11 ms·
If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being abl
by mike-cardwell 9y ago
If you care about privacy, use your ISPs DNS servers.
Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI.
The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.
- vlovich123 9y agoWell if you’re using a VPN then your ISP can’t see much. Some VPNs offer DNS too.
- mike-cardwell 9y agoSame argument applies there then. Your VPN provider can already see what websites you're visiting, so use their DNS servers if you can. Don't add yet another third party.
- arca_vorago 9y agoThe problem currently is that they aren't getting warrants!
- natbobc 9y agoI've spoken to some folks that worked in the VPN provider industry... many of them aren't the bastion of consumer protection they claim/are perceived to be. With the exception of Tor (and even that has been found to have problems) I'm not sure "single-point" anything will really provide you with anonymity. I think it really comes down to your threat model though and what tradeoffs you're willing to accept for anonymity (e.g. captchas, performance, etc). I think the sweet spot for CloudFlare's offering is if you're in a country or service provider that takes liberties in overriding DNS responses.
- vbezhenar 9y agoBuy VPS and install your own VPN. It's much harder to spy on you in this setup and basically requires complicated targeted attack. I'm not sure if common networking setups for VPS record TCP connections, if they do, then VPS provider can record some important metainformation, but it's still not a lot. On the other side with VPN it's much easier to spy on every client.
- woofcat 9y agoSure, however any warrant can get billing data from your hosting provider, or your credit card company will resolve directly to you.
- floatboth 9y agoBut if your VPS is in a country that's not very friendly to your country, getting data from the hosting provider won't be easy.
- woofcat 9y agoWell seeing as all credit cards are basically subject to US law, you'd need to find a VPS that is going to accept say Bitcoin for server space. Perhaps one that is going to accept cash in the mail. Then hope that said provider is reputable enough to be up to date on their security, and honest enough not to just cave under pressure. Realistically the VPS solution fails simply because there is no obscuring of traffic. We all know that security through obscurity isn't real security. However if a VPN provider has 1,000 users using their IP block than any specific traffic is harder to isolate to one user. -- Presuming they are honest and not keeping logs. Running your own VPS means that all traffic is owned by you.
- Cacti 9y agoI mean, if you’re trying to defend against a coordinate government attack, you’re boned anyway. They’ll just break into your house and install a sniffer, or arrest you, or make your life hell. That’s assuming they can’t just get into your home network through zero days, which an individual has no practical defense against.
- hawski 9y agoVPN is just a remote ISP. Of course you have more options, but it's not TOR. Edit: I mean TOR only figuratively.
- Someone1234 9y agoThere are Tor exit nodes which monitor traffic see: https://boingboing.net/2016/07/01/researchers-find-over-100-spyi.html https://boingboing.net/2016/07/01/researchers-find-over-100-...
- verbify 9y agoIf the traffic is https, in theory they can't link any of that traffic to individuals.
- pbhjpbhj 9y agoIf a party were to, by chance, to monitor both your entry and exit nodes couldn't they match the traffic by time & packet size, et al? Then use known techniques to match pages accessed (it's something like 85% accuracy IIRC). That would match to individual IP, or potentially an individual if you're logged in.
- deleted 9y ago[deleted]
- Cacti 9y agoSo? What if the VPN doesn’t know who you are? What if it’s your own VPN but others don’t know that? The entire point of choosing a good VPN is to get the visible data off of your immediate ISP, since they know who you are, and into a more nebulous net, where others do not.
- QasimK 9y agoThis is a great way of thinking about a VPN, and how I describe it myself. If you have limited options on your choice of ISP, then a VPN allows you to expand your choices (excluding speed, latency, usage caps).
- KozmoNau7 9y agoSome of us have no use for our ISP's DNS servers, due to government-mandated cencorship.
- mike-cardwell 9y agoI was addressing "privacy". It sounds like you have other reasons to not use your ISPs DNS servers. Fair enough.
- rnd0 9y agoI'm in the same boat. My ISP's DNS servers tend to be very slow and often unresponsive. As a result I've used googles (a bad idea, in retrospect) for the last 10 years or so.
- nandhp 9y ago> I've used googles (a bad idea, in retrospect) for the last 10 years or so. That is a reasonable consideration, but Google is very specific about how they use and retain data collected by Google Public DNS. Assuming they are not lying, I don't think it's a significant concern. (Admittedly, their policy is not as good as Cloudflare's "no IP logging" policy.) https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy TL;DR: Logs with IP addresses are deleted within 48 hours; permanent logs keep city-level location data, but no personally identifiable information. "We don't correlate or combine information from our temporary or permanent logs with any personal information that you have provided Google for other services."
- bscphil 9y agoThere aren't many ISP DNS servers that aren't garbage in my experience. Most of them don't send NXDOMAIN. Many of them are slower than either Google or Cloudflare despite being theoretically closer.
- kuschku 9y agoThen switch ISPs. Mine sends NXDOMAIN just fine, and is with 0.632ms massively faster than what Google or Cloudflare offer.
- aaomidi 9y agoI'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.
- gruez 9y agohow would encrypted SNI work? sure, you can probably do some sort of DHE, but that's vulnerable to MITM, which is why we have certificates to begin with.
- muizelaar 9y agohttps://tools.ietf.org/html/draft-huitema-tls-sni-encryption https://tools.ietf.org/html/draft-huitema-tls-sni-encryption
- deleted 9y ago[deleted]
- arkadiyt 9y agoThere's domain fronting [1] and http/2 certificate frames [2] - they are conceptually similar. [1]: https://www.bamsoftware.com/papers/fronting/ https://www.bamsoftware.com/papers/fronting/ [2]: https://tools.ietf.org/html/draft-bishop-httpbis-http2-additional-certs-05 https://tools.ietf.org/html/draft-bishop-httpbis-http2-addit...
- gruez 9y agoboth of them seem to use the concept of "connect via a fake domain name, then connect to the real domain". i'm not sure how this is scaleable for everyday browsing. you might be able to find the fronting server for wikipedia, but how are you going to find the fronting server for every website you're visiting? this solves the problem of censorship, but not the problem of ISP surveillance.
- the8472 9y agoCouldn't the client send SNI after the DH and then the server authenticate the secret? That way MITM would always be detectable at least.
- z3t4 9y agoYou most likely also get faster DNS lookups by using your ISP's DNS servers.
- jcoffland 9y agoNot necessarily. Back when I used Comcast I got much faster browsing speeds by using a proxy over a VPN to a linode server, even though that server was in another state.
- zaarn 9y agoDepends a lot. My ISP's (both mobile ISP and DSL) have pretty slow DNS providers. My mobile connections were significantly quicker after I switched to using VPN with Cloudflare DNS as resolver (or even the local resolver, though that is normally a bit slower than Cloudflare/Google DNS due to caching)
- deleted 9y ago[deleted]
- cesarb 9y agoNot every DNS query is going to be followed by a HTTP or HTTPS connection. You also have queries for other protocols; queries which are never followed by a connection because the response was "this name doesn't exist"; "leaked" queries for internal hostnames; queries which were just to check if a name exists; and reverse (PTR) queries.
- aplorbust 9y agoNot all TLS-enabled websites require SNI. I customised an https client so I dont use SNI unless a website requires it. With all due respect, 100% adoption of SNI seems like some sort of popular myth among certain web forum commenters. Perhaps we should do a survey of all websites found on HN on a given day and publish it. I would bet that the majority do not require SNI.
- MichaelGG 9y agoTLS 1.3 mandates it, doesn't it? It's safe to say it's near enough to 100% (of clients sending) to not be worth mentioning outliers like yourself.
- _wmd 9y agoSNI-enabled browsers send the unencrypted hostname in the initial ClientHello frame. It's the first transaction in the protocol, and it's how the server decides the content of the ServerHello reply. There is no way to detect the ability to avoid SNI, or indeed any sensible and generally useful way to tell if a ServerHello varied according to the ClientHello SNI hostname without probing the server, which entails introducing roundtrips, and disclosing the hostname unencrypted at least once on the wire.
- aplorbust 9y ago"There is no way to detect the ability to avoid SNI..." Assuming one is using an SNI-enabled browser. I dont use an SNI-enabled browser to make the first encrypted HTTP request. In fact I didnt even say I was using a "browser". I said "https client". For example, one can use an https client that has SNI disabled or which has no SNI code at all, or one can send any string as the servername in ClientHello.1 If the server responds with hostname not found, then retry using SNI and the desired hostname. IME, most TLS-enabled websites do not require SNI. 1 exec printf 'GET / HTTP/1.1\r\nHost: example.com\r\nConnection: close\r\n\r\n'|exec openssl s_client -tls1_2 -no_ssl2 -no_ssl3 -ign_eof -connect 93.184.216.34:443 -servername SNI_NOT_REQUIRED
- mike-cardwell 9y ago
- stirlo 9y agoWhile for absolute privacy this makes sense, from a lazy ISP dev perspective, why log packets/IPs if you can get marketing data straight from your DNS servers? Surely ISPs have taken this easy approach while encryption has been only for fringe users?
- bigiain 9y agoOn the other hand, if I were a curious and amoral ISP dev - I'd consider the people circumventing the "easy approach" to be _much_ more interesting to snoop on...
- libdjml 9y agoTrue, although what are they going to do with the data? If it’s primarily for selling to ad companies, a tiny slice of privacy minded people aren’t worth much.
- pkulak 9y agoISPs want to sell advertising, or data to advertisers. Why bother trying to advertise to a few geeks who are probably running PiHole anyway? Especially since doing that multiplies the hardware requirements 100 fold.
- bigiain 9y agoPossibly because the people who you can sell that data to are prepared to pay way more per "product" than the people trying to sell you fast moving consumer goods or ICO de jour... Wouldn't surprise me at all to find there's a market where intelligence services can purchase lists of TOR users - for example...
- h1d 9y agoErr, snooping on a teen visiting "naughty" sites isn't exactly interesting from any perspective.
- spullara 9y agoNah. DNS caching would prevent you from seeing every usage of the site. Much better to just log every source ip : dest ip.
- StillBored 9y agoThat is true in my case, but my ISP has in the past redirected various queries to their landing/search pages, which means that I simply don't use them anymore.
- deleted 9y ago[deleted]
- all_blue_chucks 9y agoNot every site uses SNI. Most probably do not. Not every site uses custom DNS for their CDN, either. Your ISP knows way less about you if you avoid their DNS. And they are the only ones that know your legal name and billing address, usually.
- pfg 9y agoSNI is part of the first message a TLS client sends to the server - the Client Hello. TLS clients that support SNI (including all modern browsers) will typically always send the SNI extension, regardless of whether the server supports or makes use of SNI.
- all_blue_chucks 9y agoThat's why I use IE6: for Privacy reasons.
- nurettin 9y agoSo if I make an ssh tunnel and use a remote DNS, my ISP can still log requests? How?
- icebraining 9y agoThat's not what the article is proposing. Still, your home ISP may not be able to, but the ISP of the machine you're SSHing into can.
- nurettin 9y agoIt is a social issue. Would you trust the government of Holland or would you rather try your chances with the Turkish government?
- zaarn 9y agoWe have to plug many holes, encrypted DNS plugs one, encrypted SNI will plug another.
- purvis 9y agoIf what you say is true -- on top of that, your ISP can also (in theory) fingerprint you as someone who is avoiding their DNS servers.
- dalore 9y agoWhat about running your own DNS server locally? Your requests will go to the root dns servers, which then go the dns servers of the domains you request. But also it will cache responses locally (so if you make another request it won't even need to make an external request). Yes your ISP can still see it but they can see all your traffic anyway.
- ListenLinda 9y agoStandard DNS is clear text. It doesn't matter if you use your ISP DNS server or not. Either way, they will see the DNS traffic. Forward you DNS requests to servers using DNS with TLS encryption or with a VPN provider. That way the DNS requests can't be seen by your ISP. Using a non-ISP DNS server isn't enough.
- davvolun 9y agoI'm not a 'networking' person, but am I wrong in believing a VPN would (potentially, with caveats) prevent your ISP from "being able to see which IPs you're sending packets to"? Wouldn't all packets look like they are going to and from the VPN? As mentioned, that doesn't get around the VPN knowing where your traffic is going, and there are issues such as your VPN dropping and your system switching over as opposed to dropping the packets, compromising your privacy.
- singularity2001 9y agocorrect, only VPN connection visible to ISP, no content sshuttle 0.0.0.0/0 --dns -r $server don't forget --dns ;)
- sli 9y agoKind of strange that Google's first result for "sshuttle" is a dead project (literally says "Wrong project!" in the title) that links you to the real one.
- ListenLinda 9y agoThat won't work. All the ISP has to do is snoop port 53 and they can see your DNS whether you're using their DNS server or someone else's. You have to get the DNS traffic out of their visibility by using VPN or DNS TLS.