Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to keep your ISP’s nose out of your browser history with encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

41–50 of 195 posts

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#41

Post by gruez »

aaomidi wrote: post #40
mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

how would encrypted SNI work? sure, you can probably do some sort of DHE, but that's vulnerable to MITM, which is why we have certificates to begin with.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#42

Post by chug »

plg wrote: post #33

does/can Pi-Hole use encrypted DNS? I have a raspberry-pi on my home network running Pi-Hole and my router’s DHCP server gives all devices on my network the Pi-Hole as the DNS address

It doesn't have built in support for it since it's just using dnsmasq under the hood, but you can install something like dnscrypt-proxy and then configure pi-hole (i.e. dnsmasq) to use it as its upstream DNS server.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#43

Post by lol768 »

chipperyman573 wrote: post #37
JumpCrisscross wrote: post #10

Dumbass question: is there a difference between setting one’s DNS to https://1.1.1.1 versus 1.1.1.1 unadorned?

DNS Lookup has its own protocol that doesn't work with https. If you send an https request to a DNS server, even if you include all the other parameters required for a DNS lookup, you won't get back a usable response (unless the server has been setup to proxy DNS requests over https, but this comes at a speed cost and increases your server overhead, so it is very uncommon - I've never heard of this happening. edit: a…

1.1.1.1 supports DNS over HTTPS (and TLS). You generally need a local tool running though which acts as a local resolver and does the DNS lookups for you (using HTTPS).

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#44

Post by z3t4 »

mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

You most likely also get faster DNS lookups by using your ISP's DNS servers.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#45

Post by [deleted] »

mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

[deleted]

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#46

Post by muizelaar »

gruez wrote: post #41
aaomidi wrote: post #40

Earlier quoted context omitted.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

how would encrypted SNI work? sure, you can probably do some sort of DHE, but that's vulnerable to MITM, which is why we have certificates to begin with.

https://tools.ietf.org/html/draft-huitema-tls-sni-encryption

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#47

Post by vbezhenar »

aaomidi wrote: post #40
mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

There's nothing good about breaking DPI. Instead of blocking a single site you'll end up blocking entire IP address. I'd even suggest an optional extension of HTTPS which allows to put entire URL as unencrypted part of the request. Censorship systems usually block content by individual pages. Currently with HTTPS it's not possible to block individual page, so an entire website is blocked.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#48

Post by [deleted] »

gruez wrote: post #41
aaomidi wrote: post #40

Earlier quoted context omitted.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

how would encrypted SNI work? sure, you can probably do some sort of DHE, but that's vulnerable to MITM, which is why we have certificates to begin with.

[deleted]

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#49

Post by arkadiyt »

gruez wrote: post #41
aaomidi wrote: post #40

Earlier quoted context omitted.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

how would encrypted SNI work? sure, you can probably do some sort of DHE, but that's vulnerable to MITM, which is why we have certificates to begin with.

There's domain fronting [1] and http/2 certificate frames [2] - they are conceptually similar.

[1]: https://www.bamsoftware.com/papers/fronting/

[2]: https://tools.ietf.org/html/draft-bishop-httpbis-http2-addit...

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#50

Post by Franciscouzo »

vbezhenar wrote: post #47
aaomidi wrote: post #40

Earlier quoted context omitted.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

There's nothing good about breaking DPI. Instead of blocking a single site you'll end up blocking entire IP address. I'd even suggest an optional extension of HTTPS which allows to put entire URL as unencrypted part of the request. Censorship systems usually block content by individual pages. Currently with HTTPS it's not possible to block individual page, so an entire website is blocked.

That would be such a bad idea, lots of websites send data that should be secret on the query parameters.
Post reply on HN