15 ms·
How to keep your ISP’s nose out of your browser history with encrypted DNS
- woofcat 9y agoSadly not really a solution yet for SNI being unencrypted. So while they may not see your DNS query they can just use DPI to capture the sites. VPN is a solution but not always deployable.
- adrianN 9y agoVPN is not really a solution because you have no reason to trust your VPN provider more than your ISP.
- iotku 9y ago>you have no reason to trust your VPN provider more than your ISP. A lot of people really do distrust their ISP enough that even with knowledge that you're shifting the responsibility to the VPN provider they still trust a random VPN more than their ISP. Would I trust some random unknown VPN provider more than Comcast? Maybe.
- paulie_a 9y agoI would trust the Russian mob before I would trust Comcast
- JorgeGT 9y agoWell, as in anything human it is a matter of incentives. Comcast probably has an incentive for logging and selling your data to advertisers, whereas the Russian mob probably has other, more pressing things to worry about. I follow the same logic by setting up my own VPS in a rented $big_provider VPN. VPS companies are succulent targets that surely attract many eyes, whereas I doubt any non-state actor has the capacity of capturing and filtering the traffic of the millions of random VPNs that $big_provider has.
- StanislavPetrov 9y agoIts better than no solution, and you aren't limited to using one VPN. A dozen VPN providers each with 8% of your browsing history is still bad, but far preferable to an ISP with 100%.
- dfee 9y agoIs it? I would guess that people already split their traffic between a home workstation connected through a local ISP, a mobile phone connected through a national carrier ISP, and a work computer that is connected with a (third) enterprise ISP. The concerns that linger in the comments here, are about the dangers of exposing even a slice of your metadata can be disastrous. Therefore, going from three to eight ISPs is arguably worse as your exposed to nearly 3x the risk of exposure.
- StanislavPetrov 9y agoThe more information any one entity has about any individual, the more accurate a profile they can create. The more thinly spread your metadata is, the harder it is for any one corporation to create a profile. Clearly there is no perfect solution, it depends on what sort of privacy risks you are trying to mitigate.
- danShumway 9y agoI mean, by this logic I have no reason to use Cloudflare's DNS server more than my ISP's, because, 'hey, technically Cloudflare could be lying about their logs.' Yeah, my VPN provider could be lying to me and logging a whole bunch of extra data under the table. But I know my ISP is logging that data. I have every reason to trust a paid VPN provider more than my ISP because my VPN provider is basing their business model on me trusting them, not on being a monopoly. Not to mention that VPNs also help at least a bit with anonymizing IP addresses. The trust model I have with directly exposing my IP to a website is "I hope nobody I visit on the Internet is logging this." If I'm wrong and my VPN is logging everything, I'll still be in a better position than I was with my ISP, because at least I won't be broadcasting my current physical location to every single website I visit.
- jcoffland 9y agoYou usually have a choice of between 1 and 3 ISPs but you can choose from hundreds of VPN services or setup your own on any cloud server. So there is a very good chance you could find someone more trustworthy. Your VPN can exist outside of your legal jurisdiction which could make a huge difference legally.
- adrianN 9y agoBut unless you work at the VPN provider you don't have enough information to make that choice. You can't tell from the outside whether the VPN provider is logging or not.
- _emacsomancer_ 9y agoFor many ISPs, I think we have sufficient grounds for trusting the ISP less than a decent VPN provider.
- nurettin 9y agoIt is a social consideration. Would you trust the government and jurisdiction of Holland or would you rather use DNS services offered by Turkey?
- fwn 9y agoTo answer this question, location is pretty much key. If in the Netherlands: probably Turkey. If anywhere else: probably the Netherlands. Although it is hard to think about a scenario in which the only available choice is between the Netherlands and Turkey. The idea is hedging against the closest guy with a stick.
- nerdymanchild 9y agoI wonder when someone is going to take on the task of figuring out how to encrypt SNI
- swinglock 9y agohttps://tools.ietf.org/html/draft-ietf-tls-sni-encryption-02 https://tools.ietf.org/html/draft-ietf-tls-sni-encryption-02
- amelius 9y agoIsn't there an option to polute the information the ISP sees to such a level that their information is useless? E.g. contact a friendly service that gives back N different random domain names; then lookup those domain names, spread over, say, an hour; then repeat.
- ec109685 9y agoThen you connect to one and boom, isp knows who you connected to.
- written 9y agoI just realized I'm obfuscating my internet usage inadverently. Here's how: Good source of reasonable randomness is twitter. I've set up a scrapper for various twitter accounts and I'm downloading every page that is linked by those accounts automatically. With this approach you can even select what you want to look like based on your browsing data by selecting proper accounts. Gold bug? Bitcoin fool? Knitting expert? No problemo. ;)
- pixl97 9y agoThe problem with pollution ideas is you're still giving your real information to your monitors. You can never be certain they won't find a way to discard the fake information and keep the real.
- berkut 9y agoI'm probably being really stupid, but how does using encrypted DNS prevent your ISP seeing what websites you go to? (I haven't done network stuff for many years, and am a bit out of touch with the current stuff). Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection is made first which would be sniffable?
- detaro 9y agoNot stupid. It makes it harder for the ISP (just grabbing and reading DNS traffic is a very convenient way of getting this information), but it's still visible if they look at all your connections. IPs alone aren't great (e.g. CDNs conflate a lot of domains under one IP), but if they look inside the traffic they can still get the full domains.
- gsnedders 9y agoAlso TLS SNI transmits the hostname in plaintext at the start of the TLS handshake.
- Someone1234 9y agoIt increases the cost and complexity of an ISP tracking you, which is a win within itself. Plus some services share public IPs or are behind a global cache (e.g. Cloudflare) making it harder to pinpoint exactly which endpoint you tried to access. Is it perfect? No. It is better than yesterday? Yes. I call these "micro-wins." One micro-win won't make a difference, but two, three, four, and so on eventually start to have an impact. And that's all we can hope for. Even often cited VPNs just shift the problem downstream. Instead of your ISP monitoring you, the VPN provider themselves could, or if you host it yourself then your server/virtual server's ISP could. VPNs themselves are another "micro-win" but people often claim they're a complete bulletproof solution.
- amaccuish 9y agoNot sure why you're being downvoted; as tescos says here in the UK, every little helps :)
- JumpCrisscross 9y agoDumbass question: is there a difference between setting one’s DNS to https://1.1.1.1 https://1.1.1.1 versus 1.1.1.1 unadorned?
- tomcooks 9y agoI am not a sysadmin but you can't add https:// https:// (or any other prefix) in front of a DNS address. Secure HTTP is a different protocol, suited for web page hosting.
- Freaky 9y agoIt's actually a thing: https://developers.cloudflare.com/1.1.1.1/dns-over-https/cloudflared-proxy/ https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo...
- alwillis 9y agoDNS over HTTPS (DoH) works in the latest Firefox Nightly: https://facebookexperimental.github.io/doh-proxy/tutorials/firefox-nightly-doh-proxy.html https://facebookexperimental.github.io/doh-proxy/tutorials/f...
- deleted 9y ago[deleted]
- chipperyman573 9y agoDNS Lookup has its own protocol that doesn't work with https. If you send an https request to a DNS server, even if you include all the other parameters required for a DNS lookup, you won't get back a usable response (unless the server has been setup to proxy DNS requests over https, but this comes at a speed cost and increases your server overhead, so it is very uncommon - I've never heard of this happening. edit: apparently 1.1.1.1 supports this) +1 for asking, though. Nothing wrong with trying to learn more about something you know very little about. Not sure why others are downvoting you.
- lol768 9y ago
- therealmarv 9y agoAlso mentioned in article: Use DNSCrypt Proxy V2 (a golang rewrite) for DNS over TLS and/or DNScurve https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy E.g. on a Mac with Homebrew. First: brew install dnscrypt-proxy Second: Edit your /usr/local/etc/dnscrypt-proxy.toml and put e.g. google or cloudflare there inside Third: Put your DNS to 127.0.0.1
- rnhmjoj 9y agoI'm a bit concerned about using it yet because it was written from scratch just about three months ago and probably hasn't gone through enough testing.
- shakna 9y agoHow about an actively-maintained 3-year-old project? [0] [0] https://github.com/alterstep/dnscrypt-osxclient https://github.com/alterstep/dnscrypt-osxclient
- therealmarv 9y agoI used that one before. I don't like it technically. It only supports DNScurve and installs itself deeply into the system (e.g. system preferences). I also think it's more unreliable because they don't do the caching in a good way (sometimes a DNS server fails is my experience). I like dnscrypt proxy V2 more because it's more rock solid, works better on caching and also supports DNS over TLS. Only downside on dnscrypt proxy is that you don't have a nice UI and you have to type the local DNS 127.0.0.1 manually into your Wifi or LAN connection point.
- jedisct1 9y agoI use this as an UI for dnscrypt-proxy v2: https://getbitbar.com/plugins/Network/dnscrypt-proxy-switcher.10s.sh https://getbitbar.com/plugins/Network/dnscrypt-proxy-switche...
- jedisct1 9y ago
- mike-cardwell 9y agoIf you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.
- vlovich123 9y agoWell if you’re using a VPN then your ISP can’t see much. Some VPNs offer DNS too.
- mike-cardwell 9y agoSame argument applies there then. Your VPN provider can already see what websites you're visiting, so use their DNS servers if you can. Don't add yet another third party.
- arca_vorago 9y agoThe problem currently is that they aren't getting warrants!
- natbobc 9y agoI've spoken to some folks that worked in the VPN provider industry... many of them aren't the bastion of consumer protection they claim/are perceived to be. With the exception of Tor (and even that has been found to have problems) I'm not sure "single-point" anything will really provide you with anonymity. I think it really comes down to your threat model though and what tradeoffs you're willing to accept for anonymity (e.g. captchas, performance, etc). I think the sweet spot for CloudFlare's offering is if you're in a country or service provider that takes liberties in overriding DNS responses.
- vbezhenar 9y agoBuy VPS and install your own VPN. It's much harder to spy on you in this setup and basically requires complicated targeted attack. I'm not sure if common networking setups for VPS record TCP connections, if they do, then VPS provider can record some important metainformation, but it's still not a lot. On the other side with VPN it's much easier to spy on every client.
- deleted 9y ago[deleted]
- plg 9y agodoes/can Pi-Hole use encrypted DNS? I have a raspberry-pi on my home network running Pi-Hole and my router’s DHCP server gives all devices on my network the Pi-Hole as the DNS address
- chug 9y agoIt doesn't have built in support for it since it's just using dnsmasq under the hood, but you can install something like dnscrypt-proxy and then configure pi-hole (i.e. dnsmasq) to use it as its upstream DNS server.
- Machado117 9y agoYes, you can follow the instructions from the wiki https://github.com/pi-hole/pi-hole/wiki/DNSCrypt-2.0 https://github.com/pi-hole/pi-hole/wiki/DNSCrypt-2.0
- evolve2k 9y agoFrom the article it seems like 'DNS over HTTPS' (DoH), seems to be the winner. Seems the authors best advice is to set up DoH via DNSCrypt Proxy 2, possibly using a raspberry pi to make it easier to manage ur whole network. Do people here agree this is a pretty good approach?
- tfigment 9y agoWhile I'm not everybody, I think its decent and better than the default which is your ISP. Normally pointing directly at google or cloudflare does not hide it from your ISP. I actually just did this yesterday though not with a raspberry pi since I just care about my windows box for now and my router is not open enough to allow this. I think they recommend doing it on your router directly if possible. This helps with Android devices for instance which do not really let you set your DNS easily. I installed DNSCrypt for windows on my desktop and pointed at cloudflare. As others pointed out without a VPN, its only kinda helpful but I figure I don't need to share any more than I really need to with my ISP who I don't trust in general. Also I figure even with VPN anything that slips past the VPN for whatever reason is leaked less to my ISP. Had an extra benefit of creating a log file of queries so I can see addresses that are being queried. I found NordVPN pinging random websites and wondering why? (To see if I'm blocked apparently)
- arca_vorago 9y agoI thought that dnscurve was the method to actually prevent domain snooping. Regardless, I think running your own authoritative dns which updates from root servers is the real way to go.
- pbhjpbhj 9y agoYour traffic still has to go to those servers, so your ISP still can track the terminal server IP, can't it? (TOR, or tunneling aside)
- pixl97 9y agoAn almost unlimited number of domains can be hosted off a single IP. That said, the SNI header can still be sniffed on an HTTPS connection.
- itakedrugs 9y agoNow we just need a an encrypted DNS provider that isn't NSA's puppet...
- quickthrower2 9y agoNamecoin?
- throw2016 9y agoThis preoccupation with ISPs is akin to concern about a pin prick while blood gushes out of knife wound unattended. All sorts of solutions are offered enthusiastically while the elephant in the room, tens of thousand of engineers and billion dollar companies incentivized to hoover up and collate every minutiae of user data as a business model, is met with hand wringing and apologism about ad revenue. In this case solutions have to emerge from outside the tech community by something like GDPR. Given that reality and the primacy of ad driven business models in SV its difficult to contextualize this preoccupation with ISPs. It feels like a distraction, insincere and driven by commercial concerns.
- supertrope 9y agoI agree. To play devil's advocate you can choose not to use Facebook or Gmail or Android. In many areas (of USA) there's exactly two choices for Internet access, and in some there's only one. Additionally the quid pro quo of free online services for personal data may be considered less objectionable than additional monetization on top of the monthly fee.
- StillBored 9y agoNow if we can just get a default encrypted email protocol....
- h1d 9y agoI thought the reason that these critical infrastructures are not encrypted after decades and decades of use is that there are powerful agencies who want to snoop on them.
- tempz 9y agoI cannot begin to understand how is it better to reveal your DNS access patterns to the global company like Cloudflare, as opposed to revealing them to your local ISP? Who do you think can smoother monetize your data - your local ISP or Cloudflare? Or maybe Cloudflare solemnly promised never to do it? If an effort is to be taken, the best thing is to run your own DNS resolver that will query root servers and follow the chains directly.
- bo1024 9y agoI assume it has something to do with how easy it is to connect your data with other aspects of your identity. Presumably with an ISP it is associated with the name of the subscriber, whereas there is some chance with other DNS servers that this is untrue.
- stordoff 9y agoIt's fragmenting the data - CloudFlare _only_ gets your DNS data, whereas your ISP has DNS, content of non-HTTPS traffic (Cloudflare gets a non-zero percentage of this anyway), billing information, real identity etc. Your ISP can _immediately_ tie your DNS records to a real identity (or a member of your household at the very least), whereas CloudFlare can only make inferences from the data and the source IP location. It gives two companies an incomplete picture, rather than one knowing EVERYTHING. CloudFlare promise to not do so is also a non-zero consideration - it's clearly unenforceable/you would never know, but the mere promise is probably better than many ISPs. I'd also say most users' ISPs are probably are global companies (or at least national) anyway. > the best thing is to run your own DNS resolver that will query root servers and follow the chains directly Only if the first step is also encrypted. If it is plain DNS, then your ISP can see the requests almost as easily as if going to their own servers (or transparently redirect the requests to their servers).
- rmdoss 9y agoIt is not much about privacy, but about the integrity of your data. Your ISP can see the IP addresses and all the meta data for your traffic. With the current way DNS is setup, they can modify the responses and re-route you any where they want. With HTTPS and encrypted DNS, it makes a lot harder for them to inject content or redirect you without browsers warnings.
- xorcist 9y agoWhy are so many clients still running stub resolvers? Just type "apt-get install unbound" already. You won't miss that 200 kB resident memory.
- Annatar 9y ago...Or one could just run one's own DNS servers.
- ohiovr 9y agoYes, it isn't that hard to do: https://www.digitalocean.com/community/tutorials/how-to-configure-bind-as-a-caching-or-forwarding-dns-server-on-ubuntu-16-04 https://www.digitalocean.com/community/tutorials/how-to-conf...
- aorth 9y agoThis is the first I've heard of cloudflared (aka Argo). It's a DNS over HTTPS proxy. As far as I know Firefox is working to get DNS over HTTPS into Nightly so it can be used directly in the browser, but this proxy allows your whole system to use DNS over HTTPS without having to change anything (other than pointing /etc/resolv.conf or equivalent at 127.0.0.1). Pretty cool!
- Sami_Lehtinen 9y agoAfter all these posts, I still don't get what is the problem with the ISP seeing my DNS queries. That's still private telecom information protected by law. Unless you're doing something obviously illegal, and are under investigation. They can't do anything with that data legally. Using Cloudflare or VPN most likely won't solve the problem anyway, at least if you're doing something criminal enough. Therefore claiming it making you untraceable on net, is snake oil anyway.