Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to keep your ISP’s nose out of your browser history with encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

91–100 of 195 posts

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#91

Post by kim0 »

rnhmjoj wrote: post #35
therealmarv wrote: post #19

Also mentioned in article: Use DNSCrypt Proxy V2 (a golang rewrite) for DNS over TLS and/or DNScurve https://github.com/jedisct1/dnscrypt-proxy E.g. on a Mac with Homebrew. First: brew install dnscrypt-proxy Second: Edit your /usr/local/etc/dnscrypt-proxy.toml and put e.g. google or cloudflare there inside Third: Put your DNS to 127.0.0.1

I'm a bit concerned about using it yet because it was written from scratch just about three months ago and probably hasn't gone through enough testing.

I'm using this daily and it's rock solid. Good job there

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#92

Post by libdjml »

bigiain wrote: post #89
stirlo wrote: post #80

Earlier quoted context omitted.

While for absolute privacy this makes sense, from a lazy ISP dev perspective, why log packets/IPs if you can get marketing data straight from your DNS servers? Surely ISPs have taken this easy approach while encryption has been only for fringe users?

On the other hand, if I were a curious and amoral ISP dev - I'd consider the people circumventing the "easy approach" to be _much_ more interesting to snoop on...

True, although what are they going to do with the data? If it’s primarily for selling to ad companies, a tiny slice of privacy minded people aren’t worth much.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#93

Post by infogulch »

AlexCoventry wrote: post #81
gruez wrote: post #41

Earlier quoted context omitted.

how would encrypted SNI work? sure, you can probably do some sort of DHE, but that's vulnerable to MITM, which is why we have certificates to begin with.

> you can probably do some sort of DHE Could the browser send a symmetric key encrypted in the public key of the target website, as part of the initial challenge?

The point is you don't know what the public key of the target website is. You find out by asking for it, and then you verify it's authenticity by checking the signature. Before you connect all you know is the domain and the keys of CA's you trust.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#94

Post by throw2016 »

This preoccupation with ISPs is akin to concern about a pin prick while blood gushes out of knife wound unattended.

All sorts of solutions are offered enthusiastically while the elephant in the room, tens of thousand of engineers and billion dollar companies incentivized to hoover up and collate every minutiae of user data as a business model, is met with hand wringing and apologism about ad revenue.

In this case solutions have to emerge from outside the tech community by something like GDPR. Given that reality and the primacy of ad driven business models in SV its difficult to contextualize this preoccupation with ISPs. It feels like a distraction, insincere and driven by commercial concerns.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#95

Post by hacknat »

gruez wrote: post #41
aaomidi wrote: post #40

Earlier quoted context omitted.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

how would encrypted SNI work? sure, you can probably do some sort of DHE, but that's vulnerable to MITM, which is why we have certificates to begin with.

> But that’s vulnerable to MITM

It is if that’s all you’re trusting, but you get to check the validity of the cert, so someone could MITM a TLS 1.3, but it wouldn’t do them much good as all they would get is a request for a certificate, then the normal TLS certification steps must proceed. Without the certificate private key the rest of the handshake would fail.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#96

Post by therealmarv »

shakna wrote: post #65
rnhmjoj wrote: post #35

Earlier quoted context omitted.

I'm a bit concerned about using it yet because it was written from scratch just about three months ago and probably hasn't gone through enough testing.

How about an actively-maintained 3-year-old project? [0] [0] https://github.com/alterstep/dnscrypt-osxclient

I used that one before. I don't like it technically. It only supports DNScurve and installs itself deeply into the system (e.g. system preferences). I also think it's more unreliable because they don't do the caching in a good way (sometimes a DNS server fails is my experience). I like dnscrypt proxy V2 more because it's more rock solid, works better on caching and also supports DNS over TLS. Only downside on dnscrypt proxy is that you don't have a nice UI and you have to type the local DNS 127.0.0.1 manually into your Wifi or LAN connection point.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#97

Post by eastdakota »

aaomidi wrote: post #40
mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

We’re working on it.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#98

Post by jedisct1 »

therealmarv wrote: post #96
shakna wrote: post #65

Earlier quoted context omitted.

How about an actively-maintained 3-year-old project? [0] [0] https://github.com/alterstep/dnscrypt-osxclient

I used that one before. I don't like it technically. It only supports DNScurve and installs itself deeply into the system (e.g. system preferences). I also think it's more unreliable because they don't do the caching in a good way (sometimes a DNS server fails is my experience). I like dnscrypt proxy V2 more because it's more rock solid, works better on caching and also supports DNS over TLS. Only downside on dnscryp…

I use this as an UI for dnscrypt-proxy v2: https://getbitbar.com/plugins/Network/dnscrypt-proxy-switche...

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#99

Post by jedisct1 »

shakna wrote: post #65
rnhmjoj wrote: post #35

Earlier quoted context omitted.

I'm a bit concerned about using it yet because it was written from scratch just about three months ago and probably hasn't gone through enough testing.

How about an actively-maintained 3-year-old project? [0] [0] https://github.com/alterstep/dnscrypt-osxclient

Not maintained any more.

A new macOS GUI would be really great.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#100

Post by Cacti »

hawski wrote: post #32
vlovich123 wrote: post #23

Earlier quoted context omitted.

Well if you’re using a VPN then your ISP can’t see much. Some VPNs offer DNS too.

VPN is just a remote ISP. Of course you have more options, but it's not TOR. Edit: I mean TOR only figuratively.

So? What if the VPN doesn’t know who you are? What if it’s your own VPN but others don’t know that?

The entire point of choosing a good VPN is to get the visible data off of your immediate ISP, since they know who you are, and into a more nebulous net, where others do not.

Post reply on HN