Hacker News Reader

Comment by foxfired | Hacker News Reader

I may be the last person to join the party, but I do not understand how Dns over HTTPS hides me from my ISP.

From my understanding to fetch a url, my make a request to the dns server. If I do it unencrypted, the isp sees the request in plain text. They know where I am going.

But when I do it over DoH, I send an encrypted DNS request to a service, of my choosing, that gives me the ip address of my destination. (is this correct?)

Now, in order to reach that destination ip address, don't I have to use the ISP? Aren't they the ones routing me my request to the destination? Even if it is under HTTPS, the destination has to be known, right? I'm sure I am missing a piece of the puzzle, but where exactly I don't know.

View on HN

With DNS over HTTPS, the ISP would have the ability to see the IP address you are connecting to, yes, but critically they would not have the ability to see the domain name that you had visited unless your browser is also doing SNI. Which it probably is, so from a privacy standpoint, not much changes.

What does change is the ISP's inability to tamper with the DNS response. Many, many ISPs will refuse to actually send a DNS not found for certain record types, instead serving up their own custom search pages with advertisements and other garbage. It also prevents certain classes of MitM that involve intercepting plain-text DNS and re-routing that request to a different server by responding with an attacker-controlled value.

So, from a privacy standpoint, DNS over HTTPS by itself isn't buying you all that much (since SNI leaks the same information during the SSL handshake to your target) but in terms of making your access to the DNS infrastructure much harder to tamper with, it does a whole bunch.

EDIT: ooohhh, ESNI is a thing? This seems interesting to keep an eye on: https://blog.cloudflare.com/esni/

eSNI is still in the draft stages, which is why Chrome has opted not to implement the draft until the standard is finalized or in a state it deems satisfactory[0]. Currently FF and CF implement draft.

There are also many hurdles Google has to consider when rolling out things like this that will break Enterprise deployments. Currently, DoH is completely inaccessible if the browser is "managed" (has Policies) at all, even if the disable DoH policy isn't set. I imagine the same will happen with eSNI.

0: https://crbug.com/908132#c7

You can learn a lot just from the destination IP address:

https://irtf.org/anrw/2019/slides-anrw19-final44.pdf

You need a VPN or Tor to obscure that from your ISP, but your VPN server ISP or your Tor exit node and ISP will always be able to see your destination IP address.

So, 95.7% of alexa top million sites are uniquely identifiable just by looking at a set of IP addresses following initial connection.

This is why real privacy is hard and DoH is a joke from technical perspective and evil from power perspective.

If the IP the domain points at is some big hosting provider like akami/cloudfare, how will they know which site you are actually accessing? TLS still sends the domain name in plaintext, but it's only a matter of time till that is fixed.

It is much easier for the ISP to just inspect the smaller amount of DNS traffic on port 53, than to inspect all traffic including port 443, and scan for HTTPS and SNI. Also, the destination IP does not revel much for CDNs.

Reply on news.ycombinator.com