4 ms·

but your ISP will still be able to see all your connections even if you don't use its DNS servers unless you use a VPN... this just spreads the information to

but your ISP will still be able to see all your connections even if you don't use its DNS servers unless you use a VPN... this just spreads the information to a third party.

trumped 8y ago
https://en.wikipedia.org/wiki/Server_Name_Indication#Security_implications https://en.wikipedia.org/wiki/Server_Name_Indication#Securit... Downvote me all you want, but domain names are still being sent to the ISP unencrypted, as of TLS 1.3... so it doesn't matter who processes your DNS queries, your ISP still knows everything about which sites you are accessing... but anyways, bare IP addresses still reveal a lot (metadata)
- patrickmcmanus 8y ago
  right - but we're coming for cleartext sni too: https://tools.ietf.org/html/draft-rescorla-tls-esni-00 https://tools.ietf.org/html/draft-rescorla-tls-esni-00 interestingly, something like DoH is a pre-requisite for pulling off esni.
  - trumped 8y ago
    that's great, but are you coming for the ip addresses too (probably the bigger challenge)?
    - patrickmcmanus 8y ago
      wrt esni the anonymity pool is definitely the set of content that can share the same address pool. In a world with lots of CDNS (and several multi-CDN switching services) this covers a huge amount of content - but I agree - not everything.
      - trumped 8y ago
        If you think about the best/worst case scenario, would you be happy if one CDN would deliver everything? I think that we would be in a worst situation... ideally, I think that everyone would have their own servers and that your ISP would not even be able to see which IP addresses you are talking too (completely decentralized)
      - patrickmcmanus 8y ago
        cdn switchers/sharers are very interesting here. e.g. cedexis
    - eastdakota 8y ago
      Yes, we are. After ESNI we’re working on DNS IP address randomization.
      - trumped 8y ago
        is that a joke? sorry I don't see how that would help... where could I get more info?

but your ISP will still be able to see all your connections even if you don't use its DNS servers unless you use a VPN... this just spreads the information to a third party.

trumped 8y ago

https://en.wikipedia.org/wiki/Server_Name_Indication#Security_implications https://en.wikipedia.org/wiki/Server_Name_Indication#Securit... Downvote me all you want, but domain names are still being sent to the ISP unencrypted, as of TLS 1.3... so it doesn't matter who processes your DNS queries, your ISP still knows everything about which sites you are accessing... but anyways, bare IP addresses still reveal a lot (metadata)

patrickmcmanus 8y ago
right - but we're coming for cleartext sni too: https://tools.ietf.org/html/draft-rescorla-tls-esni-00 https://tools.ietf.org/html/draft-rescorla-tls-esni-00 interestingly, something like DoH is a pre-requisite for pulling off esni.
- trumped 8y ago
  that's great, but are you coming for the ip addresses too (probably the bigger challenge)?
  - patrickmcmanus 8y ago
    wrt esni the anonymity pool is definitely the set of content that can share the same address pool. In a world with lots of CDNS (and several multi-CDN switching services) this covers a huge amount of content - but I agree - not everything.
    - trumped 8y ago
      If you think about the best/worst case scenario, would you be happy if one CDN would deliver everything? I think that we would be in a worst situation... ideally, I think that everyone would have their own servers and that your ISP would not even be able to see which IP addresses you are talking too (completely decentralized)
    - patrickmcmanus 8y ago
      cdn switchers/sharers are very interesting here. e.g. cedexis
  - eastdakota 8y ago
    Yes, we are. After ESNI we’re working on DNS IP address randomization.
    - trumped 8y ago
      is that a joke? sorry I don't see how that would help... where could I get more info?