3 ms·

How hard would it be for them to instead reverse lookup the outbound socket IP addresses to determine the servers to which you are connecting? Assuming they ha

by koolba 7y ago

How hard would it be for them to instead reverse lookup the outbound socket IP addresses to determine the servers to which you are connecting? Assuming they have some people performing the same DNS lookups from similar locations I bet they could construct a good enough mapping. It’d probably be even more accurate if there’s DNS caching client side as it’d count actual connections and not just lookups.

GhettoMaestro 7y ago
Your method wouldn't work too well as multiple websites will be multiplexed behind a single IP address via a method known as "named-based virtual hosting". It exists even with TLS, as SNI (Server Name Indication) was added to serve this purpose. However, in the future, TLS will most likely mandate that SNI be encrypted and not visible to a passive attacker (it is currently in IETF draft status, as someone pointed out below).
- anfilt 7y ago
  Its still just a draft last I checked. https://tools.ietf.org/html/draft-ietf-tls-esni-04 https://tools.ietf.org/html/draft-ietf-tls-esni-04 Where as tls 1.3 is a RFC. https://tools.ietf.org/html/rfc8446 https://tools.ietf.org/html/rfc8446
JMTQp8lwXL 7y ago
One IP address could have multiple hostnames pointing to it. DNS permits this. I could register my own domain name, right now, and point it to what `dig facebook.com`'s IP address is.
- vanadium 7y ago
  Pretty much the default position for everyday shared hosting environments, unless a static IP is explicitly requested by a customer.
jcampbell1 7y ago
My thought is that with SNI (Server Name Identification), the domain is transmitted in plaintext as is. Encrypted SNI is a long way off unless everyone starts letting a 3rd party like Cloudflare manage everything. To cut Comcast out of the loop requires the OS/Browsers to switch away from Comcast's DNS, and a huge amount of the web terminating at generic Cloudflare IPs with Encrypted SNI.
- nullc 7y ago
  Even with esni the payload size is clear, so it isn't too difficult to identify the site being accessed from a small list. And ESNI's limited privacy depends on people centeralizing their services on a small number of cloud providers that get to see everything.
zzzcpan 7y ago
It's possible to extract much much more information [1] than DNS queries for an ISP with off the shelf products, they don't really need your DNS queries for that (yes, DoH people are lying like crazy that it improves privacy). What ISPs do care about is keeping control over DNS, being able to use it for address translation, routing around problematic servers, blocking and intercepting domains, etc. [1] There is lots of stuff leaking all over the place in IP packets passively, not just IP addresses, but like website identifying TLS metadata in case it shares IP address with other websites, user machine and OS identifying metadata, etc. Also when you visit a website, you make requests not just to a single IP address, but also to a bunch of other IP addresses specific to the website to load resources that the page includes that send back responses of specific size and all of this is nicely clustered and mappable to a specific machine you were using. Even if you hide TLS metadata, it only takes a single user visiting a website in the open to identify all the rest who did too and that user can be a headless browser going through alexa top million websites. Active probing is yet another thing that can reveal a lot, ISP can connect to the same port from your IP address, send various things to figure out the protocol and so on, that's how all kinds of obfuscation can be detected.

by koolba 7y ago

GhettoMaestro 7y ago

Your method wouldn't work too well as multiple websites will be multiplexed behind a single IP address via a method known as "named-based virtual hosting". It exists even with TLS, as SNI (Server Name Indication) was added to serve this purpose. However, in the future, TLS will most likely mandate that SNI be encrypted and not visible to a passive attacker (it is currently in IETF draft status, as someone pointed out below).

anfilt 7y ago
Its still just a draft last I checked. https://tools.ietf.org/html/draft-ietf-tls-esni-04 https://tools.ietf.org/html/draft-ietf-tls-esni-04 Where as tls 1.3 is a RFC. https://tools.ietf.org/html/rfc8446 https://tools.ietf.org/html/rfc8446

JMTQp8lwXL 7y ago

One IP address could have multiple hostnames pointing to it. DNS permits this. I could register my own domain name, right now, and point it to what `dig facebook.com`'s IP address is.

vanadium 7y ago
Pretty much the default position for everyday shared hosting environments, unless a static IP is explicitly requested by a customer.

jcampbell1 7y ago

My thought is that with SNI (Server Name Identification), the domain is transmitted in plaintext as is. Encrypted SNI is a long way off unless everyone starts letting a 3rd party like Cloudflare manage everything. To cut Comcast out of the loop requires the OS/Browsers to switch away from Comcast's DNS, and a huge amount of the web terminating at generic Cloudflare IPs with Encrypted SNI.

nullc 7y ago
Even with esni the payload size is clear, so it isn't too difficult to identify the site being accessed from a small list. And ESNI's limited privacy depends on people centeralizing their services on a small number of cloud providers that get to see everything.

zzzcpan 7y ago

It's possible to extract much much more information [1] than DNS queries for an ISP with off the shelf products, they don't really need your DNS queries for that (yes, DoH people are lying like crazy that it improves privacy). What ISPs do care about is keeping control over DNS, being able to use it for address translation, routing around problematic servers, blocking and intercepting domains, etc. [1] There is lots of stuff leaking all over the place in IP packets passively, not just IP addresses, but like website identifying TLS metadata in case it shares IP address with other websites, user machine and OS identifying metadata, etc. Also when you visit a website, you make requests not just to a single IP address, but also to a bunch of other IP addresses specific to the website to load resources that the page includes that send back responses of specific size and all of this is nicely clustered and mappable to a specific machine you were using. Even if you hide TLS metadata, it only takes a single user visiting a website in the open to identify all the rest who did too and that user can be a headless browser going through alexa top million websites. Active probing is yet another thing that can reveal a lot, ISP can connect to the same port from your IP address, send various things to figure out the protocol and so on, that's how all kinds of obfuscation can be detected.