Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to keep your ISP’s nose out of your browser history with encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

141–150 of 195 posts

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#141

Post by infogulch »

ori_b wrote: post #135
the8472 wrote: post #68

Earlier quoted context omitted.

Couldn't the client send SNI after the DH and then the server authenticate the secret? That way MITM would always be detectable at least.

> Couldn't the client send SNI after the DH and then the server authenticate the secret? That means you can't use sni to route your request to a different server.

Yes, whatever is serving on that interface will have to terminate TLS. Or somehow pass the session information to the proxied server, or ask the client to reconnect, or do some kind of tls tunneling from the client to the real host. I don't think any of those are unreasonable options.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#142

Post by Sephr »

Someone1234 wrote: post #9
berkut wrote: post #5

I'm probably being really stupid, but how does using encrypted DNS prevent your ISP seeing what websites you go to? (I haven't done network stuff for many years, and am a bit out of touch with the current stuff). Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection…

It increases the cost and complexity of an ISP tracking you, which is a win within itself. Plus some services share public IPs or are behind a global cache (e.g. Cloudflare) making it harder to pinpoint exactly which endpoint you tried to access. Is it perfect? No. It is better than yesterday? Yes. I call these "micro-wins." One micro-win won't make a difference, but two, three, four, and so on eventually start to ha…

Unencrypted SNI is still the global standard for TLS, and it is supported by most commerical tracking software. Tracking complexity has not been increased in practice.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#143

Post by nurettin »

icebraining wrote: post #139
nurettin wrote: post #130

Earlier quoted context omitted.

So if I make an ssh tunnel and use a remote DNS, my ISP can still log requests? How?

That's not what the article is proposing. Still, your home ISP may not be able to, but the ISP of the machine you're SSHing into can.

It is a social issue. Would you trust the government of Holland or would you rather try your chances with the Turkish government?

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#144

Post by aaomidi »

eastdakota wrote: post #97
aaomidi wrote: post #40

Earlier quoted context omitted.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

We’re working on it.

This is fantastic and amazing to hear. Thank you!

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#145

Post by rmdoss »

It is not much about privacy, but about the integrity of your data.

Your ISP can see the IP addresses and all the meta data for your traffic. With the current way DNS is setup, they can modify the responses and re-route you any where they want.

With HTTPS and encrypted DNS, it makes a lot harder for them to inject content or redirect you without browsers warnings.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#146

Post by aaomidi »

vbezhenar wrote: post #47
aaomidi wrote: post #40

Earlier quoted context omitted.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

There's nothing good about breaking DPI. Instead of blocking a single site you'll end up blocking entire IP address. I'd even suggest an optional extension of HTTPS which allows to put entire URL as unencrypted part of the request. Censorship systems usually block content by individual pages. Currently with HTTPS it's not possible to block individual page, so an entire website is blocked.

Services like google share IPs amongs their services. If SNI was encrypted, youtube.com could not be blocked unless the entire IP space of google is blocked (which would be very hard to do since nearly everyone relies on gmail).

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#147

Post by chupasaurus »

aaomidi wrote: post #40
mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

Russian here. Entries in gov's blacklist of sites should include IP addresses, domain names and optionally URLs. SNI isn't that helpful for ISPs because they could block traffic by IPs rather using DPI (IIRC only one NIR is using it, but for DNS rather than TLS itself).

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#148

Post by aaomidi »

chupasaurus wrote: post #147
aaomidi wrote: post #40

Earlier quoted context omitted.

I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.

Russian here. Entries in gov's blacklist of sites should include IP addresses, domain names and optionally URLs. SNI isn't that helpful for ISPs because they could block traffic by IPs rather using DPI (IIRC only one NIR is using it, but for DNS rather than TLS itself).

For sites like google, blocking IPs would meet resistance.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#150

Post by chupasaurus »

aaomidi wrote: post #148
chupasaurus wrote: post #147

Earlier quoted context omitted.

Russian here. Entries in gov's blacklist of sites should include IP addresses, domain names and optionally URLs. SNI isn't that helpful for ISPs because they could block traffic by IPs rather using DPI (IIRC only one NIR is using it, but for DNS rather than TLS itself).

For sites like google, blocking IPs would meet resistance.

This situation is covered with a whitelist of IPs and domains (year ago it became official after exploitation of vulnerability in how blacklist register works, before it was on ISPs, Youtube was banned by some ISPs quite a few times), including .google.com, .youtube.com and other Alphabet's domains, *.facebook.com and some others.
Post reply on HN