH it is an intended objective of the designers, stated in the specification itself and in several public statements.

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[e-mail] mailto:[e-mail]
Office @ Via Treviso 12, 10144 Torino, Italy