I know with standard setttings my isp see everything, but if i will use some encrypted dns what they will see exactly
Basically the same thing.
Encrypted DNS is not for privacy, it is for stopping someone from altering your queries basically, because normal DNS is not encrypted. Domains are exposed through other various methods we explain. Please see our website where we’ve gone to the effort to explain this https://www.privacyguides.org/en/advanced/dns-overview/ we have a flow chart that characterizes the above methods of obtaining the domains you’re requesting.
Requesting a website is like sending a letter.
You have to put the adres on the letter, or the post office (your ISP) won’t know where to send the request.
DNS is like a phonebook, but for domain names. It is used to look up the adres you put on the letters you send (websites you visit). Using a custom DNS means that your ISP cannot block websites by omitting them from the phonebook. Adguard uses the same ability of omitting domain names to block ads.
Consider: https://9gag.com/123
A DNS translates “9gag.com” to an internet protocol adres. It is never told that you will use https, or that you request “/123” from 9gag.com
What you do on a website (request “/123”) is always hidden from your ISP IF AND ONLY IF the website uses https. Https puts the details of your request inside the envelope, instead of right next to the adres.
For starters, it prevents some censorship and filtering, because it is usually done on DNS level, like in UK.
ISP can to see, to what domains you have connected, but most webpages use CDN servers like cloudflare, so while he could presume that you have connected to piratebay, there is no guarantee. It could be just an AD on some webpage or a linked picture, because each time you connect to any webpage, your browser makes connection to 30-50 other webpages, so it is not as straightforward as DNS, so an encrypted DNS helps.
To put it simply, if you use ISP DNS, ISP can see that you visited xxx shop in a mall. If you use some DOH, ISP can see, that you visited a mall.
how does DNS over TLS help with privacy? please explain it to me, since the ISP can still see the IP your sending data to and getting data from and can just reverse DNS lookup that IP
With plain DNS the ISP can see that you request example.tld to 1.1.1.1
With encrypted DNS (DoT, DoH, DoQ, DNSCrypt…) the requests are encrypted with TLS or other, o only see that you connected to dns.cloudflare.com not the domain that you request, so it cannot see that you requested example.tld
ISPs can always see what domains you visit due to it being leaked in plain text via the SNI portion of the Client Hello sequence of establishing a TLS connection to a web server, whether your DNS requests are encrypted or not.
It’s important to remember that using encrypted DNS does not shield the domains names you visit from your ISP. I feel this is a fundamental misunderstanding that gives some a false sense of privacy. At best, from a privacy perspective, you might avoid DNS-based logging which are slightly more trivial to log than domain taken from SNI.
Encrypted DNS doesn’t really do much for privacy. It does, however, accomplish two main things:
• Ensures the authenticity of the DNS server you’re receiving a response from due to the certificate exchange.
• Preserves the integrity of the response as it would be difficult for it to be tampered with in-transit.
The domain names you visit are leaked in plain text regardless of your DNS provider and how you connect to them via the “client hello” process of TLS, specifically the Server Name Indication (SNI) portion. ISPs could, in theory, use this to see which domains you’re visiting, even if you’re using encrypted DNS, but not the specific pages within the domain.
Note that there are mechanisms like ECH (Encrypted Client Hello) and ESNI (Encrypted Server Name Indication) that attempt to solve the domain name leakage issue, but each require domains that wish to support these technologies to include an entry specific to those in their DNS records to facilitate key exchange for the encryption to be viable. You’ll also need a DNS client that supports ECH/ESNI. Very few domains and clients presently do this, meaning it is almost certain all/the vast majority of your visited domains would be transmitted in plain text at this point in time.
Yes. In fact, using DNS-based blocking solutions are pretty much the only way to protect against first party trackers that use CNAME cloaking tactics if you’re not using a Firefox browser with UBo, since Chromium browsers have no ability to defend against this type of attack (with the exception of Brave as they implemented their own method of protecting against this with their Shields system.)
A good chunk of the web uses CDNs (content delivery networks) which puts a bunch sites behind the same IP and those gateways rely on SNI to figure out which site to send to the requestor.
DNS translates a hostname to an IP address. Once you get your IP address you’re going to be sending traffic to that address through your ISP so they’ll know what server you’re talking to regardless, DNS reverse lookup exists. Encrypted DNS is not for privacy, it’s for security
CDNs muddy those reverse IP lookups. Encrypted DNS (not from your ISP!) + Encrypted Client Hello are effective in masking what site on a CDN is being accessed.
It doesn’t matter if you use the DNS of your ISP or not they can always see what websites you visit. What they cannot see is website contents if the website is using https, which most modern websites are.
That means your ISP can see that you went to youtube.com but they can’t tell which video you watched or what else you did on the website.
The only thing they could do is analyze the traffic and see that there are many requests in a short time and assume you are probably watching a video.
Edit:
They will of course also not see if you clicked on a category on 9gag.
Also there’s no reason for using a VPN as the VPN provider will see the exact same thing as your ISP.
Also there’s no reason for using a VPN as the VPN provider will see the exact same thing as your ISP.
This is not true for Tor Browser.
And for regular VPN’s that depends on how hostile your ISP or government is. It may be much better to let some company in a far away country who don’t care about what you’re doing to see your stuff.
That last line is extremely oversimplified. If you find a VPN provider you trust more than your ISP, there are several benefits to routing that information through a VPN. Just because they could see the exact same thing does not mean they are redundant.
there’s no reason for using a VPN as the VPN provider will see the exact same thing as your ISP.
That statement feels intentionally misleading.
The ISPs and VPNs product alignments/value propositions are very different, as well as the jurisdictions they operate under.
For example here in Australia we have extremely fucked privacy laws, ISPs have to store your history for a minimum of 7 years and must comply with any warrentless government data request within a day if they want to so much as exist. The service they provide is internet, zero privacy.
A VPN based in Sweden with none of my personal info being paid specifically to protect my privacy is providing a different service.
The DNS is useful only to translate the hostname (9gag.com) to an IP address. If you use a different DNS then the one offered by your ISP, the ISP will not record the fact that you asked a translation of 9gag.com
But I think they can still see that you visited 9gag, just not which pages in 9gag (possibly after the first request) because https hides the details after you connect to their server.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !privacyguides@lemmy.one
In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.
This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.
You can subscribe to this community from any Kbin or Lemmy instance:
Check out our website at privacyguides.org before asking your questions here. We’ve tried answering the common questions and recommendations there!
Want to get involved? The website is open-source on GitHub, and your help would be appreciated!
This community is the “official” Privacy Guides community on Lemmy, which can be verified here. Other “Privacy Guides” communities on other Lemmy servers are not moderated by this team or associated with the website.
Moderation Rules:
We prefer posting about open-source software whenever possible.
No soliciting engagement: Don’t ask for upvotes, follows, etc.
Surveys, Fundraising, and Petitions must be pre-approved by the mod team.
Be civil, no violence, hate speech. Assume people here are posting in good faith.
Don’t repost topics which have already been covered here.
News posts must be related to privacy and security, and your post title must match the article headline exactly. Do not editorialize titles, you can post your opinions in the post body or a comment.
Memes/images/video posts that could be summarized as text explanations should not be posted. Infographics and conference talks from reputable sources are acceptable.
No help vampires: This is not a tech support subreddit, don’t abuse our community’s willingness to help. Questions related to privacy, security or privacy/security related software and their configurations are acceptable.
No misinformation: Extraordinary claims must be matched with evidence.
Do not post about VPNs or cryptocurrencies which are not listed on privacyguides.org. See Rule 2 for info on adding new recommendations to the website.
General guides or software lists are not permitted. Original sources and research about specific topics are allowed as long as they are high quality and factual. We are not providing a platform for poorly-vetted, out-of-date or conflicting recommendations.
Basically the same thing.
Encrypted DNS is not for privacy, it is for stopping someone from altering your queries basically, because normal DNS is not encrypted. Domains are exposed through other various methods we explain. Please see our website where we’ve gone to the effort to explain this https://www.privacyguides.org/en/advanced/dns-overview/ we have a flow chart that characterizes the above methods of obtaining the domains you’re requesting.
Requesting a website is like sending a letter. You have to put the adres on the letter, or the post office (your ISP) won’t know where to send the request.
DNS is like a phonebook, but for domain names. It is used to look up the adres you put on the letters you send (websites you visit). Using a custom DNS means that your ISP cannot block websites by omitting them from the phonebook. Adguard uses the same ability of omitting domain names to block ads.
Consider: https://9gag.com/123 A DNS translates “9gag.com” to an internet protocol adres. It is never told that you will use https, or that you request “/123” from 9gag.com
What you do on a website (request “/123”) is always hidden from your ISP IF AND ONLY IF the website uses https. Https puts the details of your request inside the envelope, instead of right next to the adres.
For starters, it prevents some censorship and filtering, because it is usually done on DNS level, like in UK.
ISP can to see, to what domains you have connected, but most webpages use CDN servers like cloudflare, so while he could presume that you have connected to piratebay, there is no guarantee. It could be just an AD on some webpage or a linked picture, because each time you connect to any webpage, your browser makes connection to 30-50 other webpages, so it is not as straightforward as DNS, so an encrypted DNS helps.
To put it simply, if you use ISP DNS, ISP can see that you visited xxx shop in a mall. If you use some DOH, ISP can see, that you visited a mall.
use dns-over-tls if you want privacy.
also only domains are exposed in plain text.
how does DNS over TLS help with privacy? please explain it to me, since the ISP can still see the IP your sending data to and getting data from and can just reverse DNS lookup that IP
With plain DNS the ISP can see that you request example.tld to 1.1.1.1
With encrypted DNS (DoT, DoH, DoQ, DNSCrypt…) the requests are encrypted with TLS or other, o only see that you connected to dns.cloudflare.com not the domain that you request, so it cannot see that you requested example.tld
ISPs can always see what domains you visit due to it being leaked in plain text via the SNI portion of the Client Hello sequence of establishing a TLS connection to a web server, whether your DNS requests are encrypted or not.
It’s important to remember that using encrypted DNS does not shield the domains names you visit from your ISP. I feel this is a fundamental misunderstanding that gives some a false sense of privacy. At best, from a privacy perspective, you might avoid DNS-based logging which are slightly more trivial to log than domain taken from SNI.
isp can still see the ip, but it’s not as big of an issue as plain domain names (because the default dns logs requests 90% of the time).
I’m fairly certain that’s not how it works, you’re describing a VPN where your isp routes all traffic to an IP
Almost, but only for DNS https://heimdalsecurity.com/blog/what-is-encrypted-dns-traffic/
You can also use DNS-over-SSH or DNS-over-TOR, only tunnels the DNS not the whole traffic
deleted by creator
Encrypted DNS doesn’t really do much for privacy. It does, however, accomplish two main things:
• Ensures the authenticity of the DNS server you’re receiving a response from due to the certificate exchange.
• Preserves the integrity of the response as it would be difficult for it to be tampered with in-transit.
The domain names you visit are leaked in plain text regardless of your DNS provider and how you connect to them via the “client hello” process of TLS, specifically the Server Name Indication (SNI) portion. ISPs could, in theory, use this to see which domains you’re visiting, even if you’re using encrypted DNS, but not the specific pages within the domain.
Note that there are mechanisms like ECH (Encrypted Client Hello) and ESNI (Encrypted Server Name Indication) that attempt to solve the domain name leakage issue, but each require domains that wish to support these technologies to include an entry specific to those in their DNS records to facilitate key exchange for the encryption to be viable. You’ll also need a DNS client that supports ECH/ESNI. Very few domains and clients presently do this, meaning it is almost certain all/the vast majority of your visited domains would be transmitted in plain text at this point in time.
Ad and tracker blocking at the DNS level is a solid way to improve privacy right? Whether it be using your VPN’s DNS or something like NextDNS.
Yes. In fact, using DNS-based blocking solutions are pretty much the only way to protect against first party trackers that use CNAME cloaking tactics if you’re not using a Firefox browser with UBo, since Chromium browsers have no ability to defend against this type of attack (with the exception of Brave as they implemented their own method of protecting against this with their Shields system.)
The ISP can still see which IPs you’re visiting, so couldn’t they cover most cases by just doing their own lookup, but backwards?
A good chunk of the web uses CDNs (content delivery networks) which puts a bunch sites behind the same IP and those gateways rely on SNI to figure out which site to send to the requestor.
If the website you visit uses HTTPS (SSL), then your ISP can see that you’ve visited
9gag.combut not what specific URL.If you don’t want them to see your DNS requests, you can use DNS Over HTTPS (DoH) or DNS Over TLS (DoT) I think
also you should usually prefer DoT over DoH
DNS translates a hostname to an IP address. Once you get your IP address you’re going to be sending traffic to that address through your ISP so they’ll know what server you’re talking to regardless, DNS reverse lookup exists. Encrypted DNS is not for privacy, it’s for security
Thanks for clearing that up. But it would still be better than not having it as multiple host names/websites could point to the same IP, right?
Also I’m not sure how you read my comment since I deleted it right after I posted it 😂. Still learning this Lemmy stuff
CDNs muddy those reverse IP lookups. Encrypted DNS (not from your ISP!) + Encrypted Client Hello are effective in masking what site on a CDN is being accessed.
It doesn’t matter if you use the DNS of your ISP or not they can always see what websites you visit. What they cannot see is website contents if the website is using https, which most modern websites are.
That means your ISP can see that you went to youtube.com but they can’t tell which video you watched or what else you did on the website.
The only thing they could do is analyze the traffic and see that there are many requests in a short time and assume you are probably watching a video.
Edit:
They will of course also not see if you clicked on a category on 9gag.
Also there’s no reason for using a VPN as the VPN provider will see the exact same thing as your ISP.
This is not true for Tor Browser.
And for regular VPN’s that depends on how hostile your ISP or government is. It may be much better to let some company in a far away country who don’t care about what you’re doing to see your stuff.
That last line is extremely oversimplified. If you find a VPN provider you trust more than your ISP, there are several benefits to routing that information through a VPN. Just because they could see the exact same thing does not mean they are redundant.
That statement feels intentionally misleading. The ISPs and VPNs product alignments/value propositions are very different, as well as the jurisdictions they operate under. For example here in Australia we have extremely fucked privacy laws, ISPs have to store your history for a minimum of 7 years and must comply with any warrentless government data request within a day if they want to so much as exist. The service they provide is internet, zero privacy. A VPN based in Sweden with none of my personal info being paid specifically to protect my privacy is providing a different service.
not to forget that in some territories you have to use a VPN even to access Wikipedia 🤷
The DNS is useful only to translate the hostname (9gag.com) to an IP address. If you use a different DNS then the one offered by your ISP, the ISP will not record the fact that you asked a translation of 9gag.com
But I think they can still see that you visited 9gag, just not which pages in 9gag (possibly after the first request) because https hides the details after you connect to their server.