4 ms·

...and you think the sequence and timing of IP addresses your machine connects to alone can't be used to easily infer the website you're browsing? Neither DoH n

by pjf 7y ago

...and you think the sequence and timing of IP addresses your machine connects to alone can't be used to easily infer the website you're browsing? Neither DoH nor ESNI will make you more secure/private, but DoH will definitely make some companies more powerful. That's not the Internet as we knew it until now.

vinay_ys 7y ago
Thankfully, today's Internet is definitely not the Internet of the early 2000s I remember – it was highly insecure and infested with virus/worms everywhere. Thanks to efforts like this Internet has gradually evolved to become more secure and more useful for real-world applications. Both DoH+ESNI will make me more secure and private. Here's why: Today my home ISP has deployed middle boxes that inspect my traffic to profile my browsing habits and serve me ads. They serve ads by doing click hijacking on plain http websites. yeah, it's nasty and they do it at a huge scale. Obviously, we have some legislative gaps to address here. Irrespective of the legal gaps, I can make it more expensive for them to do this by ensuring all of my traffic is fully encrypted (TLS 1.3 or wireguard). They can still see IPs and do IP reverse lookup and traffic timing analysis etc. But the information leaked this way is far lesser than today and definitely not actionable immediately the way it is today. Now, w.r.t making some companies more powerful – that is not inherent to DoH. DoH makes it possible for anyone to operate a secure and private resolver and any client is still free to choose who should be their upstream dns resolver. Client auto configuration protocols will evolve to support the ecosystem as more DoH resolvers show up.
fulafel 7y ago
The only reason that security conscious web sites haven't implemented any traffic analysis countermeasures is that the stuff leaks out in cleartext anyway. After DoH and ESNI are implemented, I can imagine many relatively cheap approaches that websites can use to make traffic analysis a few notches harder.

by pjf 7y ago

vinay_ys 7y ago

Thankfully, today's Internet is definitely not the Internet of the early 2000s I remember – it was highly insecure and infested with virus/worms everywhere. Thanks to efforts like this Internet has gradually evolved to become more secure and more useful for real-world applications. Both DoH+ESNI will make me more secure and private. Here's why: Today my home ISP has deployed middle boxes that inspect my traffic to profile my browsing habits and serve me ads. They serve ads by doing click hijacking on plain http websites. yeah, it's nasty and they do it at a huge scale. Obviously, we have some legislative gaps to address here. Irrespective of the legal gaps, I can make it more expensive for them to do this by ensuring all of my traffic is fully encrypted (TLS 1.3 or wireguard). They can still see IPs and do IP reverse lookup and traffic timing analysis etc. But the information leaked this way is far lesser than today and definitely not actionable immediately the way it is today. Now, w.r.t making some companies more powerful – that is not inherent to DoH. DoH makes it possible for anyone to operate a secure and private resolver and any client is still free to choose who should be their upstream dns resolver. Client auto configuration protocols will evolve to support the ecosystem as more DoH resolvers show up.

fulafel 7y ago

The only reason that security conscious web sites haven't implemented any traffic analysis countermeasures is that the stuff leaks out in cleartext anyway. After DoH and ESNI are implemented, I can imagine many relatively cheap approaches that websites can use to make traffic analysis a few notches harder.