Hacker News Reader

Comment by EastSmith | Hacker News Reader

Why would I need a VPN for browsing if all my traffic is https and I use HTTPS DNS?

Your ISP could still see the servers you connect to and how much data is transferred, they don't need to look in any packets to know you browse YouTube or PornHub, and when, and for how long.

But its also about hiding your identity from the sites you visit (dependent on how well your browser protects your privacy).

Your ISP is only going to see the IPs of the VPN nodes, times you connect, and the bandwidth used but not what sites you are browsing.

Their reply was in response to "Why would I need a VPN for browsing if all my traffic is https and I use HTTPS DNS?"

> Why would I need a VPN for browsing if all my traffic is https and I use HTTPS DNS?

Until TLS 1.4 is deployed, each HTTPS-protected site you visit will still reveal the domain name in its certificate, giving your ISP a pretty good idea of your browsing patterns, which it will in turn sell or turn over to authorities when asked.

TLS 1.3 already encrypts the full certificate. The only place where TLS 1.3 reveals the domain name is the SNI field, but there are ESNI proposals currently being worked on to fix this issue, although realistically, this will only work well with sites behind CDNs. If an IP hosts only a single site, and you connect to it, it will be possible to tell who you are connecting too.

They can also be used to avoid some geographic restrictions, although some services now actively look to block people on VPN. I used to watch new episodes of certain show about a time traveler live via the BBC website despite being in the US.

Reply on news.ycombinator.com