Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to keep your ISP’s nose out of your browser history with encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

171–180 of 195 posts

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#171

Post by MertsA »

dullgiulio wrote: post #157
JetSpiegel wrote: post #154

Earlier quoted context omitted.

SNI is just an ugly hack because IPv6 is not deployed widely. You could have a server listen on a subnet and clients randomizing its target IP.

Datacenters today work differently: IPs convey a fuzzy idea of where to find what you are looking for. Server name will be used to route your request internally in the DC. I cannot imagine exposing the IPv6 IPs of single racks: it makes the whole "cloud" thing fall apart.

You don't need to. This is no different than how lack of SNI is handled with IPv4, just have multiple static IP addresses on whatever frontend you're using. With IPv6 it's easy to delegate as many IP addresses as you want. The slight problem with this is that it doesn't solve the privacy problem at all as now you just look at the IP address and check which domain it serves.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#172

Post by h1d »

bigiain wrote: post #89
stirlo wrote: post #80

Earlier quoted context omitted.

While for absolute privacy this makes sense, from a lazy ISP dev perspective, why log packets/IPs if you can get marketing data straight from your DNS servers? Surely ISPs have taken this easy approach while encryption has been only for fringe users?

On the other hand, if I were a curious and amoral ISP dev - I'd consider the people circumventing the "easy approach" to be _much_ more interesting to snoop on...

Err, snooping on a teen visiting "naughty" sites isn't exactly interesting from any perspective.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#173

Post by chupasaurus »

dullgiulio wrote: post #156
chupasaurus wrote: post #150

Earlier quoted context omitted.

This situation is covered with a whitelist of IPs and domains (year ago it became official after exploitation of vulnerability in how blacklist register works, before it was on ISPs, Youtube was banned by some ISPs quite a few times), including .google.com, .youtube.com and other Alphabet's domains, *.facebook.com and some others.

So effectively, if you post something on Blogger it cannot be taken down, because the whole Google would come down with it. Still, encrypting SNI hides quite some information (were you searching, watching youtube, reading blogger, was it image search, maps...?)

Rechecked the list, only https://*.youtube.com and (whooping) .google. are inside [0]. [0]: https://storage.googleapis.com/smisc/%D0%A1%D0%BF%D0%B8%D1%8...

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#174

Post by dx034 »

spullara wrote: post #104
stirlo wrote: post #80

Earlier quoted context omitted.

While for absolute privacy this makes sense, from a lazy ISP dev perspective, why log packets/IPs if you can get marketing data straight from your DNS servers? Surely ISPs have taken this easy approach while encryption has been only for fringe users?

Nah. DNS caching would prevent you from seeing every usage of the site. Much better to just log every source ip : dest ip.

The only thing you'll see is a list of CDNs and cloud providers.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#175

Post by _wmd »

aplorbust wrote: post #82
_wmd wrote: post #79

Earlier quoted context omitted.

SNI-enabled browsers send the unencrypted hostname in the initial ClientHello frame. It's the first transaction in the protocol, and it's how the server decides the content of the ServerHello reply. There is no way to detect the ability to avoid SNI, or indeed any sensible and generally useful way to tell if a ServerHello varied according to the ClientHello SNI hostname without probing the server, which entails intro…

"There is no way to detect the ability to avoid SNI..." Assuming one is using an SNI-enabled browser. I dont use an SNI-enabled browser to make the first encrypted HTTP request. In fact I didnt even say I was using a "browser". I said "https client". For example, one can use an https client that has SNI disabled or which has no SNI code at all, or one can send any string as the servername in ClientHello.1 If the serv…

Since the ClientHello is sent in the clear, a MITM can simply reset the connection until the client retries with SNI. Again, there is no generally useful way to solve this

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#176

Post by davvolun »

mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

I'm not a 'networking' person, but am I wrong in believing a VPN would (potentially, with caveats) prevent your ISP from "being able to see which IPs you're sending packets to"? Wouldn't all packets look like they are going to and from the VPN?

As mentioned, that doesn't get around the VPN knowing where your traffic is going, and there are issues such as your VPN dropping and your system switching over as opposed to dropping the packets, compromising your privacy.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#177

Post by kuschku »

pixl97 wrote: post #167
kuschku wrote: post #83

Earlier quoted context omitted.

Then switch ISPs. Mine sends NXDOMAIN just fine, and is with 0.632ms massively faster than what Google or Cloudflare offer.

>Then switch ISPs. Hahahha, and then he said "Then switch ISPs", like we have more than one high speed choice where we live".

Then vote for politicians that help with that.

Due to laws designed for more broadband competition, I've got over 6 providers to choose from here in Germany.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#178

Post by webbles »

rattray wrote: post #122
eastdakota wrote: post #97

Earlier quoted context omitted.

We’re working on it.

(for the lazy: eastdakota's profile claims to be the CEO & co-founder of CloudFlare) Thanks & very, very good luck!

Hail corporate.

It's nice that you trust them.

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#179

Post by singularity2001 »

davvolun wrote: post #176
mike-cardwell wrote: post #20

If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.

I'm not a 'networking' person, but am I wrong in believing a VPN would (potentially, with caveats) prevent your ISP from "being able to see which IPs you're sending packets to"? Wouldn't all packets look like they are going to and from the VPN? As mentioned, that doesn't get around the VPN knowing where your traffic is going, and there are issues such as your VPN dropping and your system switching over as opposed to…

correct, only VPN connection visible to ISP, no content

sshuttle 0.0.0.0/0 --dns -r $server

don't forget --dns ;)

Re: How to keep your ISP’s nose out of your browser history with encrypted DNS

#180

Post by sli »

singularity2001 wrote: post #179
davvolun wrote: post #176

Earlier quoted context omitted.

I'm not a 'networking' person, but am I wrong in believing a VPN would (potentially, with caveats) prevent your ISP from "being able to see which IPs you're sending packets to"? Wouldn't all packets look like they are going to and from the VPN? As mentioned, that doesn't get around the VPN knowing where your traffic is going, and there are issues such as your VPN dropping and your system switching over as opposed to…

correct, only VPN connection visible to ISP, no content sshuttle 0.0.0.0/0 --dns -r $server don't forget --dns ;)

Kind of strange that Google's first result for "sshuttle" is a dead project (literally says "Wrong project!" in the title) that links you to the real one.
Post reply on HN