5 ms·
I was trying to explain this to someone recently and basically described the same. However, there’s still a privacy risk on a public wifi, correct? As in your
by throwoutway 4y ago
I was trying to explain this to someone recently and basically described the same.
However, there’s still a privacy risk on a public wifi, correct? As in your neighbor can see the DNS requests (as those are generally unencrypted).
If you use a VPN, cool, but now your “free VPN” gets to see that.
The only other issues I could think of were ARP poisoning / spoofing and maybe local phishing redirects
- aidenn0 4y agoDoH encrypts dns requests over the local network. HSTS helps with local phishing redirects, as the browser ought not load a 3xx request over http for sites with HSTS enabled.
- nibbleshifter 4y agoA fair amount (DNS, etc) is still in the clear, yes. I still see a good amount of clear text web traffic when I do packet captures in airports and the like. Usually image or media files, but the odd time I see some badly conceived automatic update process pulling an exe or msi over plaintext HTTP.
- roustem 4y agoWould something like NextDNS help?
- tialaramex 4y agoNextDNS offers DoH (DNS over HTTP) so yes, your DNS look ups are encrypted. But of course if an app developer clicked past all the "This is a terrible idea, just stop it" and added that code to download your porn over a plaintext HTTP 1.0 connection from their server this-is-literally-porn.example then NextDNS doesn't magically prevent that when you run their crappy porn app.
- PhantomBKB 4y agoFirefox has built-in support for DNS over HTTPS using NextDNS or Cloudflare
- pydry 4y agoI think debian does package updates over HTTP in the clear. It's not necessarily a problem if the package is signed and the signature is verified.
- tialaramex 4y agoBut you don't have privacy. If you didn't want anybody to know that you've got clown-fetish-program version 1.6.4 installed, then Debian's package upgrade code fetching clown-fetish-program version 1.6.4.1 update is a disappointing give away. In the real world is it embarrassing to have Emacs installed? Or KDE? Or even Tux Racer ? Probably not. But all things being equal we'd rather the program just kept this to itself right?
- Avamander 4y agoIt could also reveal information about your system that could be used for exploiting. E.g. you have a package installed that can be used for privilege escalation once compromised. Not to mention the additional possibility of exploiting apt itself vs. having to exploit the TLS stack (which goes trough a lot more scrutiny).
- teddyh 4y agohttps://tracker.debian.org/pkg/anarchism https://tracker.debian.org/pkg/anarchism
- closewith 4y ago> I still see a good amount of clear text web traffic when I do packet captures in airports and the like. Of all the places I'd avoid packet sniffing, that's high on the list.
- nibbleshifter 4y agoIts where you find the best variety of packets! Far superior to cafes.
- jstanley 4y agoWhy?
- closewith 4y agoBecause irrespective of the legality of packet sniffing on a network you don't own, airport police have no chill.
- throwoutway 4y agoThey also don’t have the competence to actually figure out that you’re packet sniffing. How would they know?
- feet 4y agoThere are multiple reputable non free VPNs, why are you jumping to the conclusion that all VPN users are on a free one?