Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to keep your ISP’s nose out of your browser history with encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

1–10 of 195 posts

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#3

Post by adrianN »

woofcat wrote: post #2

Sadly not really a solution yet for SNI being unencrypted. So while they may not see your DNS query they can just use DPI to capture the sites. VPN is a solution but not always deployable.

VPN is not really a solution because you have no reason to trust your VPN provider more than your ISP.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#4

Post by amelius »

Isn't there an option to polute the information the ISP sees to such a level that their information is useless?

E.g. contact a friendly service that gives back N different random domain names; then lookup those domain names, spread over, say, an hour; then repeat.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#5

Post by berkut »

I'm probably being really stupid, but how does using encrypted DNS prevent your ISP seeing what websites you go to? (I haven't done network stuff for many years, and am a bit out of touch with the current stuff).

Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection is made first which would be sniffable?

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#6

Post by iotku »

adrianN wrote: post #3
woofcat wrote: post #2

Sadly not really a solution yet for SNI being unencrypted. So while they may not see your DNS query they can just use DPI to capture the sites. VPN is a solution but not always deployable.

VPN is not really a solution because you have no reason to trust your VPN provider more than your ISP.

>you have no reason to trust your VPN provider more than your ISP.

A lot of people really do distrust their ISP enough that even with knowledge that you're shifting the responsibility to the VPN provider they still trust a random VPN more than their ISP.

Would I trust some random unknown VPN provider more than Comcast? Maybe.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#7

Post by detaro »

berkut wrote: post #5

I'm probably being really stupid, but how does using encrypted DNS prevent your ISP seeing what websites you go to? (I haven't done network stuff for many years, and am a bit out of touch with the current stuff). Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection…

Not stupid. It makes it harder for the ISP (just grabbing and reading DNS traffic is a very convenient way of getting this information), but it's still visible if they look at all your connections. IPs alone aren't great (e.g. CDNs conflate a lot of domains under one IP), but if they look inside the traffic they can still get the full domains.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#8

Post by gsnedders »

berkut wrote: post #5

I'm probably being really stupid, but how does using encrypted DNS prevent your ISP seeing what websites you go to? (I haven't done network stuff for many years, and am a bit out of touch with the current stuff). Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection…

Also TLS SNI transmits the hostname in plaintext at the start of the TLS handshake.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#9

Post by Someone1234 »

berkut wrote: post #5

I'm probably being really stupid, but how does using encrypted DNS prevent your ISP seeing what websites you go to? (I haven't done network stuff for many years, and am a bit out of touch with the current stuff). Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection…

It increases the cost and complexity of an ISP tracking you, which is a win within itself. Plus some services share public IPs or are behind a global cache (e.g. Cloudflare) making it harder to pinpoint exactly which endpoint you tried to access.

Is it perfect? No. It is better than yesterday? Yes.

I call these "micro-wins." One micro-win won't make a difference, but two, three, four, and so on eventually start to have an impact. And that's all we can hope for.

Even often cited VPNs just shift the problem downstream. Instead of your ISP monitoring you, the VPN provider themselves could, or if you host it yourself then your server/virtual server's ISP could. VPNs themselves are another "micro-win" but people often claim they're a complete bulletproof solution.

Post reply on HN