pforemski / dingo

A DNS client in Go that supports Google DNS over HTTPS
761 stars 66 forks source link

Security: Padding done right #33

Open Opensourcecommunitydevelopment opened 7 years ago

Opensourcecommunitydevelopment commented 7 years ago

the current repeats the same char only by 500 times, No respect of actual query or Type length.. Making it pointless/guessable. While there is never a 500 chars domains according To RFC. Useless overhead.

API clients concerned about possible side-channel privacy attacks using the packet sizes of HTTPS GET requests can use this to make all requests exactly the same size by padding requests with random data.

see https://github.com/pforemski/dingo/issues/26