Memes

45734 readers

415 users here now

Rules:

Be civil and nice.
Try not to excessively repost, as a rule of thumb, wait at least 2 months to do it if you have to.

founded 5 years ago

MODERATORS

[email protected]

1038

Cough Cough... Chrome... Chough... (slrpnk.net)

submitted 7 months ago by [email protected] to c/[email protected]

143 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 8 points 7 months ago (1 children)

Encrypted DNS anyone? (NextDNS for example)

[–] [email protected] 5 points 7 months ago (1 children)

That solves a completely different problem. The ISP can still see who you requested data from.

That's more about security around retrieving the correct IP address from a DNS query, and doesn't do that much for privacy.

[–] [email protected] 5 points 7 months ago (1 children)

DoT also encrypts the request, so the ISP cannot spy on the Domain Name you have requested.

And thanks to Https the ISP only sees the IP address which cannot in every case be resolved to a unique Domain, especially large sites that are hosted on service providers like Cloudflare, amazon etc etc

[–] [email protected] 2 points 7 months ago* (last edited 7 months ago) (3 children)

But what's not encrypted by either is the Server Name Indicator or SNI, ie: the initial request to a webserver stating which host you're trying to reach at that IP, before establishing the TLS connection, contains the domain you'd requested via DoH/DoT, in plaintext.

[–] [email protected] 3 points 7 months ago (1 children)

encrypted SNI is a thing now.

[–] [email protected] 4 points 7 months ago

True. Known as Encrypted Client Hello now, as part of TLS1.3.

It seems many more browsers support it than last I'd looked. I'm curious to see how much of the general web has adopted support for it onnthe server side. I'll have to look into that more, and see what it'll take to setup for self-hosting.

[–] [email protected] 1 points 7 months ago

That is correct. HSTS helps to some degree but the very first request is still unprotected.

[–] [email protected] 1 points 7 months ago (1 children)

https://www.cloudflare.com/learning/dns/dns-over-tls/

If I understand it correctly DoH (which I use with NextDNS) should prevent ISP from snooping.

[–] [email protected] 1 points 7 months ago* (last edited 7 months ago)

It will prevent the ISP from snooping on, or tampering with, the DNS request. However when you go to use the IP you've retrieved via DoH/DoT; your first request establishing a TLS connection to that IP will contain an unencrypted SNI which states the domain you are trying to use. This can be snooped on by your ISP.