Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to keep your ISP’s nose out of your browser history with encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

51–60 of 195 posts

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#51

Post by jakobdabo »

vbezhenar wrote: post #47
aaomidi wrote: post #40

Earlier quoted context omitted.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

There's nothing good about breaking DPI. Instead of blocking a single site you'll end up blocking entire IP address. I'd even suggest an optional extension of HTTPS which allows to put entire URL as unencrypted part of the request. Censorship systems usually block content by individual pages. Currently with HTTPS it's not possible to block individual page, so an entire website is blocked.

TLS and HTTP are different things. TLS is being used without HTTP in lots of cases.

Besides, even if such extension had existed it would've been easy to write X in TLS header and Y in the HTTP payload to circumvent the ban, like the domain fronting[1] trick currently being used by e.g. Signal.

[1] https://en.wikipedia.org/wiki/Domain_fronting

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#52

Post by jakobdabo »

aaomidi wrote: post #40
mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

Getting rid of plaintext SNI won't help much.

The domain is there in the certificate itself. There are, of course, some (or maybe many, I don't have statistics) certificates for multiple domains (wildcard and alt. name), but still.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#53

Post by cesarb »

jakobdabo wrote: post #52
aaomidi wrote: post #40

Earlier quoted context omitted.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

Getting rid of plaintext SNI won't help much. The domain is there in the certificate itself. There are, of course, some (or maybe many, I don't have statistics) certificates for multiple domains (wildcard and alt. name), but still.

> The domain is there in the certificate itself.

With TLS 1.3, the certificate is in the encrypted portion of the handshake.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#54

Post by vbezhenar »

natbobc wrote: post #27
vlovich123 wrote: post #23

Earlier quoted context omitted.

Well if you’re using a VPN then your ISP can’t see much. Some VPNs offer DNS too.

I've spoken to some folks that worked in the VPN provider industry... many of them aren't the bastion of consumer protection they claim/are perceived to be. With the exception of Tor (and even that has been found to have problems) I'm not sure "single-point" anything will really provide you with anonymity. I think it really comes down to your threat model though and what tradeoffs you're willing to accept for anonymi…

Buy VPS and install your own VPN. It's much harder to spy on you in this setup and basically requires complicated targeted attack. I'm not sure if common networking setups for VPS record TCP connections, if they do, then VPS provider can record some important metainformation, but it's still not a lot. On the other side with VPN it's much easier to spy on every client.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#55

Post by dfee »

StanislavPetrov wrote: post #16
adrianN wrote: post #3

Earlier quoted context omitted.

VPN is not really a solution because you have no reason to trust your VPN provider more than your ISP.

Its better than no solution, and you aren't limited to using one VPN. A dozen VPN providers each with 8% of your browsing history is still bad, but far preferable to an ISP with 100%.

Is it? I would guess that people already split their traffic between a home workstation connected through a local ISP, a mobile phone connected through a national carrier ISP, and a work computer that is connected with a (third) enterprise ISP. The concerns that linger in the comments here, are about the dangers of exposing even a slice of your metadata can be disastrous.

Therefore, going from three to eight ISPs is arguably worse as your exposed to nearly 3x the risk of exposure.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#56

Post by gruez »

arkadiyt wrote: post #49
gruez wrote: post #41

Earlier quoted context omitted.

how would encrypted SNI work? sure, you can probably do some sort of DHE, but that's vulnerable to MITM, which is why we have certificates to begin with.

There's domain fronting [1] and http/2 certificate frames [2] - they are conceptually similar. [1]: https://www.bamsoftware.com/papers/fronting/ [2]: https://tools.ietf.org/html/draft-bishop-httpbis-http2-addit...

both of them seem to use the concept of "connect via a fake domain name, then connect to the real domain". i'm not sure how this is scaleable for everyday browsing. you might be able to find the fronting server for wikipedia, but how are you going to find the fronting server for every website you're visiting? this solves the problem of censorship, but not the problem of ISP surveillance.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#57

Post by jakobdabo »

cesarb wrote: post #53
jakobdabo wrote: post #52

Earlier quoted context omitted.

Getting rid of plaintext SNI won't help much. The domain is there in the certificate itself. There are, of course, some (or maybe many, I don't have statistics) certificates for multiple domains (wildcard and alt. name), but still.

> The domain is there in the certificate itself. With TLS 1.3, the certificate is in the encrypted portion of the handshake.

That's nice to hear. I stand corrected, thank you.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#58

Post by evolve2k »

From the article it seems like 'DNS over HTTPS' (DoH), seems to be the winner. Seems the authors best advice is to set up DoH via DNSCrypt Proxy 2, possibly using a raspberry pi to make it easier to manage ur whole network.

Do people here agree this is a pretty good approach?

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#59

Post by cesarb »

mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

Not every DNS query is going to be followed by a HTTP or HTTPS connection. You also have queries for other protocols; queries which are never followed by a connection because the response was "this name doesn't exist"; "leaked" queries for internal hostnames; queries which were just to check if a name exists; and reverse (PTR) queries.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#60

Post by woofcat »

vbezhenar wrote: post #54
natbobc wrote: post #27

Earlier quoted context omitted.

I've spoken to some folks that worked in the VPN provider industry... many of them aren't the bastion of consumer protection they claim/are perceived to be. With the exception of Tor (and even that has been found to have problems) I'm not sure "single-point" anything will really provide you with anonymity. I think it really comes down to your threat model though and what tradeoffs you're willing to accept for anonymi…

Buy VPS and install your own VPN. It's much harder to spy on you in this setup and basically requires complicated targeted attack. I'm not sure if common networking setups for VPS record TCP connections, if they do, then VPS provider can record some important metainformation, but it's still not a lot. On the other side with VPN it's much easier to spy on every client.

Sure, however any warrant can get billing data from your hosting provider, or your credit card company will resolve directly to you.
Post reply on HN