4 ms·
How much does HTTPS circumvent this? In theory the ISP would only know what domain you were on, but not what content you were viewing, correct?
by pdelbarba 10y ago
How much does HTTPS circumvent this? In theory the ISP would only know what domain you were on, but not what content you were viewing, correct?
- tribune 10y agoSure, but still, which domains a person uses can say a lot about them. Not to mention ISPs have access to a wealth of other information about their customers including physical location (down to the address, they bill them)
- __jal 10y agoUnless you have a friendly local ISP, I strongly suggest using a third-party DNS provider as well. OpenDNS is lovely for this, or piggy-backing on one that you know actually returns valid results (and doesn't sell the logs) is good. If you're already a Google user, use theirs - they are still part of the surveillance-entertainment complex, but at least they don't lie about DNS.
- exabrial 10y agoYou'll also need to use dnscurve. Setup an RPI as your local DNS resolver using dnscurve and have your router hand out your rpi as your lan's DNS resolver. None of this matters if you rent your router from your isp
- edraferi 10y agoI need a tutorial on setting up privacy protections against an ISP. Any recommendations?
- komali2 10y agoNo doubt, seems like there's a lot of opportunity to set up some clear-cut guides for dummies like me to protect ourselves. Kinda surprised there isn't a general guide from a VPN provider, would be a great opportunity to both upsell their services and promote whatever their staff (probably) care a great deal about (internet privacy).
- darkengine 10y agoAn ISP can still see the sites you browse, even if you use HTTPS everywhere and don't use their DNS. For shared HTTPS hosting (1 IP serving multiple domains), SNI (the domain) is sent in cleartext so the server can pick which configuration to use (SSL cert, etc). For sites that don't use SNI, they can still see you browsed there because without SNI, 1 IP = 1 domain.
- zkms 10y ago> I strongly suggest using a third-party DNS provider as well. I don't know the exact equipment and mechanisms used by ISPs today, but it's extremely likely that the surveillance works just based on sniffing every DNS packet, not just those sent to ISP resolvers. Someone with a better knowledge of the current state of the art is invited to comment :)
- hawski 10y agoBut wouldn't your ISP have IPs that you connected to? Then it could do reverse DNS lookup and they have a domain. It's true that there can be multiple domains attached to single IP, but it does not change much.
- BurningFrog 10y agoNit pick: Billing address and physical location can easily be different. I'd expect the ISP to know where their wires go though. Unless they're wireless.
- yjftsjthsd-h 10y agoEven then, they probably know, albeit at lower precision.
- exabrial 10y agoCorrect. They can tell what ip you're talking to, but no idea the content nor can they modify it. Unless I'm missing something obvious, I don't really understand the general HN reaction here. I use https everywhere.
- trendia 10y agoYou have HTTPS between advertiser and you. Advertiser then requests the name associated with your IP. That's all they need.
- exabrial 10y agoThat is an interesting scheme. I feel like the same thing could be done by asking Amazon Prime or Google or Netflix too though. (Who is singed into this ip? Who has the cookie/session id)
- chillacy 10y agoI dunno, would you be comfortable with your ISP bundling you into a cohort because you made enough requests to pornhub's servers between 6 and 8PM?