3 ms·
In general I agree about it not providing security benefit, but they can reduce the exposure of eavesdropping like DNS leaking browsing patterns, and so on. Sur
by mmsc 3y ago
In general I agree about it not providing security benefit, but they can reduce the exposure of eavesdropping like DNS leaking browsing patterns, and so on. Sure, you’re now leaking your DNS traffic to the VPN server, but in my opinion it’s better to leak that to somewhere external than somewhere close by (e.g. to companies or individuals directly related to your network that will use it for monitoring and monetisation)
https downgrade attacks and the like (html injection on http pages) can also be thwarted (unless they are done on the vpn->service path ofc),
- al_borland 3y agoWouldn’t switching to something like Cloudflare’s 1.1.1.1 DNS mostly solve the DNS issue without going the VPN route? The user’s DNS provider would no longer be their ISP.
- mschuster91 3y ago> The user’s DNS provider would no longer be their ISP. Only if the ISP doesn't do DPI to transparently route any outgoing DNS traffic to their (censoring) servers. There have been enough cases of that.
- yjftsjthsd-h 3y agoDoes that work anymore with DNS over HTTPS? I think the real leak is that until we get Encrypted Client Hello your HTTPS connections expose the domain in plaintext so DNS is kind of a moot point.
- WirelessGigabit 3y agoIt does not. DoH and DoT is a real lifesaver for the privacy-minded people. And it's hell for the security minded people. Before I could do DNAT on my router to redirect everything to my Pi-Hole, even the Google Mini that staunchly ignored the handed out DNS, but used 8.8.8.8. But soon they'll start using DoH and I can't do anything anymore at all. I believe IMDb on iOS already uses DoH.