mirrors/dnscrypt-proxy
1
0
Fork 0
mirror of https://github.com/DNSCrypt/dnscrypt-proxy.git synced 2025-03-04 02:14:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Changes in "Caution!" section. (If something is wrong or it's not needed, plase change, remove etc. Thanks!)

szemley 2021-07-14 14:23:14 +00:00
parent bb8af03079
commit 40bcf8be7f
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
Local-DoH.md

@ -94,6 +94,6 @@ Note that the actual resolvers don't have to be Cloudflare's, and don't have to
In order to revert the changes, set `network.trr.mode` to `0`. Other parameters will then be ignored, so they can be left as-is.
### Caution!
Users have to remember, that enabling `ECH/ESNI` is not enough. The domains Users want to visit, also must have support for Encrypted SNI, as well as for DNSSEC and TLS 1.3 - the fact, that web browsers support these technologies is not sufficient.
User must remember, that enabling `ECH`/`ESNI` is not enough. Generally speaking, the domains which User wants to visit, also must have support for Encrypted SNI, as well as for DNSSEC and TLS 1.3 - the fact, that web browsers support these essential features and advanced protocols - in this situation - is not sufficient and doesn't change anything.
If the above conditions are not met, privacy is not fully assured and/or protected, because - for example - unencrypted Server Name Indication (`SNI`) leaks an information about the origin server (hostname from the TLS handshake etc.), which the client wants to connect and - potentially - allows attacker/network observers obtaining a lot of informations about the client communication. Of course, that's only one example.
If the above conditions are not met, privacy is not fully assured and/or protected, because - for example - unencrypted Server Name Indication (`SNI`) leaks an information about the origin server (hostname from the TLS handshake etc.) with which the client wants to connect and - potentially - allows attacker/network observers obtaining a lot of informations about the client communication. Of course, that's only one example.