5 ms·

Sadly not really a solution yet for SNI being unencrypted. So while they may not see your DNS query they can just use DPI to capture the sites. VPN is a soluti

Sadly not really a solution yet for SNI being unencrypted. So while they may not see your DNS query they can just use DPI to capture the sites. VPN is a solution but not always deployable.

adrianN 9y ago
VPN is not really a solution because you have no reason to trust your VPN provider more than your ISP.
- iotku 9y ago
  >you have no reason to trust your VPN provider more than your ISP. A lot of people really do distrust their ISP enough that even with knowledge that you're shifting the responsibility to the VPN provider they still trust a random VPN more than their ISP. Would I trust some random unknown VPN provider more than Comcast? Maybe.
  - paulie_a 9y ago
    I would trust the Russian mob before I would trust Comcast
    - JorgeGT 9y ago
      Well, as in anything human it is a matter of incentives. Comcast probably has an incentive for logging and selling your data to advertisers, whereas the Russian mob probably has other, more pressing things to worry about. I follow the same logic by setting up my own VPS in a rented $big_provider VPN. VPS companies are succulent targets that surely attract many eyes, whereas I doubt any non-state actor has the capacity of capturing and filtering the traffic of the millions of random VPNs that $big_provider has.
- StanislavPetrov 9y ago
  Its better than no solution, and you aren't limited to using one VPN. A dozen VPN providers each with 8% of your browsing history is still bad, but far preferable to an ISP with 100%.
  - dfee 9y ago
    Is it? I would guess that people already split their traffic between a home workstation connected through a local ISP, a mobile phone connected through a national carrier ISP, and a work computer that is connected with a (third) enterprise ISP. The concerns that linger in the comments here, are about the dangers of exposing even a slice of your metadata can be disastrous. Therefore, going from three to eight ISPs is arguably worse as your exposed to nearly 3x the risk of exposure.
    - StanislavPetrov 9y ago
      The more information any one entity has about any individual, the more accurate a profile they can create. The more thinly spread your metadata is, the harder it is for any one corporation to create a profile. Clearly there is no perfect solution, it depends on what sort of privacy risks you are trying to mitigate.
- danShumway 9y ago
  I mean, by this logic I have no reason to use Cloudflare's DNS server more than my ISP's, because, 'hey, technically Cloudflare could be lying about their logs.' Yeah, my VPN provider could be lying to me and logging a whole bunch of extra data under the table. But I know my ISP is logging that data. I have every reason to trust a paid VPN provider more than my ISP because my VPN provider is basing their business model on me trusting them, not on being a monopoly. Not to mention that VPNs also help at least a bit with anonymizing IP addresses. The trust model I have with directly exposing my IP to a website is "I hope nobody I visit on the Internet is logging this." If I'm wrong and my VPN is logging everything, I'll still be in a better position than I was with my ISP, because at least I won't be broadcasting my current physical location to every single website I visit.
- jcoffland 9y ago
  You usually have a choice of between 1 and 3 ISPs but you can choose from hundreds of VPN services or setup your own on any cloud server. So there is a very good chance you could find someone more trustworthy. Your VPN can exist outside of your legal jurisdiction which could make a huge difference legally.
  - adrianN 9y ago
    But unless you work at the VPN provider you don't have enough information to make that choice. You can't tell from the outside whether the VPN provider is logging or not.
- _emacsomancer_ 9y ago
  For many ISPs, I think we have sufficient grounds for trusting the ISP less than a decent VPN provider.
- nurettin 9y ago
  It is a social consideration. Would you trust the government and jurisdiction of Holland or would you rather use DNS services offered by Turkey?
  - fwn 9y ago
    To answer this question, location is pretty much key. If in the Netherlands: probably Turkey. If anywhere else: probably the Netherlands. Although it is hard to think about a scenario in which the only available choice is between the Netherlands and Turkey. The idea is hedging against the closest guy with a stick.
nerdymanchild 9y ago
I wonder when someone is going to take on the task of figuring out how to encrypt SNI
- swinglock 9y ago
  https://tools.ietf.org/html/draft-ietf-tls-sni-encryption-02 https://tools.ietf.org/html/draft-ietf-tls-sni-encryption-02

Sadly not really a solution yet for SNI being unencrypted. So while they may not see your DNS query they can just use DPI to capture the sites. VPN is a solution but not always deployable.

adrianN 9y ago

VPN is not really a solution because you have no reason to trust your VPN provider more than your ISP.

iotku 9y ago
>you have no reason to trust your VPN provider more than your ISP. A lot of people really do distrust their ISP enough that even with knowledge that you're shifting the responsibility to the VPN provider they still trust a random VPN more than their ISP. Would I trust some random unknown VPN provider more than Comcast? Maybe.
- paulie_a 9y ago
  I would trust the Russian mob before I would trust Comcast
  - JorgeGT 9y ago
    Well, as in anything human it is a matter of incentives. Comcast probably has an incentive for logging and selling your data to advertisers, whereas the Russian mob probably has other, more pressing things to worry about. I follow the same logic by setting up my own VPS in a rented $big_provider VPN. VPS companies are succulent targets that surely attract many eyes, whereas I doubt any non-state actor has the capacity of capturing and filtering the traffic of the millions of random VPNs that $big_provider has.
StanislavPetrov 9y ago
Its better than no solution, and you aren't limited to using one VPN. A dozen VPN providers each with 8% of your browsing history is still bad, but far preferable to an ISP with 100%.
- dfee 9y ago
  Is it? I would guess that people already split their traffic between a home workstation connected through a local ISP, a mobile phone connected through a national carrier ISP, and a work computer that is connected with a (third) enterprise ISP. The concerns that linger in the comments here, are about the dangers of exposing even a slice of your metadata can be disastrous. Therefore, going from three to eight ISPs is arguably worse as your exposed to nearly 3x the risk of exposure.
  - StanislavPetrov 9y ago
    The more information any one entity has about any individual, the more accurate a profile they can create. The more thinly spread your metadata is, the harder it is for any one corporation to create a profile. Clearly there is no perfect solution, it depends on what sort of privacy risks you are trying to mitigate.
danShumway 9y ago
I mean, by this logic I have no reason to use Cloudflare's DNS server more than my ISP's, because, 'hey, technically Cloudflare could be lying about their logs.' Yeah, my VPN provider could be lying to me and logging a whole bunch of extra data under the table. But I know my ISP is logging that data. I have every reason to trust a paid VPN provider more than my ISP because my VPN provider is basing their business model on me trusting them, not on being a monopoly. Not to mention that VPNs also help at least a bit with anonymizing IP addresses. The trust model I have with directly exposing my IP to a website is "I hope nobody I visit on the Internet is logging this." If I'm wrong and my VPN is logging everything, I'll still be in a better position than I was with my ISP, because at least I won't be broadcasting my current physical location to every single website I visit.
jcoffland 9y ago
You usually have a choice of between 1 and 3 ISPs but you can choose from hundreds of VPN services or setup your own on any cloud server. So there is a very good chance you could find someone more trustworthy. Your VPN can exist outside of your legal jurisdiction which could make a huge difference legally.
- adrianN 9y ago
  But unless you work at the VPN provider you don't have enough information to make that choice. You can't tell from the outside whether the VPN provider is logging or not.
_emacsomancer_ 9y ago
For many ISPs, I think we have sufficient grounds for trusting the ISP less than a decent VPN provider.
nurettin 9y ago
It is a social consideration. Would you trust the government and jurisdiction of Holland or would you rather use DNS services offered by Turkey?
- fwn 9y ago
  To answer this question, location is pretty much key. If in the Netherlands: probably Turkey. If anywhere else: probably the Netherlands. Although it is hard to think about a scenario in which the only available choice is between the Netherlands and Turkey. The idea is hedging against the closest guy with a stick.

nerdymanchild 9y ago

I wonder when someone is going to take on the task of figuring out how to encrypt SNI

swinglock 9y ago
https://tools.ietf.org/html/draft-ietf-tls-sni-encryption-02 https://tools.ietf.org/html/draft-ietf-tls-sni-encryption-02