[Android Software/Hacking General [Developers Only]] MrT69:
Sorry for the delay but I have hat still technical challenges. ?

OK, let's talk about DoH vs. DoT and in addition dnscrypt-proxy.

1. DoT, DoH and DNSCrypt is safe DNS

Wrong. A lot of people think when they are using encrypted DNS requests then logging or profile analytics is not longer possible. Double wrong.

How does this encryption work?

1. You establish a tunnel to the DNS Server

2. Via this tunnel you send the DNS requests

3. The server behind this tunnel accept the request

4. Based on your IP Adress the Server process this request

5. At this point you IP Address and the answer can be logged

6. The Server encrypt the answer

7. The Server transmit the answer to your device.

The only advantage is the fact that no one can read any longer the Server response between the DNS Server and your device.

2. Do they log?

Yes. That's 100% proof. I have had 2 Meetings with Mobile phone provider. I was asking to have the option to offer keweon via SIM card. Plug in the Card and get the DNS Server via the Provider. Of cause, I'm not talking about the current System because this is to unstable and contains too much errors. Anyway. They have no interests about this because then they don't get any longer the Data for there DNS Server. I don't know what they do and what exactly they are collecting and they don't answered this question.

3. The difference of DoH, DoT and dnscrypt

DNSCRYPT has the advantage that this is high encrypted and the most secure option you can choose. But this has also a big disadvantage. Every single package will encapsulated into a 8kb container. Sounds not so much but if you calculate about 20.000 to 60.000 (60.000 is high Mobile usage) DNS requests per DAY then you will be shocked about the traffic only just for DNS. I have no problem with security but if this blows my traffic limit away just for secure DNS transmission then it's not a solution. From my point of view this is the biggest stupid idea to use DNSCrypt on a default mobile device when you have a traffic limit.

DoH and DoT offers also both security. It's the same procedure with logging option on the Server. Only the Internet transport is protected. Both Options has advantages and disadvantages. For a Server to Server communication or if you have high DNS requests then I recommend to use DoT. DoH is invented by Google based on the HTTPS Web-server communication they have invented this Protocol.

4. DoH vs. DoT

I would prefers to use the DoH protocol but based on the fact that Android has this client build within the OS I'm always on DoT Server. No additional client and its working.

5. Prevent Data logging

I have had 96 Investor Meetings since 2016 with one shocking result. Everyone wants to have our Data. If I would agree to data collection then even a 30 Million invest would be not a problem. No kidding. But I'm hard against this and I even want to have a F-Root Server copy within my Infrastructure to make sure that no one can collect any longer any user Data. But just having them is not a cheap thing. I would need a Data center location, minimum of 2 DELL Server because they only install it on DELL Server. Each of the Server would cost round about 7.000 Euro.

Based on the feedback from Mobile provider you can now imagine that none of the security things we are doing will really prevent 100% this annoying data logging.

6. Summary

Of cause Data encryption things will help in a minimum way to prevent Data logging because of round Robin and the fact that a lot of DoH and DoT Server are outside. Its almost not longer possible that your IP Address is logged by the big Data collection Players. A lot of companies already warning about the DoT and DoH technology because they don't get any longer user data. On the other Hand this DNS encryption will cost a lot of traffic. Google DNS Server process round about 900.000 requests per second. If you calculate this then you will see that this is a real huge traffic if they would serve this encrypted. My personal recommendation is to use whatever you can use to encrypt your DNS requests. It will not help to prevent 100% data logging, creating moving profiles or even prevent Censorship. But it is harder for them to get the Data and its more expensive for them.