4 ms·
Can you help me out with the threat model for encrypted DNS? As I see it, the model is that I need to contact a site, and use DNS to get the IP - but either my
by SV_BubbleTime 3y ago
Can you help me out with the threat model for encrypted DNS?
As I see it, the model is that I need to contact a site, and use DNS to get the IP - but either my ISP or my VPN provider can see I’m visiting that IP whether I looked it up just now, or knew it already.
So unless the model is I’m using a VPN, but am leaking via someone else’s logging DNS, I don’t really get it.
- Etheryte 3y agoPersonally my main motivation is I don't want anyone to snoop what sites I visit and then sell that data, my ISP included, but there are other issues too. To quote Cloudflare [0]: > Queries could be directed to a resolver that performs DNS hijacking. For example, in the UK, Virgin Media and BT return a fake response for domains that do not exist, redirecting users to a search page. This redirection is possible because the computer/phone blindly trusts the DNS resolver that was advertised using DHCP by the ISP-provided gateway router. [0] https://blog.cloudflare.com/dns-encryption-explained/ https://blog.cloudflare.com/dns-encryption-explained/
- _Algernon_ 3y agoCant your ISP reverse lookup the IPs you connect to based on your IP headers anyways?
- jrockway 3y agoThey can, but pretty much everything will reverse lookup to Cloudflare or AWS.
- gruez 3y agoSNI reveals the exact site though
- mmwelt 3y agoAs I understand it, this is now being addressed by ESNI[1] and ECH[2]. Hopefully ECH will continue being more widely deployed. [1] https://www.cloudflare.com/learning/ssl/what-is-encrypted-sni/ https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn... [2] https://blog.cloudflare.com/encrypted-client-hello/ https://blog.cloudflare.com/encrypted-client-hello/
- fullspectrumdev 3y agoRather amusingly, the massive centralisation of the internet, which is bad for privacy in every other way, actually protects you here.
- eddd-ddde 3y agoYep, cloudflare dns proxy essentially hides your origin ip addresses.
- prosody 3y agoI think it might become a little more useful in some contexts at least once ECH gets wider adoption. In that case afaik only the DNS server and the remote host you’re connecting to would know what FQDN you're connecting to—anyone else would only see the IP of the remote host. If the host serves requests for lots of different FQDNs, that’s less information going around.
- radlad 3y agoDNS leaks have historically been a thorn in the side of the Tor project, if I understand correctly. Sure, you might have a SOCKS proxy configured for the HTTP request, but depending on how the program makes the DNS query, it might bypass that proxy: https://support.torproject.org/misc/check-socks-dns-leaks/ https://support.torproject.org/misc/check-socks-dns-leaks/ Encrypted DNS isn't a perfect solution, because the request still won't go through the proxy, but at least it won't leak the info to your ISP (assuming you have something else configured as your DNS provider.) Obviously, this isn't limited to just Tor.
- Erratic6576 3y agoYour connection is encrypted through https. Your DNS lookups aren’t yet though. Your ISP or network manager could have access to that data. A vpn reduces speed and battery life
- diarrhea 3y agoGood point. One scenario comes to mind: multiple services under the same IP. “cutecats.com” and “hotintercourse.net” might both resolve to the same IP, but a reverse proxy resolves requests differently depending on the host. Then, knowing the IP but not the host, as your ISP does, becomes a meaningful difference.