23 ms·

So why is this better when people could still take the raw IP addresses and do reverse look ups? If I recall looking into the spec before there is a reason it’

So why is this better when people could still take the raw IP addresses and do reverse look ups? If I recall looking into the spec before there is a reason it’s an improvement but I can’t recall what it was. I know there are tons of servers behind proxies and so forth but still it seems like over time databases could be built up to give some decent success with this countermeasure.

vbezhenar 6y ago
rocketspark.com -> 104.22.34.138 104.22.34.138 is one of the cloudflare servers, it does not have reverse dns record and you can't associate it with any specific website. If you're monitoring traffic, you would have no idea what website user is visiting unless you can intercept his unencrypted DNS queries as well. So CDNs increase user security a little bit.
- mappu 6y ago
  If you're monitoring traffic you can see the SNI header in plaintext. ESNI is not deployed yet (and is only as secure as DNS; that is maybe why browsers are implementing DoH themselves instead of waiting for the OS).
an_opabinia 6y ago
For narrow cases like Cloudflare load balancing traffic, it would be difficult to reverse lookup without other compromises. It always depends on who your adversary is. Chrome is a controlled, auto-updating application. Your Cloudflare traffic is going to a central authority, Cloudflare. They could decide to sell traffic information. Or the government where Google or Cloudflare main line employees eat and sleep could ask or order those working stiffs to do something secretly in spite of company policy or promises. This does protect against a very narrow adversary, which is your ISP or router manufacturer monetizing your aggregated traffic statistics. It remains to be seen if there was ever harm there to the user in the first place. The government, as an adversary, generally wants to put you in jail. Google working stiffs generally don't want to go to jail, so they'll comply with requests; or Google will want the government's business and just do the thing they ask for. Google already gives you the thing for free. Your ISP and router manufacturer just want to offer you lower prices. Corporate and closed source or remotely managed software promises are just that.

vbezhenar 6y ago

rocketspark.com -> 104.22.34.138 104.22.34.138 is one of the cloudflare servers, it does not have reverse dns record and you can't associate it with any specific website. If you're monitoring traffic, you would have no idea what website user is visiting unless you can intercept his unencrypted DNS queries as well. So CDNs increase user security a little bit.

mappu 6y ago
If you're monitoring traffic you can see the SNI header in plaintext. ESNI is not deployed yet (and is only as secure as DNS; that is maybe why browsers are implementing DoH themselves instead of waiting for the OS).

an_opabinia 6y ago

For narrow cases like Cloudflare load balancing traffic, it would be difficult to reverse lookup without other compromises. It always depends on who your adversary is. Chrome is a controlled, auto-updating application. Your Cloudflare traffic is going to a central authority, Cloudflare. They could decide to sell traffic information. Or the government where Google or Cloudflare main line employees eat and sleep could ask or order those working stiffs to do something secretly in spite of company policy or promises. This does protect against a very narrow adversary, which is your ISP or router manufacturer monetizing your aggregated traffic statistics. It remains to be seen if there was ever harm there to the user in the first place. The government, as an adversary, generally wants to put you in jail. Google working stiffs generally don't want to go to jail, so they'll comply with requests; or Google will want the government's business and just do the thing they ask for. Google already gives you the thing for free. Your ISP and router manufacturer just want to offer you lower prices. Corporate and closed source or remotely managed software promises are just that.