DoH with authentication for private resolvers about dnscloak HOT 8 OPEN

https://patents.google.com/patent/US9661108

from dnscloak.

dnscrypt-proxy has a query_meta parameter that allows adding arbitrary TXT records to queries. These records will always be encrypted like other records.

The development code of dnscrypt-proxy also supports TLS authentication.

Identification via extra EDNS options is subject to patents issues.

Actually, a custom URL isn't that bad. It is strictly equivalent to HTTP Basic authentication.

from dnscloak.

Thanks for pointing on "query_meta".
"TLS authentication" do you mean certificate based? It may be "heavy" if you need to serve multiple clients.
Custom URL is unsecure w/o TLS 1.3 and SNI encryption. FQDN can leak various ways (e.g. via passive DNS), URL with custom user ID (if is not encrypted) may be intercepted on the line.

from dnscloak.

Identification via extra EDNS options is subject to patents issues.

Can you elaborate this. Who's has patents on this?

from dnscloak.

Weird. EDNS was proposed to address such use cases....

From rfc2671

The Domain Name System's wire protocol includes a number of fixed
fields whose range has been or soon will be exhausted and does not
allow clients to advertise their capabilities to servers. This
document describes backward compatible mechanisms for allowing the
protocol to grow.

from dnscloak.

Anything can be proposed.

Also, what you quoted refers to advertising what parts of the protocol the client implements. It is not about sending configuration data.

from dnscloak.

I can't find query_meta in the UI of 2.2.0 on iOS. Is it meant to be used via the config editor only?

from dnscloak.

BTW Intra (on Android) supports basic HTTP authentication. Can you add support for it (I've tried it in the recent DNSCloak release and it didn't work)?

from dnscloak.