Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to keep your ISP’s nose out of your browser history with encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

101–110 of 195 posts

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#101

Post by Cacti »

floatboth wrote: post #76
woofcat wrote: post #60

Earlier quoted context omitted.

Sure, however any warrant can get billing data from your hosting provider, or your credit card company will resolve directly to you.

But if your VPS is in a country that's not very friendly to your country, getting data from the hosting provider won't be easy.

I mean, if you’re trying to defend against a coordinate government attack, you’re boned anyway. They’ll just break into your house and install a sniffer, or arrest you, or make your life hell.

That’s assuming they can’t just get into your home network through zero days, which an individual has no practical defense against.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#102

Post by pkulak »

bigiain wrote: post #89
stirlo wrote: post #80

Earlier quoted context omitted.

While for absolute privacy this makes sense, from a lazy ISP dev perspective, why log packets/IPs if you can get marketing data straight from your DNS servers? Surely ISPs have taken this easy approach while encryption has been only for fringe users?

On the other hand, if I were a curious and amoral ISP dev - I'd consider the people circumventing the "easy approach" to be _much_ more interesting to snoop on...

ISPs want to sell advertising, or data to advertisers. Why bother trying to advertise to a few geeks who are probably running PiHole anyway? Especially since doing that multiplies the hardware requirements 100 fold.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#103

Post by knodi »

rnhmjoj wrote: post #35
therealmarv wrote: post #19

Also mentioned in article: Use DNSCrypt Proxy V2 (a golang rewrite) for DNS over TLS and/or DNScurve https://github.com/jedisct1/dnscrypt-proxy E.g. on a Mac with Homebrew. First: brew install dnscrypt-proxy Second: Edit your /usr/local/etc/dnscrypt-proxy.toml and put e.g. google or cloudflare there inside Third: Put your DNS to 127.0.0.1

I'm a bit concerned about using it yet because it was written from scratch just about three months ago and probably hasn't gone through enough testing.

I used it on my route (netgear with oss firmware) works great.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#104

Post by spullara »

stirlo wrote: post #80
mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

While for absolute privacy this makes sense, from a lazy ISP dev perspective, why log packets/IPs if you can get marketing data straight from your DNS servers? Surely ISPs have taken this easy approach while encryption has been only for fringe users?

Nah. DNS caching would prevent you from seeing every usage of the site. Much better to just log every source ip : dest ip.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#105

Post by _emacsomancer_ »

adrianN wrote: post #3
woofcat wrote: post #2

Sadly not really a solution yet for SNI being unencrypted. So while they may not see your DNS query they can just use DPI to capture the sites. VPN is a solution but not always deployable.

VPN is not really a solution because you have no reason to trust your VPN provider more than your ISP.

For many ISPs, I think we have sufficient grounds for trusting the ISP less than a decent VPN provider.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#106

Post by AlexCoventry »

infogulch wrote: post #93
AlexCoventry wrote: post #81

Earlier quoted context omitted.

> you can probably do some sort of DHE Could the browser send a symmetric key encrypted in the public key of the target website, as part of the initial challenge?

The point is you don't know what the public key of the target website is. You find out by asking for it, and then you verify it's authenticity by checking the signature. Before you connect all you know is the domain and the keys of CA's you trust.

Ah, right. Thanks.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#107

Post by StillBored »

berkut wrote: post #5

I'm probably being really stupid, but how does using encrypted DNS prevent your ISP seeing what websites you go to? (I haven't done network stuff for many years, and am a bit out of touch with the current stuff). Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection…

Just to add another point I don't see mentioned. For sites hosted on godaddy like shared hosting plans it makes it a lot harder because a single IP frequently resolves to a dozen or so actual sites.

How many sites being visited fit this model? Fewer everyday, but it seems a lot of non-mainstream content is still hosted on smaller shared hosting plans.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#108

Post by gruez »

hacknat wrote: post #95
gruez wrote: post #41

Earlier quoted context omitted.

how would encrypted SNI work? sure, you can probably do some sort of DHE, but that's vulnerable to MITM, which is why we have certificates to begin with.

> But that’s vulnerable to MITM It is if that’s all you’re trusting, but you get to check the validity of the cert, so someone could MITM a TLS 1.3, but it wouldn’t do them much good as all they would get is a request for a certificate, then the normal TLS certification steps must proceed. Without the certificate private key the rest of the handshake would fail.

sure, they're not going to MITM your http connection, but they will be able to MITM your certificate connection, which allows them to discover what site you visited, which is the same problem that SNI has.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#110

Post by tempz »

I cannot begin to understand how is it better to reveal your DNS access patterns to the global company like Cloudflare, as opposed to revealing them to your local ISP?

Who do you think can smoother monetize your data - your local ISP or Cloudflare? Or maybe Cloudflare solemnly promised never to do it?

If an effort is to be taken, the best thing is to run your own DNS resolver that will query root servers and follow the chains directly.

Post reply on HN