DNS over HTTPS (DoH) – Obfuscating the Resolver

Future of Network Censorship and Plaintext

In this season finale, we explore how encryption and obfuscation tools are adapting to advanced censorship. Topics include potential client-side backdoors, the centralization of encrypted services, and the role of grassroots tech communities. This concluding discussion frames key challenges and possibilities for future internet governance and user privacy.

MASQUE – Tunneling Through HTTP

MASQUE (sometimes spelled “mask”) expands on HTTPS-based tunneling to conceal additional traffic types, including IP-level tunnels. You’ll look at how MASQUE can make censorship more difficult by blending various protocols into HTTP/3 streams. There is a broader reflection here on protocol “camouflage” and how the arms race escalates as new protocols offer stronger obfuscation against state or ISP-level meddling.

Encrypted Client Hello (ECH) – Cloaking the Handshake

TLS used to expose data like Server Name Indication during the handshake. Encrypted Client Hello (ECH) fixes that by encrypting handshake info, defeating SNI-based blocking. This episode covers how ECH works, its adoption push, and how censors might react. It also explores the privacy vs. visibility debate between users and network operators focused on security.

DNS over HTTPS (DoH) – Obfuscating the Resolver

Shifting into the encryption era, you introduce DNS over HTTPS (DoH) and explain how it attempts to shield DNS queries from on-path observers. This episode investigates the controversies around DoH—whether centralization of DNS resolvers shifts power to big tech, and whether it genuinely thwarts censorship or simply moves the choke point to another layer (e.g., government regulation of public DoH endpoints).

DNS – The Original Plaintext Protocol

This episode explores how DNS, traditionally in plaintext, exposes user intentions and becomes a target for censorship via spoofing, redirection, or injection. It covers classic DNS-based blocking tactics and examines how the fragmented, distributed nature of the DNS ecosystem influences censorship approaches.