Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

With DNS over HTTPS, the ISP would have the ability to see the IP address you are connecting to, yes, but critically they would not have the ability to see the domain name that you had visited unless your browser is also doing SNI. Which it probably is, so from a privacy standpoint, not much changes.

What does change is the ISP's inability to tamper with the DNS response. Many, many ISPs will refuse to actually send a DNS not found for certain record types, instead serving up their own custom search pages with advertisements and other garbage. It also prevents certain classes of MitM that involve intercepting plain-text DNS and re-routing that request to a different server by responding with an attacker-controlled value.

So, from a privacy standpoint, DNS over HTTPS by itself isn't buying you all that much (since SNI leaks the same information during the SSL handshake to your target) but in terms of making your access to the DNS infrastructure much harder to tamper with, it does a whole bunch.

EDIT: ooohhh, ESNI is a thing? This seems interesting to keep an eye on: https://blog.cloudflare.com/esni/



eSNI is still in the draft stages, which is why Chrome has opted not to implement the draft until the standard is finalized or in a state it deems satisfactory[0]. Currently FF and CF implement draft.

There are also many hurdles Google has to consider when rolling out things like this that will break Enterprise deployments. Currently, DoH is completely inaccessible if the browser is "managed" (has Policies) at all, even if the disable DoH policy isn't set. I imagine the same will happen with eSNI.

0: https://crbug.com/908132#c7




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: