Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to keep your ISP’s nose out of your browser history with encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

61–70 of 195 posts

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#61

Post by tfigment »

evolve2k wrote: post #58

From the article it seems like 'DNS over HTTPS' (DoH), seems to be the winner . Seems the authors best advice is to set up DoH via DNSCrypt Proxy 2, possibly using a raspberry pi to make it easier to manage ur whole network. Do people here agree this is a pretty good approach?

While I'm not everybody, I think its decent and better than the default which is your ISP. Normally pointing directly at google or cloudflare does not hide it from your ISP. I actually just did this yesterday though not with a raspberry pi since I just care about my windows box for now and my router is not open enough to allow this. I think they recommend doing it on your router directly if possible. This helps with Android devices for instance which do not really let you set your DNS easily. I installed DNSCrypt for windows on my desktop and pointed at cloudflare. As others pointed out without a VPN, its only kinda helpful but I figure I don't need to share any more than I really need to with my ISP who I don't trust in general. Also I figure even with VPN anything that slips past the VPN for whatever reason is leaked less to my ISP.

Had an extra benefit of creating a log file of queries so I can see addresses that are being queried. I found NordVPN pinging random websites and wondering why? (To see if I'm blocked apparently)

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#62

Post by Machado117 »

plg wrote: post #33

does/can Pi-Hole use encrypted DNS? I have a raspberry-pi on my home network running Pi-Hole and my router’s DHCP server gives all devices on my network the Pi-Hole as the DNS address

Yes, you can follow the instructions from the wiki https://github.com/pi-hole/pi-hole/wiki/DNSCrypt-2.0

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#63

Post by arca_vorago »

mike-cardwell wrote: post #26
vlovich123 wrote: post #23

Earlier quoted context omitted.

Well if you’re using a VPN then your ISP can’t see much. Some VPNs offer DNS too.

Same argument applies there then. Your VPN provider can already see what websites you're visiting, so use their DNS servers if you can. Don't add yet another third party.

The problem currently is that they aren't getting warrants!

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#64

Post by nandhp »

rnd0 wrote: post #31
mike-cardwell wrote: post #25

Earlier quoted context omitted.

I was addressing "privacy". It sounds like you have other reasons to not use your ISPs DNS servers. Fair enough.

I'm in the same boat. My ISP's DNS servers tend to be very slow and often unresponsive. As a result I've used googles (a bad idea, in retrospect) for the last 10 years or so.

> I've used googles (a bad idea, in retrospect) for the last 10 years or so.

That is a reasonable consideration, but Google is very specific about how they use and retain data collected by Google Public DNS. Assuming they are not lying, I don't think it's a significant concern. (Admittedly, their policy is not as good as Cloudflare's "no IP logging" policy.)

https://developers.google.com/speed/public-dns/privacy

TL;DR: Logs with IP addresses are deleted within 48 hours; permanent logs keep city-level location data, but no personally identifiable information. "We don't correlate or combine information from our temporary or permanent logs with any personal information that you have provided Google for other services."

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#65

Post by shakna »

rnhmjoj wrote: post #35
therealmarv wrote: post #19

Also mentioned in article: Use DNSCrypt Proxy V2 (a golang rewrite) for DNS over TLS and/or DNScurve https://github.com/jedisct1/dnscrypt-proxy E.g. on a Mac with Homebrew. First: brew install dnscrypt-proxy Second: Edit your /usr/local/etc/dnscrypt-proxy.toml and put e.g. google or cloudflare there inside Third: Put your DNS to 127.0.0.1

I'm a bit concerned about using it yet because it was written from scratch just about three months ago and probably hasn't gone through enough testing.

How about an actively-maintained 3-year-old project? [0]

[0] https://github.com/alterstep/dnscrypt-osxclient

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#66

Post by verbify »

Someone1234 wrote: post #36
hawski wrote: post #32

Earlier quoted context omitted.

VPN is just a remote ISP. Of course you have more options, but it's not TOR. Edit: I mean TOR only figuratively.

There are Tor exit nodes which monitor traffic see: https://boingboing.net/2016/07/01/researchers-find-over-100-...

If the traffic is https, in theory they can't link any of that traffic to individuals.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#67

Post by arca_vorago »

evolve2k wrote: post #58

From the article it seems like 'DNS over HTTPS' (DoH), seems to be the winner . Seems the authors best advice is to set up DoH via DNSCrypt Proxy 2, possibly using a raspberry pi to make it easier to manage ur whole network. Do people here agree this is a pretty good approach?

I thought that dnscurve was the method to actually prevent domain snooping. Regardless, I think running your own authoritative dns which updates from root servers is the real way to go.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#68

Post by the8472 »

gruez wrote: post #41
aaomidi wrote: post #40

Earlier quoted context omitted.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

how would encrypted SNI work? sure, you can probably do some sort of DHE, but that's vulnerable to MITM, which is why we have certificates to begin with.

Couldn't the client send SNI after the DH and then the server authenticate the secret? That way MITM would always be detectable at least.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#69

Post by JorgeGT »

paulie_a wrote: post #14
iotku wrote: post #6

Earlier quoted context omitted.

>you have no reason to trust your VPN provider more than your ISP. A lot of people really do distrust their ISP enough that even with knowledge that you're shifting the responsibility to the VPN provider they still trust a random VPN more than their ISP. Would I trust some random unknown VPN provider more than Comcast? Maybe.

I would trust the Russian mob before I would trust Comcast

Well, as in anything human it is a matter of incentives. Comcast probably has an incentive for logging and selling your data to advertisers, whereas the Russian mob probably has other, more pressing things to worry about.

I follow the same logic by setting up my own VPS in a rented $big_provider VPN. VPS companies are succulent targets that surely attract many eyes, whereas I doubt any non-state actor has the capacity of capturing and filtering the traffic of the millions of random VPNs that $big_provider has.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#70

Post by aplorbust »

mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

Not all TLS-enabled websites require SNI. I customised an https client so I dont use SNI unless a website requires it.

With all due respect, 100% adoption of SNI seems like some sort of popular myth among certain web forum commenters.

Perhaps we should do a survey of all websites found on HN on a given day and publish it. I would bet that the majority do not require SNI.

Post reply on HN