2 ms·
"This makes no sense. your ISP cannot see that you are visiting facebook" There are many massive databases of ip to hostname mappings which can be trivially qu
by mike-cardwell 7y ago
"This makes no sense. your ISP cannot see that you are visiting facebook"
There are many massive databases of ip to hostname mappings which can be trivially queried by an ISP to see what service you're connecting to.
Or if they see you connecting to 185.60.216.35, they can just:
curl http://185.60.216.35 -v 2>&1|grep Location
Or:
openssl s_client -connect 185.60.216.35:443 2>&1 | openssl x509 -text|grep Subject:
Or one of a miriad of other ways to get a hint about the hostname of the service you're connecting to, at which point they can automatically do forward DNS lookups to confirm what matches.
DoH only adds to the number of organisations that can see your web traffic. It does not reduce it, or shift it to a more trustworthy organisation. It just adds more leaks.
DoH/ESNI don't stop your ISPs knowing exactly what sites you're visiting unless we centralise HTTP behind a handful of benevolant gateways the same way Mozilla is doing with DNS.
Fuck that.