4 ms·

I'm probably being really stupid, but how does using encrypted DNS prevent your ISP seeing what websites you go to? (I haven't done network stuff for many years

by berkut 9y ago

I'm probably being really stupid, but how does using encrypted DNS prevent your ISP seeing what websites you go to? (I haven't done network stuff for many years, and am a bit out of touch with the current stuff). Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection is made first which would be sniffable?

detaro 9y ago
Not stupid. It makes it harder for the ISP (just grabbing and reading DNS traffic is a very convenient way of getting this information), but it's still visible if they look at all your connections. IPs alone aren't great (e.g. CDNs conflate a lot of domains under one IP), but if they look inside the traffic they can still get the full domains.
gsnedders 9y ago
Also TLS SNI transmits the hostname in plaintext at the start of the TLS handshake.
Someone1234 9y ago
It increases the cost and complexity of an ISP tracking you, which is a win within itself. Plus some services share public IPs or are behind a global cache (e.g. Cloudflare) making it harder to pinpoint exactly which endpoint you tried to access. Is it perfect? No. It is better than yesterday? Yes. I call these "micro-wins." One micro-win won't make a difference, but two, three, four, and so on eventually start to have an impact. And that's all we can hope for. Even often cited VPNs just shift the problem downstream. Instead of your ISP monitoring you, the VPN provider themselves could, or if you host it yourself then your server/virtual server's ISP could. VPNs themselves are another "micro-win" but people often claim they're a complete bulletproof solution.
- amaccuish 9y ago
  Not sure why you're being downvoted; as tescos says here in the UK, every little helps :)
- bogomipz 9y ago
  >"I call these "micro-wins." I like this term :) It's also believe its a win when computer privacy and security begin to edge into main stream lexicon. Somewhat anecdotal but I recently saw that NordVPN is advertising on CNN.
- Sephr 9y ago
  Unencrypted SNI is still the global standard for TLS, and it is supported by most commerical tracking software. Tracking complexity has not been increased in practice.
zeta0134 9y ago
These are valid points. Encrypted DNS stops your ISP from sniffing DNS requests, but does not directly stop them from seeing IP based traffic, and potentially deducing the domain name, if that IP address is from a suitably unique source. (Shared hosting might thwart this somewhat.) The slightly bigger problem is HTTPS with SNI, which leaks the host header in plain text before establishing the connection. It's an unfortunate necessity as long as hosting providers need to use virtual hosts behind a shared IP address, but it's also one more potential snooping vector to deal with.
thaumaturgy 9y ago
> ...how does using encrypted DNS prevent your ISP seeing what websites you go to? It doesn't do this by itself. It just prevents one method of data collection. The ISP can easily connect your IP to your subscriber information, and their DNS can log every lookup made by your IP. Even if you use another DNS, since it's unencrypted, they can (and likely do) sniff that traffic and collect the same information. > Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Sure, but this requires a slightly higher level of effort, and also assumes that you're not connecting to a CDN, which can make your requests pretty opaque. > Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection is made first which would be sniffable? Right, and even with SNI, the requested hostname is still sent in the clear. I hope this will be fixed somehow in future implementations. In the meantime, if you need to treat your ISP as absolutely hostile, then you need a VPN or some other kind of encrypted tunnel or proxy.
vavrusa 9y ago
It's worth mentioning that encrypted DNS is not just about privacy, but also integrity. It's more difficult to intercept or spoof in hostile networks. ISP can still see the target IP address and SNI. The IP address is sometimes meaningful (single website), but not if it's a CDN or a multi-tenant server. The SNI is being worked on (encrypted SNI, ORIGIN frame, CERTIFICATE frame). The point is none of that matters without encrypted DNS.
- kuschku 9y ago
  > It's worth mentioning that encrypted DNS is not just about privacy, but also integrity. It's more difficult to intercept or spoof in hostile networks. That’s why we all have DNSSEC enabled on our domains, right? Right?
  - vavrusa 9y ago
    DNSSEC is orthogonal to this. Its goal is to prove integrity of records between authoritatives and the closest validator. The validator is most often the resolver doing the recursion, not the client. The client can either revalidate all the answers and/or establish a secure channel between the itself and the resolver (with the added privacy bonus). The reason why many clients don't revalidate is because it's time consuming (basically same complexity as recursor), and fragile (recursive operators can work around DNSSEC screwups by adding negative trust anchors), so it's a tradeoff between convenience and risk. There's an ongoing work to make revalidation easier - the client would basically ask the recursive to not only provide answer, but also a whole trust chain from a known trust anchor (so it would revalidate the answer without additional queries) https://tools.ietf.org/html/rfc7901 https://tools.ietf.org/html/rfc7901
StillBored 9y ago
Just to add another point I don't see mentioned. For sites hosted on godaddy like shared hosting plans it makes it a lot harder because a single IP frequently resolves to a dozen or so actual sites. How many sites being visited fit this model? Fewer everyday, but it seems a lot of non-mainstream content is still hosted on smaller shared hosting plans.
- stordoff 9y ago
  Even if not actually on shared hosting, there's a fair chance the site will be behind a shared CDN (e.g. CloudFlare). Doesn't really help while SNI is in the clear, but it's a start.

by berkut 9y ago

detaro 9y ago

Not stupid. It makes it harder for the ISP (just grabbing and reading DNS traffic is a very convenient way of getting this information), but it's still visible if they look at all your connections. IPs alone aren't great (e.g. CDNs conflate a lot of domains under one IP), but if they look inside the traffic they can still get the full domains.

gsnedders 9y ago

Also TLS SNI transmits the hostname in plaintext at the start of the TLS handshake.

Someone1234 9y ago

It increases the cost and complexity of an ISP tracking you, which is a win within itself. Plus some services share public IPs or are behind a global cache (e.g. Cloudflare) making it harder to pinpoint exactly which endpoint you tried to access. Is it perfect? No. It is better than yesterday? Yes. I call these "micro-wins." One micro-win won't make a difference, but two, three, four, and so on eventually start to have an impact. And that's all we can hope for. Even often cited VPNs just shift the problem downstream. Instead of your ISP monitoring you, the VPN provider themselves could, or if you host it yourself then your server/virtual server's ISP could. VPNs themselves are another "micro-win" but people often claim they're a complete bulletproof solution.

amaccuish 9y ago
Not sure why you're being downvoted; as tescos says here in the UK, every little helps :)
bogomipz 9y ago
>"I call these "micro-wins." I like this term :) It's also believe its a win when computer privacy and security begin to edge into main stream lexicon. Somewhat anecdotal but I recently saw that NordVPN is advertising on CNN.
Sephr 9y ago
Unencrypted SNI is still the global standard for TLS, and it is supported by most commerical tracking software. Tracking complexity has not been increased in practice.

zeta0134 9y ago

These are valid points. Encrypted DNS stops your ISP from sniffing DNS requests, but does not directly stop them from seeing IP based traffic, and potentially deducing the domain name, if that IP address is from a suitably unique source. (Shared hosting might thwart this somewhat.) The slightly bigger problem is HTTPS with SNI, which leaks the host header in plain text before establishing the connection. It's an unfortunate necessity as long as hosting providers need to use virtual hosts behind a shared IP address, but it's also one more potential snooping vector to deal with.

thaumaturgy 9y ago

> ...how does using encrypted DNS prevent your ISP seeing what websites you go to? It doesn't do this by itself. It just prevents one method of data collection. The ISP can easily connect your IP to your subscriber information, and their DNS can log every lookup made by your IP. Even if you use another DNS, since it's unencrypted, they can (and likely do) sniff that traffic and collect the same information. > Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Sure, but this requires a slightly higher level of effort, and also assumes that you're not connecting to a CDN, which can make your requests pretty opaque. > Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection is made first which would be sniffable? Right, and even with SNI, the requested hostname is still sent in the clear. I hope this will be fixed somehow in future implementations. In the meantime, if you need to treat your ISP as absolutely hostile, then you need a VPN or some other kind of encrypted tunnel or proxy.

vavrusa 9y ago

It's worth mentioning that encrypted DNS is not just about privacy, but also integrity. It's more difficult to intercept or spoof in hostile networks. ISP can still see the target IP address and SNI. The IP address is sometimes meaningful (single website), but not if it's a CDN or a multi-tenant server. The SNI is being worked on (encrypted SNI, ORIGIN frame, CERTIFICATE frame). The point is none of that matters without encrypted DNS.

kuschku 9y ago
> It's worth mentioning that encrypted DNS is not just about privacy, but also integrity. It's more difficult to intercept or spoof in hostile networks. That’s why we all have DNSSEC enabled on our domains, right? Right?
- vavrusa 9y ago
  DNSSEC is orthogonal to this. Its goal is to prove integrity of records between authoritatives and the closest validator. The validator is most often the resolver doing the recursion, not the client. The client can either revalidate all the answers and/or establish a secure channel between the itself and the resolver (with the added privacy bonus). The reason why many clients don't revalidate is because it's time consuming (basically same complexity as recursor), and fragile (recursive operators can work around DNSSEC screwups by adding negative trust anchors), so it's a tradeoff between convenience and risk. There's an ongoing work to make revalidation easier - the client would basically ask the recursive to not only provide answer, but also a whole trust chain from a known trust anchor (so it would revalidate the answer without additional queries) https://tools.ietf.org/html/rfc7901 https://tools.ietf.org/html/rfc7901

StillBored 9y ago

Just to add another point I don't see mentioned. For sites hosted on godaddy like shared hosting plans it makes it a lot harder because a single IP frequently resolves to a dozen or so actual sites. How many sites being visited fit this model? Fewer everyday, but it seems a lot of non-mainstream content is still hosted on smaller shared hosting plans.

stordoff 9y ago
Even if not actually on shared hosting, there's a fair chance the site will be behind a shared CDN (e.g. CloudFlare). Doesn't really help while SNI is in the clear, but it's a start.