How to keep your ISP’s nose out of your browser history with encrypted DNS • Hacker News Board

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#111

Post by bigiain » Mon, Apr 09, 2018, 1:35 AM UTC

pkulak wrote: post #102

bigiain wrote: post #89

Earlier quoted context omitted.

On the other hand, if I were a curious and amoral ISP dev - I'd consider the people circumventing the "easy approach" to be _much_ more interesting to snoop on...

ISPs want to sell advertising, or data to advertisers. Why bother trying to advertise to a few geeks who are probably running PiHole anyway? Especially since doing that multiplies the hardware requirements 100 fold.

Possibly because the people who you can sell that data to are prepared to pay way more per "product" than the people trying to sell you fast moving consumer goods or ICO de jour...

Wouldn't surprise me at all to find there's a market where intelligence services can purchase lists of TOR users - for example...

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#112

Post by supertrope » Mon, Apr 09, 2018, 1:44 AM UTC

throw2016 wrote: post #94

This preoccupation with ISPs is akin to concern about a pin prick while blood gushes out of knife wound unattended. All sorts of solutions are offered enthusiastically while the elephant in the room, tens of thousand of engineers and billion dollar companies incentivized to hoover up and collate every minutiae of user data as a business model, is met with hand wringing and apologism about ad revenue. In this case sol…

I agree. To play devil's advocate you can choose not to use Facebook or Gmail or Android. In many areas (of USA) there's exactly two choices for Internet access, and in some there's only one. Additionally the quid pro quo of free online services for personal data may be considered less objectionable than additional monetization on top of the monthly fee.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#113

Post by microwavecamera » Mon, Apr 09, 2018, 1:47 AM UTC

stirlo wrote: post #80

mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

While for absolute privacy this makes sense, from a lazy ISP dev perspective, why log packets/IPs if you can get marketing data straight from your DNS servers? Surely ISPs have taken this easy approach while encryption has been only for fringe users?

Data mining is big money. They can glean in insane amount of personal information about you based on the sites you go, aside from the fact they already know who you are.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#114

Post by StillBored » Mon, Apr 09, 2018, 2:02 AM UTC

mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

That is true in my case, but my ISP has in the past redirected various queries to their landing/search pages, which means that I simply don't use them anymore.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#115

Post by quickthrower2 » Mon, Apr 09, 2018, 2:06 AM UTC

itakedrugs wrote: post #71

Now we just need a an encrypted DNS provider that isn't NSA's puppet...

Namecoin?

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#116

Post by [deleted] » Mon, Apr 09, 2018, 2:09 AM UTC

StillBored wrote: post #114

mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

That is true in my case, but my ISP has in the past redirected various queries to their landing/search pages, which means that I simply don't use them anymore.

[deleted]

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#117

Post by bo1024 » Mon, Apr 09, 2018, 2:13 AM UTC

tempz wrote: post #110

I cannot begin to understand how is it better to reveal your DNS access patterns to the global company like Cloudflare, as opposed to revealing them to your local ISP? Who do you think can smoother monetize your data - your local ISP or Cloudflare? Or maybe Cloudflare solemnly promised never to do it? If an effort is to be taken, the best thing is to run your own DNS resolver that will query root servers and follow t…

I assume it has something to do with how easy it is to connect your data with other aspects of your identity. Presumably with an ISP it is associated with the name of the subscriber, whereas there is some chance with other DNS servers that this is untrue.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#118

Post by [deleted] » Mon, Apr 09, 2018, 2:21 AM UTC

pbhjpbhj wrote: post #73

verbify wrote: post #66

Earlier quoted context omitted.

If the traffic is https, in theory they can't link any of that traffic to individuals.

If a party were to, by chance, to monitor both your entry and exit nodes couldn't they match the traffic by time & packet size, et al ? Then use known techniques to match pages accessed (it's something like 85% accuracy IIRC). That would match to individual IP, or potentially an individual if you're logged in.

[deleted]

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#119

Post by alwillis » Mon, Apr 09, 2018, 2:25 AM UTC

tomcooks wrote: post #17

JumpCrisscross wrote: post #10

Dumbass question: is there a difference between setting one’s DNS to https://1.1.1.1 versus 1.1.1.1 unadorned?

I am not a sysadmin but you can't add https:// (or any other prefix) in front of a DNS address. Secure HTTP is a different protocol, suited for web page hosting.

DNS over HTTPS (DoH) works in the latest Firefox Nightly: https://facebookexperimental.github.io/doh-proxy/tutorials/f...

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#120

Post by stordoff » Mon, Apr 09, 2018, 2:34 AM UTC

StillBored wrote: post #107

berkut wrote: post #5

I'm probably being really stupid, but how does using encrypted DNS prevent your ISP seeing what websites you go to? (I haven't done network stuff for many years, and am a bit out of touch with the current stuff). Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection…

Just to add another point I don't see mentioned. For sites hosted on godaddy like shared hosting plans it makes it a lot harder because a single IP frequently resolves to a dozen or so actual sites. How many sites being visited fit this model? Fewer everyday, but it seems a lot of non-mainstream content is still hosted on smaller shared hosting plans.

Even if not actually on shared hosting, there's a fair chance the site will be behind a shared CDN (e.g. CloudFlare). Doesn't really help while SNI is in the clear, but it's a start.