Now we just need a an encrypted DNS provider that isn't NSA's puppet...
How to keep your ISP’s nose out of your browser history with encrypted DNS
71–80 of 195 posts
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#72Earlier quoted context omitted.
I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.
how would encrypted SNI work? sure, you can probably do some sort of DHE, but that's vulnerable to MITM, which is why we have certificates to begin with.
What if we could have first class SSL certs for IP addresses? You connect to the IP and verify the cert it presents you with your PKI, then switch to the desired host via SNI or some other mechanism after DHE is established. I suspect you could do this without any extra hops but I haven't really thought through how that would work.
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#73Earlier quoted context omitted.
There are Tor exit nodes which monitor traffic see: https://boingboing.net/2016/07/01/researchers-find-over-100-...
If the traffic is https, in theory they can't link any of that traffic to individuals.
If a party were to, by chance, to monitor both your entry and exit nodes couldn't they match the traffic by time & packet size, et al? Then use known techniques to match pages accessed (it's something like 85% accuracy IIRC).
That would match to individual IP, or potentially an individual if you're logged in.
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#74Earlier quoted context omitted.
Some of us have no use for our ISP's DNS servers, due to government-mandated cencorship.
I was addressing "privacy". It sounds like you have other reasons to not use your ISPs DNS servers. Fair enough.
There aren't many ISP DNS servers that aren't garbage in my experience. Most of them don't send NXDOMAIN. Many of them are slower than either Google or Cloudflare despite being theoretically closer.
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#75From the article it seems like 'DNS over HTTPS' (DoH), seems to be the winner . Seems the authors best advice is to set up DoH via DNSCrypt Proxy 2, possibly using a raspberry pi to make it easier to manage ur whole network. Do people here agree this is a pretty good approach?
I thought that dnscurve was the method to actually prevent domain snooping. Regardless, I think running your own authoritative dns which updates from root servers is the real way to go.
Your traffic still has to go to those servers, so your ISP still can track the terminal server IP, can't it? (TOR, or tunneling aside)
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#76Earlier quoted context omitted.
Buy VPS and install your own VPN. It's much harder to spy on you in this setup and basically requires complicated targeted attack. I'm not sure if common networking setups for VPS record TCP connections, if they do, then VPS provider can record some important metainformation, but it's still not a lot. On the other side with VPN it's much easier to spy on every client.
Sure, however any warrant can get billing data from your hosting provider, or your credit card company will resolve directly to you.
But if your VPS is in a country that's not very friendly to your country, getting data from the hosting provider won't be easy.
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#77If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.
Not all TLS-enabled websites require SNI. I customised an https client so I dont use SNI unless a website requires it. With all due respect, 100% adoption of SNI seems like some sort of popular myth among certain web forum commenters. Perhaps we should do a survey of all websites found on HN on a given day and publish it. I would bet that the majority do not require SNI.
TLS 1.3 mandates it, doesn't it? It's safe to say it's near enough to 100% (of clients sending) to not be worth mentioning outliers like yourself.
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#78Earlier quoted context omitted.
how would encrypted SNI work? sure, you can probably do some sort of DHE, but that's vulnerable to MITM, which is why we have certificates to begin with.
What if we could have first class SSL certs for IP addresses? You connect to the IP and verify the cert it presents you with your PKI, then switch to the desired host via SNI or some other mechanism after DHE is established. I suspect you could do this without any extra hops but I haven't really thought through how that would work.
tls certificates already work out of the box for ip addresses (at least on firefox, see https://1.1.1.1/), so that's actually a pretty neat solution.
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#79If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.
Not all TLS-enabled websites require SNI. I customised an https client so I dont use SNI unless a website requires it. With all due respect, 100% adoption of SNI seems like some sort of popular myth among certain web forum commenters. Perhaps we should do a survey of all websites found on HN on a given day and publish it. I would bet that the majority do not require SNI.
SNI-enabled browsers send the unencrypted hostname in the initial ClientHello frame. It's the first transaction in the protocol, and it's how the server decides the content of the ServerHello reply. There is no way to detect the ability to avoid SNI, or indeed any sensible and generally useful way to tell if a ServerHello varied according to the ClientHello SNI hostname without probing the server, which entails introducing roundtrips, and disclosing the hostname unencrypted at least once on the wire.
Re: How to keep your ISP’s nose out of your browser history with encrypted DNS
#80If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.
While for absolute privacy this makes sense, from a lazy ISP dev perspective, why log packets/IPs if you can get marketing data straight from your DNS servers?
Surely ISPs have taken this easy approach while encryption has been only for fringe users?