Hacker News Reader

Comment by commoner | Hacker News Reader

While encrypted DNS does conceal the domain name from the ISP, it also prevents the ISP from intentionally returning an incorrect IP address in response to a DNS request. This behavior is known as DNS cache poisoning[1] (or DNS spoofing) and has been used by governments to censor websites and perform DDoS attacks on other websites.[2]

[1] https://en.wikipedia.org/wiki/DNS_spoofing

[2] https://www.crowdstrike.com/blog/cyber-kung-fu-great-firewal...

View on HN

> And if I'm not mistaken, even on HTTPS sites, the domain is visible in the request in plaintext too.

I originally misread this sentence. Yes, HTTPS requests expose the domain/subdomain name in plaintext to support Server Name Indication, which allows a server to host multiple HTTPS sites.[1] The domain/subdomain name can be concealed from the ISP with Encrypted SNI,[2] which Cloudflare's 1.1.1.1 DNS resolver supports.

Firefox used to support ESNI as an about:config option, but in version 85, Firefox replaced it with support for an improved mechanism called Encrypted Client Hello.[3][4] ECH is not widely used yet, though Cloudflare is testing it on some of its servers.[5]

With DNS over HTTPS/TLS and ECH, the entire process of connecting to an HTTPS site can be done without leaking the domain/subdomain name to the ISP. The only remaining parts exposed in plaintext are the remote IP address and port.

[1] https://https.cio.gov/faq/#why-are-domain-names-unencrypted-...

[2] https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn...

[3] https://blog.mozilla.org/security/2021/01/07/encrypted-clien...

[4] https://blog.cloudflare.com/encrypted-client-hello/

[5] https://blog.cloudflare.com/handshake-encryption-endgame-an-...

Thanks a lot for the responses, I understand now :)

Reply on news.ycombinator.com