Sadly not really a solution yet for SNI being unencrypted. So while they may not see your DNS query they can just use DPI to capture the sites. VPN is a solution but not always deployable.
I wonder when someone is going to take on the task of figuring out how to encrypt SNI
How to keep your ISP’s nose out of your browser history with encrypted DNS
21–30 of 195 posts
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#22Dumbass question: is there a difference between setting one’s DNS to https://1.1.1.1 versus 1.1.1.1 unadorned?
[deleted]
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#23If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.
Well if you’re using a VPN then your ISP can’t see much. Some VPNs offer DNS too.
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#24If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.
Some of us have no use for our ISP's DNS servers, due to government-mandated cencorship.
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#25If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.
Some of us have no use for our ISP's DNS servers, due to government-mandated cencorship.
I was addressing "privacy". It sounds like you have other reasons to not use your ISPs DNS servers. Fair enough.
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#26If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.
Well if you’re using a VPN then your ISP can’t see much. Some VPNs offer DNS too.
Same argument applies there then. Your VPN provider can already see what websites you're visiting, so use their DNS servers if you can. Don't add yet another third party.
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#27If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.
Well if you’re using a VPN then your ISP can’t see much. Some VPNs offer DNS too.
I've spoken to some folks that worked in the VPN provider industry... many of them aren't the bastion of consumer protection they claim/are perceived to be. With the exception of Tor (and even that has been found to have problems) I'm not sure "single-point" anything will really provide you with anonymity.
I think it really comes down to your threat model though and what tradeoffs you're willing to accept for anonymity (e.g. captchas, performance, etc).
I think the sweet spot for CloudFlare's offering is if you're in a country or service provider that takes liberties in overriding DNS responses.
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#28I'm probably being really stupid, but how does using encrypted DNS prevent your ISP seeing what websites you go to? (I haven't done network stuff for many years, and am a bit out of touch with the current stuff). Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection…
It's worth mentioning that encrypted DNS is not just about privacy, but also integrity. It's more difficult to intercept or spoof in hostile networks.
ISP can still see the target IP address and SNI. The IP address is sometimes meaningful (single website), but not if it's a CDN or a multi-tenant server. The SNI is being worked on (encrypted SNI, ORIGIN frame, CERTIFICATE frame). The point is none of that matters without encrypted DNS.
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#29I'm probably being really stupid, but how does using encrypted DNS prevent your ISP seeing what websites you go to? (I haven't done network stuff for many years, and am a bit out of touch with the current stuff). Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection…
It increases the cost and complexity of an ISP tracking you, which is a win within itself. Plus some services share public IPs or are behind a global cache (e.g. Cloudflare) making it harder to pinpoint exactly which endpoint you tried to access. Is it perfect? No. It is better than yesterday? Yes. I call these "micro-wins." One micro-win won't make a difference, but two, three, four, and so on eventually start to ha…
Not sure why you're being downvoted; as tescos says here in the UK, every little helps :)
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#30[deleted]