So I logged in to my bitwarden account through the appimage, but I didn’t have dns-over-https enabled. I was wondering if it’s possible to be attacked by dns-spoofing this way. What url/ip does the appimage visit? I’m going to verify the appimage itself by comparing its hash with a legitimate copy, but that shouldn’t be enough.
DNS spoofing is useful only in case of HTTP-connections. Almost everything is now using TLS-based protocols like HTTPS including Bitwarden of course. So even if some attacker spoof your DNS records, application won’t load anything after not passing certificate check.
DNS-over-HTTPS(-TLS, -QUIC) is a nice addition, but it is mostly needed to just hide your DNS requests from ISP (or basically any other 3rd party).
1 Like