Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to keep your ISP’s nose out of your browser history with encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

131–140 of 195 posts

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#131

Post by saurik »

gruez wrote: post #108
hacknat wrote: post #95

Earlier quoted context omitted.

> But that’s vulnerable to MITM It is if that’s all you’re trusting, but you get to check the validity of the cert, so someone could MITM a TLS 1.3, but it wouldn’t do them much good as all they would get is a request for a certificate, then the normal TLS certification steps must proceed. Without the certificate private key the rest of the handshake would fail.

sure, they're not going to MITM your http connection, but they will be able to MITM your certificate connection, which allows them to discover what site you visited, which is the same problem that SNI has.

They can do this, but your browser would retroactively notice that it happened and go "holy shit that was bad, you should complain to someone about it". This does not solve for all threat models, but it does avoid the "snoopy ISP".

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#132

Post by adrianN »

jcoffland wrote: post #86
adrianN wrote: post #3

Earlier quoted context omitted.

VPN is not really a solution because you have no reason to trust your VPN provider more than your ISP.

You usually have a choice of between 1 and 3 ISPs but you can choose from hundreds of VPN services or setup your own on any cloud server. So there is a very good chance you could find someone more trustworthy. Your VPN can exist outside of your legal jurisdiction which could make a huge difference legally.

But unless you work at the VPN provider you don't have enough information to make that choice. You can't tell from the outside whether the VPN provider is logging or not.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#133

Post by purvis »

mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

If what you say is true -- on top of that, your ISP can also (in theory) fingerprint you as someone who is avoiding their DNS servers.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#135

Post by ori_b »

the8472 wrote: post #68
gruez wrote: post #41

Earlier quoted context omitted.

how would encrypted SNI work? sure, you can probably do some sort of DHE, but that's vulnerable to MITM, which is why we have certificates to begin with.

Couldn't the client send SNI after the DH and then the server authenticate the secret? That way MITM would always be detectable at least.

> Couldn't the client send SNI after the DH and then the server authenticate the secret?

That means you can't use sni to route your request to a different server.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#136

Post by nurettin »

adrianN wrote: post #3
woofcat wrote: post #2

Sadly not really a solution yet for SNI being unencrypted. So while they may not see your DNS query they can just use DPI to capture the sites. VPN is a solution but not always deployable.

VPN is not really a solution because you have no reason to trust your VPN provider more than your ISP.

It is a social consideration. Would you trust the government and jurisdiction of Holland or would you rather use DNS services offered by Turkey?

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#137

Post by ori_b »

bscphil wrote: post #72
gruez wrote: post #41

Earlier quoted context omitted.

how would encrypted SNI work? sure, you can probably do some sort of DHE, but that's vulnerable to MITM, which is why we have certificates to begin with.

What if we could have first class SSL certs for IP addresses? You connect to the IP and verify the cert it presents you with your PKI, then switch to the desired host via SNI or some other mechanism after DHE is established. I suspect you could do this without any extra hops but I haven't really thought through how that would work.

> What if we could have first class SSL certs for IP addresses?

They're not routable.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#138

Post by icebraining »

spullara wrote: post #104
stirlo wrote: post #80

Earlier quoted context omitted.

While for absolute privacy this makes sense, from a lazy ISP dev perspective, why log packets/IPs if you can get marketing data straight from your DNS servers? Surely ISPs have taken this easy approach while encryption has been only for fringe users?

Nah. DNS caching would prevent you from seeing every usage of the site. Much better to just log every source ip : dest ip.

IPs are shared, they don't necessarily tell you what site you're accessing.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#139

Post by icebraining »

nurettin wrote: post #130
mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

So if I make an ssh tunnel and use a remote DNS, my ISP can still log requests? How?

That's not what the article is proposing. Still, your home ISP may not be able to, but the ISP of the machine you're SSHing into can.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#140

Post by javajosh »

icebraining wrote: post #138
spullara wrote: post #104

Earlier quoted context omitted.

Nah. DNS caching would prevent you from seeing every usage of the site. Much better to just log every source ip : dest ip.

IPs are shared, they don't necessarily tell you what site you're accessing.

Never thought of virtual hosts as a security feature! But, I guess it is!
Post reply on HN