11–20 of 195 posts
Isn't there an option to polute the information the ISP sees to such a level that their information is useless? E.g. contact a friendly service that gives back N different random domain names; then lookup those domain names, spread over, say, an hour; then repeat.
Sadly not really a solution yet for SNI being unencrypted. So while they may not see your DNS query they can just use DPI to capture the sites. VPN is a solution but not always deployable.
I'm probably being really stupid, but how does using encrypted DNS prevent your ISP seeing what websites you go to? (I haven't done network stuff for many years, and am a bit out of touch with the current stuff). Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection…
The slightly bigger problem is HTTPS with SNI, which leaks the host header in plain text before establishing the connection. It's an unfortunate necessity as long as hosting providers need to use virtual hosts behind a shared IP address, but it's also one more potential snooping vector to deal with.
Earlier quoted context omitted.
VPN is not really a solution because you have no reason to trust your VPN provider more than your ISP.
>you have no reason to trust your VPN provider more than your ISP. A lot of people really do distrust their ISP enough that even with knowledge that you're shifting the responsibility to the VPN provider they still trust a random VPN more than their ISP. Would I trust some random unknown VPN provider more than Comcast? Maybe.
I'm probably being really stupid, but how does using encrypted DNS prevent your ISP seeing what websites you go to? (I haven't done network stuff for many years, and am a bit out of touch with the current stuff). Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection…
It doesn't do this by itself. It just prevents one method of data collection.
The ISP can easily connect your IP to your subscriber information, and their DNS can log every lookup made by your IP. Even if you use another DNS, since it's unencrypted, they can (and likely do) sniff that traffic and collect the same information.
> Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that?
Sure, but this requires a slightly higher level of effort, and also assumes that you're not connecting to a CDN, which can make your requests pretty opaque.
> Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection is made first which would be sniffable?
Right, and even with SNI, the requested hostname is still sent in the clear. I hope this will be fixed somehow in future implementations. In the meantime, if you need to treat your ISP as absolutely hostile, then you need a VPN or some other kind of encrypted tunnel or proxy.
Sadly not really a solution yet for SNI being unencrypted. So while they may not see your DNS query they can just use DPI to capture the sites. VPN is a solution but not always deployable.
VPN is not really a solution because you have no reason to trust your VPN provider more than your ISP.
Dumbass question: is there a difference between setting one’s DNS to https://1.1.1.1 versus 1.1.1.1 unadorned?
Sadly not really a solution yet for SNI being unencrypted. So while they may not see your DNS query they can just use DPI to capture the sites. VPN is a solution but not always deployable.
VPN is not really a solution because you have no reason to trust your VPN provider more than your ISP.
Yeah, my VPN provider could be lying to me and logging a whole bunch of extra data under the table. But I know my ISP is logging that data. I have every reason to trust a paid VPN provider more than my ISP because my VPN provider is basing their business model on me trusting them, not on being a monopoly.
Not to mention that VPNs also help at least a bit with anonymizing IP addresses. The trust model I have with directly exposing my IP to a website is "I hope nobody I visit on the Internet is logging this."
If I'm wrong and my VPN is logging everything, I'll still be in a better position than I was with my ISP, because at least I won't be broadcasting my current physical location to every single website I visit.
E.g. on a Mac with Homebrew. First:
brew install dnscrypt-proxy
Third: Put your DNS to 127.0.0.1
Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI.
The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.