3 ms·

Forgive me if you will, but I don't really understand the idea behind privacy on DNS. If you're not using a VPN, even if the DNS resolution is private, the ISP

Forgive me if you will, but I don't really understand the idea behind privacy on DNS. If you're not using a VPN, even if the DNS resolution is private, the ISP can still see what IP you're connecting to. It's trivial to do a reverse lookup on that. And if I'm not mistaken, even on HTTPS sites, the domain is visible in the request in plaintext too. So why is there so much focus on proxying DNS?

commoner 5y ago
While encrypted DNS does conceal the domain name from the ISP, it also prevents the ISP from intentionally returning an incorrect IP address in response to a DNS request. This behavior is known as DNS cache poisoning[1] (or DNS spoofing) and has been used by governments to censor websites and perform DDoS attacks on other websites.[2] [1] https://en.wikipedia.org/wiki/DNS_spoofing https://en.wikipedia.org/wiki/DNS_spoofing [2] https://www.crowdstrike.com/blog/cyber-kung-fu-great-firewall-art-dns-poisoning/ https://www.crowdstrike.com/blog/cyber-kung-fu-great-firewal...
- commoner 5y ago
  > And if I'm not mistaken, even on HTTPS sites, the domain is visible in the request in plaintext too. I originally misread this sentence. Yes, HTTPS requests expose the domain/subdomain name in plaintext to support Server Name Indication, which allows a server to host multiple HTTPS sites.[1] The domain/subdomain name can be concealed from the ISP with Encrypted SNI,[2] which Cloudflare's 1.1.1.1 DNS resolver supports. Firefox used to support ESNI as an about:config option, but in version 85, Firefox replaced it with support for an improved mechanism called Encrypted Client Hello.[3][4] ECH is not widely used yet, though Cloudflare is testing it on some of its servers.[5] With DNS over HTTPS/TLS and ECH, the entire process of connecting to an HTTPS site can be done without leaking the domain/subdomain name to the ISP. The only remaining parts exposed in plaintext are the remote IP address and port. [1] https://https.cio.gov/faq/#why-are-domain-names-unencrypted-over-https-today https://https.cio.gov/faq/#why-are-domain-names-unencrypted-... [2] https://www.cloudflare.com/learning/ssl/what-is-encrypted-sni/ https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn... [3] https://blog.mozilla.org/security/2021/01/07/encrypted-client-hello-the-future-of-esni-in-firefox/ https://blog.mozilla.org/security/2021/01/07/encrypted-clien... [4] https://blog.cloudflare.com/encrypted-client-hello/ https://blog.cloudflare.com/encrypted-client-hello/ [5] https://blog.cloudflare.com/handshake-encryption-endgame-an-ech-update/ https://blog.cloudflare.com/handshake-encryption-endgame-an-...
  - claudiawerner 5y ago
    Thanks a lot for the responses, I understand now :)

commoner 5y ago

While encrypted DNS does conceal the domain name from the ISP, it also prevents the ISP from intentionally returning an incorrect IP address in response to a DNS request. This behavior is known as DNS cache poisoning[1] (or DNS spoofing) and has been used by governments to censor websites and perform DDoS attacks on other websites.[2] [1] https://en.wikipedia.org/wiki/DNS_spoofing https://en.wikipedia.org/wiki/DNS_spoofing [2] https://www.crowdstrike.com/blog/cyber-kung-fu-great-firewall-art-dns-poisoning/ https://www.crowdstrike.com/blog/cyber-kung-fu-great-firewal...

commoner 5y ago
> And if I'm not mistaken, even on HTTPS sites, the domain is visible in the request in plaintext too. I originally misread this sentence. Yes, HTTPS requests expose the domain/subdomain name in plaintext to support Server Name Indication, which allows a server to host multiple HTTPS sites.[1] The domain/subdomain name can be concealed from the ISP with Encrypted SNI,[2] which Cloudflare's 1.1.1.1 DNS resolver supports. Firefox used to support ESNI as an about:config option, but in version 85, Firefox replaced it with support for an improved mechanism called Encrypted Client Hello.[3][4] ECH is not widely used yet, though Cloudflare is testing it on some of its servers.[5] With DNS over HTTPS/TLS and ECH, the entire process of connecting to an HTTPS site can be done without leaking the domain/subdomain name to the ISP. The only remaining parts exposed in plaintext are the remote IP address and port. [1] https://https.cio.gov/faq/#why-are-domain-names-unencrypted-over-https-today https://https.cio.gov/faq/#why-are-domain-names-unencrypted-... [2] https://www.cloudflare.com/learning/ssl/what-is-encrypted-sni/ https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn... [3] https://blog.mozilla.org/security/2021/01/07/encrypted-client-hello-the-future-of-esni-in-firefox/ https://blog.mozilla.org/security/2021/01/07/encrypted-clien... [4] https://blog.cloudflare.com/encrypted-client-hello/ https://blog.cloudflare.com/encrypted-client-hello/ [5] https://blog.cloudflare.com/handshake-encryption-endgame-an-ech-update/ https://blog.cloudflare.com/handshake-encryption-endgame-an-...
- claudiawerner 5y ago
  Thanks a lot for the responses, I understand now :)