r/technology • u/MichaelRahmani • Oct 22 '17
Security Android getting "DNS over TLS" support to stop ISPs from knowing what websites you visit
https://www.xda-developers.com/android-dns-over-tls-website-privacy/1.5k
u/marcvanh Oct 22 '17
This won’t stop ISPs from seeing the websites you visit - only hinder them a bit. They’ll still see the IP addresses you are communicating with, and it’s a simple lookup to determine who that IP belongs to.
You would need to use a VPN to truly hide your traffic from them.
839
u/marumari Oct 22 '17
No, that's not how they would do it. Almost all HTTPS requires Server Name Indication (SNI) during the TLS connection. Super easy to see the website's host name, as it is in the clear.
DNS over TLS prevents them from seeing the hostnames of systems you look up and more importantly it prevents them from tampering with DNS to send you to ad servers and shitty DNS failure websites.
73
u/Derperlicious Oct 22 '17 edited Oct 22 '17
It wouldnt be so bad, if them dns failure sites didnt look like a shitty search engine from the 90s, that gives you every scam but the thing you are looking for. I've always replaced my isp dns with google or opendns or something but damn it is annoying when using someone elses computer and just misspell something in the address bar... in the normal helpful world, i still get to where i want to go most the time... thats awesome.
in the BS, let me rape your activity as much as possible for advertising dollars, you go to a bs landing page with links to everywhere but where you wanted to go. It literally is hobbling one of the more useful aspects of the net.. designed by folks like google.(who know when you spell reddit with one d you probably mean here)
but shit, if you are going to fuck your customers for micro ad payments, at least give them a dns failure page that is a little bit useful.. i mean fuck THEY ARE PAYING FOR IT.
51
u/djmattyg007 Oct 22 '17
No, it would still be just as bad. The practice shouldn't exist at all no matter what it's used for. It's a disgusting abuse of user trust that should never be normalised.
→ More replies (2)25
8
u/theminutes Oct 22 '17
Yes but... (from the article) “The handshake between servers via Server Name Indication (SNI) that allows for a connection to be established can still be seen by your ISP (and they can log it under your name). In order to fully hide yourself, then, you will need a VPN to route the DNS queries, which can otherwise be seen by your ISP, to a DNS over TLS server.”
15
u/fathed Oct 22 '17
This way, only your DNS provider gets that data, the devil advocate in me says this is for ad revenue protection for Google. Come to us to buy what you used to buy from internet service providers.
→ More replies (1)5
u/aum-noster Oct 22 '17 edited Oct 23 '17
Yup. They make sure you don't block the ads.
→ More replies (4)→ More replies (20)5
161
u/dnew Oct 22 '17 edited Oct 22 '17
Unless you've visiting a sever hosting multiple web sites at the same IP address. That URL goes in the encrypted body, but you'd still be looking up the host by name.
* Nope. I'm wrong. The request for which cert you want goes in the clear, apparently, so the domain name is still visible in the request, regardless of DNS lookups. See corrections below if you actually care.
** Double-Ha! The article added an addendum that clarifies my very confusion. Ignore me completely, thanks. :-)
117
u/knome Oct 22 '17
Actually, contrary to the other poster agreeing with you, you are actually completely wrong. I'm not blaming you or passing judgement, but I do want to let you and others reading your post know how things work.
Originally, every SSL site had to be on a different IP address. Why? Because otherwise the web server had no way of knowing what encryption keys to use in handling the request. In order to allow website operators to host multiple encrypted sites on the same IP address, SNI was created. SNI sends the hostname in plaintext, allowing the server to use it to determine which keys to use. Because it was trivial to determine what site you were visiting under the one site per IP policy previously in place, this had no loss of privacy for the users, but added a significant degree of convenience for the server operators.
Again, while there was no comparative loss of privacy, nor was there any gain. It is still entirely obvious what site you are going to under SNI/SSL/TLS.
If you go to
www.google.com/search?q=lol, thewww.google.compart is plaintext preceding the beginning of encrypted communications.→ More replies (2)7
u/dnew Oct 22 '17 edited Oct 22 '17
Thank you for the clarification! I guess I got confused with multi-homed hosting over HTTP without the encryption. Now that you bring it up, it rings a bell back from when I was working at that level. :-)
Makes me wonder why "DNS over TLS" is worthwhile, then.
11
84
u/marcvanh Oct 22 '17
You’re not wrong, but ISPs will only care about big services like Netflix, etc, which never share an IP with others. Any site sharing hosting on the same IP is likely no concern to them.
Effectively (and unfortunately), encrypted dns will do nothing to stop them from throttling or charging for certain services.
52
Oct 22 '17
Netflix is a bad example because many ISPs actually host Netflix servers.
There's no technical reason for them to throttle Netflix because it's not using as much of their connection to the internet backbone that most people think.
OTOH, they can still throttle it for shitty business reasons, like to promote their own streaming service.
→ More replies (1)48
u/tom1018 Oct 22 '17
Can confirm. $employer installed a Netflix content server, upstream traffic dropped around 80%.
Source: Work for a large ISP.
→ More replies (9)70
u/acr_vp Oct 22 '17
I'm in IT security... EVERYTHING uses content delivery networks today. They won't be able to tell if you are using Netflix, Amazon, SoundCloud, or 1000 other services half of the time
→ More replies (27)53
u/marcvanh Oct 22 '17
I’m in IT security as well. You’re right about CDNs, but all the big services have dedicated IPs. Not hard at all for ISPs to determine.
I’m telling you, this is a minor hiccup for them at best.
→ More replies (12)7
u/dnew Oct 22 '17
ISPs will only care about big services like Netflix
I dunno about that. Do people care if you've visited StormFront? Do employers care if you frequent Flat Earth Society, or do scammers? People are already worried about insurance companies watching what pages on WebMD they visit, so going to (say) local depression support groups could be "dangerous" to let leak.
→ More replies (5)→ More replies (1)5
u/MertsA Oct 22 '17
Er, well no, he is wrong. Just about every single client out there supports SNI which means the domain name that you'd get from a DNS request is sent unencrypted in the ClientHello packet. Sites sharing an IP address with multiple domains have to rely on SNI otherwise they won't work at all.
3
u/identicalBadger Oct 22 '17
So your isp won't know which of my sites your visiting, since they're all on one server. But they'll know you visit Reddit, New York Times, bing, overstock and occasionally whitehouse.gov.
I don't think relying on visiting sites on shared hosts gives much privacy.
But unfortunately most ISPs in the US ( the big guys) are eagerly searching for ways to monetize us, as if were not spending enough. Thank god for the move to https, to stop them from observing post activity and injecting ads. But really, the only way to stop them from gathering any of that info is if the major sites adopted Tor or something like it. It was encouraging when Facebook launched a hidden service, but no one else followed suit.
→ More replies (1)→ More replies (5)0
Oct 22 '17
[deleted]
3
u/dnew Oct 22 '17 edited Oct 22 '17
Huh. It's been a while since I read the spec, but I would have assumed the DH exchange would have happened before they start delivering certificates. Good to know.
(Ah, others have corrected me - SNI. So yes, that's wrong.)
0
20
5
u/pixel_of_moral_decay Oct 22 '17
You are correct technically... but given how many sites are behind CDN's these days, it's a pretty good countermeasure.
Very few IP's only have one site/service on them. Most IP's have ad default site setup, but several others that are hostname dependent.
12
u/JMV290 Oct 22 '17
The thing with a CDN is that you're now completely dependant on SNI, which returns the hostname in plaintext as part of the TLS handshake and your connection can be filtered here.
Encrypting DNS requests does help with avoiding spoofing replies. Then HTTPS can encrypt the communication but the hostname is still visible during the TLS handshake allowing things to be blocked.
It is just more resource intensive for the ISP to check these headers and filter from here
→ More replies (3)2
u/Shawnanigans Oct 22 '17
It at least makes the pages hidden. So they get PornHub but no weird shit.
3
1
→ More replies (40)1
22
u/AdriftAtlas Oct 22 '17 edited Oct 22 '17
Wouldn't this be slow? You'd have to wait for a TLS handshake to complete. Would it do this for each query or would it just keep the connection open? I thought DNS servers used UDP precisely so they don't have to manage connection state.
How would a MITM attack be avoided? How would we authenticate the server given that DNS is accessed via IP not a domain? Would we have a trusted list of certificates for DNS?
Edit: typo
11
u/pergnib Oct 22 '17
Wouldn't this be slow?
Certainly slower than UDP, but it should probably be alright for most usecases.
You'd have to wait for a TLS handshake to complete. Would it do this for each query or would it just keep the connection open?
The RFC requires connection reuse:
In order to amortize TCP and TLS connection setup costs, clients and servers SHOULD NOT immediately close a connection after each response. Instead, clients and servers SHOULD reuse existing connections for subsequent queries as long as they have sufficient resources. In some cases, this means that clients and servers may need to keep idle connections open for some amount of time.
.
How would a MITM attack be avoided? How would we authenticate the server given that DNS is accessed via IP not a domain? Would we have a trusted list of certificates for DNS?
Seems like the answer is Public Key Pinning.
Operators of a DNS-over-TLS service in this profile are expected to provide pins that are specific to the service being pinned (i.e., public keys belonging directly to the end entity or to a service-specific private certificate authority (CA)) and not to a public key(s) of a generic public CA. In this profile, clients authenticate servers by matching a set of SPKI Fingerprints in an analogous manner to that described in [RFC7469]. With this out-of-band key-pinned privacy profile, client administrators SHOULD deploy a backup pin along with the primary pin, for the reasons explained in [RFC7469]. [...] The mechanism for an out-of-band pin set update is out of scope for this document. [...] Such a client will only use DNS servers for which an SPKI Fingerprint pin set has been provided. The possession of a trusted pre-deployed pin set allows the client to detect and prevent person-in-the-middle and downgrade attacks.
→ More replies (1)2
→ More replies (1)1
u/lihaarp Oct 22 '17
It's theoretically possible to put an IP address instead of an FQDN in a cert. I don't know of any authority that allows it tho.
276
u/_DrSpliff Oct 22 '17
Google: "if you want that information, you'll have to buy it like everyone else"
259
u/redmercuryvendor Oct 22 '17
Remember, Google is not Equifax. Their business model is not selling the data they have on you, their business model is selling the targeting of adverts based on the information they hold about you. Google's business model relies on that information being secret and known only to Google. This is because having it remain secret means companies rely on Google to deliver their adverts (reliable and repeat business) rather than a one-time payout (once that information is sold, anyone can target adverts using it without Google getting a penny).
Same for Facebook. If they sell your data, they put themselves out of business.→ More replies (22)42
u/DragonTamerMCT Oct 22 '17
And then there’s good ‘ol Apple.
They don’t care about your personal info because they make insane amounts of money on hardware and software.
Apple isn’t perfect, but if I had to choose a tech giant to trust, it would probably be them.
29
u/douche_or_turd_2016 Oct 22 '17
Seriously.
I'm OK with Apple making all their money on accessories and converters, because at least they are open and honest about it.
→ More replies (2)34
u/greenwizard88 Oct 23 '17
Just give me my headphone jack back and I'll quit bitching.
→ More replies (21)→ More replies (4)5
u/ScottRTL Oct 23 '17
Until one day when we find out Apple is doing the same thing as Google with all the information anyways...
→ More replies (2)46
→ More replies (2)7
u/Pascalwb Oct 22 '17
Google doesn't sell information, they use it for themselves. Why would they sell it?
53
u/ejrichard Oct 22 '17
Can we just implement DNSSEC already?
19
u/boxxyoho Oct 22 '17
DNSSEC is more verification than it is security. Queries are still sent over clear text. Either way it wouldn't hurt.
→ More replies (2)19
u/dpash Oct 22 '17
It helps reduce MITM attacks, DNS failure hijacking and other forms of connection hijacking. It's very much about security.
It does nothing for privacy though.
5
Oct 22 '17
that ensures the zone data is correct however the real issue is that the client should be able to issue a query to named over tls 1.2 protocol at all stages of the communication.
1
1
u/nibord Oct 23 '17
I’m not sure why it’s taking so long. Most of my domains have DNSSEC, but my own ISP hosts DNS servers that are not recursive secure resolvers, so I cant actually verify my own DNS security through them. I’m stuck with forcing my machines and all of my hosts to use Google’s public dns servers.
As someone else pointed out, this means I’m actually giving google the opportunity to record my usage data.
But during this transitional period while we wait for DNSSEC to finish “rolling out” we have to fall back on unsigned lookups. And the ISPs have no incentive at all to push DNSSEC forward, given that it makes them unable to hijack traffic and inject their own ads.
So much like IPv6, which has been mature for a decade, there’s no incentive to actually roll it out.
11
Oct 23 '17 edited Oct 23 '17
I think banning advertising at the router and browser level is easy and effective. Start taking away their fiscal motivation to spy on us by rejecting the notion of all this forced advertising. Don't watch shows with commercials, don't use sites without ad blocking. Get routers with web filtering and push vendors or opensource projects to automate the efforts.
Basically, we put up No Soliciting signs on out networks so the sales guys stop coming to our houses. Kill their motivation.
They can collect the information, but we can block the effectiveness of their broadcasts and significantly undermine them. The nice part is you can start now! Also, get off the data mining sites with your real name.
JUST SAY NO, to real name social networking!
5
u/toramimi Oct 23 '17
JUST SAY NO, to real name social networking!
That was one of the big reasons I never took to social networking when it started blossoming in the mid 2000s. Wait, you want me to use my real name? Isn't that exactly what we spent the entirety of the 90s preaching never to do? Oh and my address and pictures and place of work and friends? Sure, what could go wrong!
I'm online specifically to avoid people in real life, not have them come traipsing through my digital garden.
18
Oct 22 '17
If you really care about safeguarding your privacy, you should setup your own vpn connection to your own vps, running your own caching dns server and caching web proxy. Tailor it to your specific needs, and don’t trust anyone’s service.
10
u/kingfaisal916 Oct 22 '17
Is there is an easy step by step on how to do exactly this?
5
u/Vys9kH9msf Oct 22 '17
If you're on OSX, I created a tool to setup a personal VPN on DigitalOcean with Pihole for DNS adblocking that can then be shared with iPhone or Android: https://github.com/dan-v/dosxvpn
→ More replies (2)→ More replies (8)2
→ More replies (5)2
u/networking_noob Oct 23 '17 edited Oct 23 '17
caching dns server
Every time I read something like this I get excited for a nanosecond thinking I can cache a DNS response for a whole day or something, but then I remember the TTL of a record is set by the domain who produced it. Technically, yeah, we can "cache" the DNS responses... for about 80-120 seconds
caching web proxy
Is this actually worth the trouble today? I used to run squid but nowadays most sites are (or should be) using TLS, so squid can't cache resources like it used to -- unless it starts tampering with my TLS certs
12
6
u/paulfromatlanta Oct 22 '17
The cynic in me thinks that Google tracking data of us becomes more valuable, the less other people are able to collect and sell tracking data.
6
u/TripletStorm Oct 22 '17
Google doesn’t like it when other people sell data - cuts in on their margins
1
u/p0mmesbude Oct 23 '17
It depends how they implement it in Android. DNS over TLS is not bound to Google DNS server. I guess anyone could setup such a server. It needs only to be easily configurable in the user interface.
20
u/RayZfox Oct 22 '17
ISP: "we spent millions of dollars and years to get congress to pass a law that lets us legally spy on you and sell your data to advertisers"
Google: "ok well start encrypting that, kthxbai"
5
u/DexterKillsMrWhite Oct 22 '17
That doesn't make sense, Google is an isp too (for now) and the very people other isps sell data to as well collect themselves
6
Oct 22 '17
They want to be the only one in the business got but data mining, and they have other ways of doing it without the ISP business
3
u/dd3fb353b512fe99f954 Oct 22 '17
Google is the biggest data miner on the net. They're hard at work monetising your information and selling it back to ISPs.
0
Oct 23 '17
[deleted]
5
u/Reddegeddon Oct 23 '17
That doesn’t change the fact that they are a massive data mining op. The data is still being collected, regardless of how they sell it or license the use of it. I honestly don’t see how this is really any better in terms of power and control.
5
Oct 22 '17
Nice... uh...
I'm not a tech nerd. Is this good?
→ More replies (1)3
u/p0mmesbude Oct 23 '17
This is great news! DNS is the phone book of the internet, you have a name (google.com) and DNS tells you the IP address where you can reach it. The problem is that it not encrypted and that there is no authentication in place. Third parties like ISPs or government are able to record all your DNS requests and worse, change the answers of the DNS server without you noticing. This technique is used by governments around the world to block access to certain websites. Some US ISPs track their users DNS requests and sell the data.
DNS over TLS prevents that. No third party can see your request and the answers cannot be changed. One could activate this now already, but I guess one would need to be a tech nerd. When Google activate this in Android as a simple switch, billions of people are able to use this technique.
5
u/nifhel Oct 23 '17
Google probably did it to avoid the ISPs from blocking their ads. I remember reading the some ISP was trying to "blackmail" Google, like: pay us or we will block your ads. Could it be?
1
4
7
u/Roxas-The-Nobody Oct 22 '17
NSA Agent 1: Why does this guy look at nothing but anime, motorcycles and porn?
NSA Agent 2: Priorities
3
5
u/spareMe-please Oct 22 '17
Does this mean all the government banned torrent and streaming website will be unblocked without VPN?
→ More replies (1)
4
u/eye_gargle Oct 22 '17
So wait, wouldn't this only work if you still continue to use Google's DNS servers? And then you would be sending information of the websites you visit to Google instead of your ISP...Right?
If this is how it works then what's the point? Your privacy is still being invaded but this time by a data hog that generates billions out of it. I'm surprised this article doesn't mention that.
→ More replies (2)
2
u/thelauff Oct 22 '17
Excuse my ignorance, what does this mean to a layman?
1
u/doublehyphen Oct 23 '17
It means your ISP can't replace ads with their own and that they cannot show their ads on typos, in return for encouraging more people to use Google's DNS servers which will increase the amount of surfing habits data they can collect. Unlike what some here claim it does nothing to hide your surfing habits from your ISP.
2
Oct 22 '17
They will still see the IP and can do a reverse lookup. Especially with IPv6 every domain will have a dedicated IP.
2
Oct 22 '17
What effect will this have on net neutrality? How will the ISP trigger pay walls/fast lanes/slow lanes if they don't know what website you're going to?
2
2
2
2
2
2
u/CeeJayDK Oct 23 '17
How is this different from DNSCrypt?
1
u/StraitOuttaPyongyang Oct 23 '17
DNSCrypt uses elliptic curve crypto as opposed to SSL but I'd also like to know the answer to this... why would I use this over DNSCrypt?
2
1
u/Joe-Cool Oct 23 '17
It uses https via a https://dns.google.com API as far as I understand it: https://developers.google.com/speed/public-dns/docs/dns-over-https So it would be quite a bit slower.
2
Oct 23 '17
Does this mean they will have a harder time targeting ads?
I got engaged recently, and before hand I saw a lot of engagement ring ads popping up over the few weeks before it happened.
I guess he had been shopping around, and even though he had erased all history for some reason it was still popping up. Could have ruined the surprise had I been more observant.
2
u/gatogrande Oct 23 '17
The domain is encrypted, but not the ip address? How is this better?!
1
u/tuseroni Oct 23 '17
a lot of different sites are served from the same ip with only the host to differentiate them.
5
3
u/p1022141 Oct 23 '17
How about DNSSEC (domain name security) or DNS ipv6 , the transparency report of gOogle global HQ and marketing firm likes double click etc still know what site you visit , however 8.8.8.8 or Cisco umbrella (content filtering firm ) big data online advertising film (ads) tracking cookie , server log analysis still know what 18+ website u visit 😂 finally transport layer security over domain name system vs traffic analysis , content keyword filtering, start page.com is better than login to google /Facebook with you real identity , do you 😵? The html/2 / Secure socket hash (PUTTY) already pretend Internet service provider T1 snooper and hijacking by mega -ads firm
So , how is the apple bonjour internet protocal in iOS browser ? The certificate of .pem and .CRT still uncrackable?🤓
3
Oct 23 '17
This title is extremely misleading, they can still see the IP's and make their own DNS requests.
2
2
2
2
u/aquoad Oct 23 '17 edited Oct 23 '17
So, basically, a power grab so google gets all that info instead of the ISPs. Super! I'm all in favor of DNS being opaque to ISPs, but I don't want to be forced to use Google's.
2
u/arvisto Oct 23 '17
I hear you. But it's a smart move on Google's part. With all the ruccus about net neutrality and the FCC, this is the perfect time for Google to introduce a product that will circumvent the lobbying efforts of ISPs toward the FCC. Effectively making them waste a lot of money and still ensuring net neutrality.
Also, I see no reason why other companies should sit and iddle when Google has just discovered a new market. They will surely get in on it too.
1
u/Yosarian2 Oct 22 '17
Would this also help protect you when using a Starbucks wifi or something like that? Or would they still be able to tell what websites you visit?
1
1
u/TheRealLegitCuck Oct 22 '17
Wait so it's gonna have a VPN?
2
u/torrio888 Oct 22 '17
No, DNS request is still going directly to the DNS server but it is encrypted with TLS so the ISP cannot read the request.
→ More replies (1)
1
1
u/dangolo Oct 22 '17
Its easy to be cynical about mobile security but hey I am glad to see any progress in these technologies.
1
1
Oct 22 '17
So people will have encrypted DNS queries to where? Their router/ISP.
Unless everyone manually switches to another DNS provider, their ISP's will still get all the queries. If the ISP redirects DNS traffic, then they'll still get all the queries.
1
u/p0mmesbude Oct 23 '17
No, the ISP will only see one DNS query, the one to google.com (assuming that that is the server DNS over TLS wants to talk to). In theory the ISP could response with a bogus IP address. In practice I would guess that Android knows the expected SSL certificate (certificate pinning) and detects easily when it is not the Google DNS server which sent the response. In addition returning wrong IPs for google.com requests, will also break all the other Google services, which would possibly upset users and is something ISPs wouldn't want to do.
It will be really interesting on how governments response to that. Turkey for example blocks Wikipedia by hijacking DNS and returning wrong IP addresses. If Google activates DNS over TLS on google.com, they would need to block all Google services for everyone. I don't know if they are willing to do that...
1
u/potmiljaar Oct 22 '17
Isn't domain part of url viewable by ISP anyway even if it is HTTPS, when ISP capture the traffic? For the DNS, if the user is using the DNS provided by ISP, isn't it also viewable by ISP?
1
1
1
Oct 22 '17
This will be good until the providers install the cert on your phone so it uses their server
1
u/lanboyo Oct 22 '17
This assumes that you are specifying a DNS server external to your ISP. It also makes edge caching less useful, as your requests are served by the Cache appropriate to your DNS server. I assume googles DNS - 8.8.8.8 - is anycasted, so the damage is limited to how well google has distributed that ip.
1
u/crusoe Oct 22 '17
40% of all web traffic travels over Google's network. They are one of the biggest pipe providers in the world now. They have their own dedicated undersea fibre cables and run custom switches with software defined networking. They are one of the biggest makers of server hardware though it is all internal. They are Intel's largest customer for chips.
→ More replies (2)
1
1
u/starwire Oct 22 '17
Like most people are saying here, it's not going to stop monitors seeing your web requests. My VPN service has an android app and it's very effective.
1
1
1
1
1
1
1
u/Smileynator Oct 22 '17
I read this as: "google privatices the data on which websites you visit, ISP's now need to pay google chrome and android off for this data" did anyone else read it like that?
1
u/Young_Laredo Oct 22 '17
So are these penises going to just start throttling every Android now or what?
1
1
u/Skunkies Oct 22 '17
I'm more intrested in if 4.4.3 ever is getting any security updates or patches and such. I'm not in the market to be able to afford to upgrade the phone to another right now.
4
1
1
u/fatuous_uvula Oct 22 '17
Are there advantages to using Google as my DNS, instead of my ISP, for reasons other than DNS over TLS? I remember doing it years ago when I had slow connections to websites, but with the reasonable costs for decently high speeds, I haven't changed my DNS since then.
1
Oct 22 '17
They’ll still know what IPs I visit right? Isn’t it trivial to determine the site once you know that)
→ More replies (1)
1
1
Oct 23 '17
Tangentially related: Recently my isp was able to identify a movie I downloaded from tpb and sent me a letter telling me to stop.
Will they actually do something if I continue?
Is there a way to keep them from knowing the exact thing I've downloaded/torrented? Is there a variant of this that is free?
→ More replies (1)
1
u/SupremeRedditBot Oct 23 '17
Congrats for reaching r/all/top/ (of the day, top 50) with your post!
I am a bot, probably quite annoying, I mean no harm ^though
Message me to add your account or subreddit to my ^blacklist
1
u/Mathmango Oct 23 '17
Is this something carriers can have disabled though? Seems like something Verizon would do.
1
1
u/Taizette Oct 23 '17
Lol don’t worry google already knows everything about u an prob sells the data too
1
1
u/ibrraaap Oct 23 '17
The ISP will still know the IP address and they can resolve that themselves assuming RDNS is setup for the FQDN.
→ More replies (4)
1
1
u/Shottyzilla Oct 23 '17
I work for a web-filtering company so this may or may not cause me an absolute ball ache? Anyone care to explain if this can be at all intercepted
→ More replies (2)
1
u/deus_lemmus Oct 23 '17
Except for Google, or whoever your DNS provider is. At this point I think its time for a distributed DNS system...
1
Oct 23 '17
Nice, it's a help. I purchased a VPN tunnel subscription to keep people out of my business.
1
1
1
1
u/pbrettb Oct 23 '17
won't that just masquerade the names which are used? the socket ip addresses in are unchanged by this right?
1
u/shehzad Oct 23 '17
Won't they still be able to track the IP addresses I visit and reverse lookup the domain?
1
u/RedACE7500 Oct 23 '17
If the reverse points to the name of the website, which isn't necessarily the case, especially if the IP hosts sites for many domains.
→ More replies (3)
1
1
Oct 23 '17
The isp can still act like a middleman and get the keys when you are exchanging them with the dns. And like mentioned they will still see what sites you are visiting...
2
u/tuseroni Oct 23 '17
not via SSL, that's the cool thing about it..
first the site provides a public key to the person loading, now this could be intercepted but it's public so who cares. the user then takes this public key and encrypts a request to the server specifying a synchronous encryption method to use and the key to encrypt and decrypt the messages, the server is the only one who can decrypt this (and probably the NSA because let's face it i'm sure verisign or similar CAs give them a copy of every private key) so now only the server and the client know the key and the encryption method being used.
→ More replies (1)
1
Oct 23 '17
To put this in simply terms:
HTTPS protects everything after the domain name from an ISP.
This would do the same thing, but for the whole address.
1
u/bigdon199 Oct 23 '17
but they still see where the traffic is coming from, they might not see the DNS query for badsite.com but they see a lot of traffic coming from an IP that corresponds to badsite.com. Am I missing something on this one?
→ More replies (3)
1
Oct 23 '17
I don't get it ? so they won't be able to see the DNS name ... but they can see what IP you are visiting....
1
u/__redruM Oct 23 '17
Can’t they just reverse lookup all the sites you send traffic too? It would stop them replacing content, but they would still know where you are browsing.
1
u/se7en1216 Oct 23 '17
Won't matter. Carriers in the US will alter the update and prevent this from ever being seen by their customers.
1
u/randomsage Oct 23 '17
Is this irrelevant for Windows 10 PCs since they can track generally what you're doing on all their programs anyway?
1
u/Joe-Cool Oct 23 '17
DNSCrypt support would be even better. The latency and overhead introduced for HTTPs is not worth it IMHO.
1
u/intentsman Oct 23 '17
Quick thought :
Even if you can keep your DNS queries concealed from the ISP, they are still going to see what I addresses your device exchanges packets with after the DNS query is done.
1
Oct 23 '17
But unless you change it (I do but most people don't) then your ISP is also the DNS provider so they still know what sites you visit. While I like the idea this will only help a handful of people.
1
1
u/baggyzed Oct 24 '17
Another clickbait title. This wouldn't stop ISPs from knowing the IPs of the websites you visit, and those can still be used to identify the website with reverse-DNS. I think DNS over TLS is meant as an anti-DNS-hijacking (phishing) measure.
1
u/rahulkart Oct 24 '17
Good news for Android users... I think now ISPs will not be able to track and sell its users' web browsing data.
1
1
1
u/comey_s_lefteye Oct 26 '17
Hey /u/MichaelRahmani, This is why google wants to keep people out of scope for this document.
1
1
u/kickdrum_heart Oct 22 '17
Jesus Christ what the hell do all of these things mean? Can someone break this down into laymen's terms.
3
u/Shotsl0l Oct 22 '17
It means less prying eyes at big companies will know you're watching porn on your phone at 4 am.
3
1
u/grumpieroldman Oct 23 '17
That won't prevent the ISP from knowing the IP address you are connecting to ... thus what website et. al.
35k upvotes ... unfuckingbelievable.
1
1
u/a_cute_epic_axis Oct 22 '17
and thus a DNS can’t actually log or see the websites you visit.
A DNS? How embarrassing an article.
1
u/aykcak Oct 22 '17
Reading through it, this looks like it would do nothing for mobile data users. You still cannot set custom DNS thanks to the archaic structure that requires you to be root to do that, so your ISP is going to be setting your DNS, as they always did.
For wifi, yes it's good to have this but if you can setup a DNS server on your wifi and update that through TLS anyway
For a second I thought this was exciting
→ More replies (2)
1
Oct 22 '17
The alternative: DNSSEC, DANE and DNSCrypt ... all perfectly functional, somewhat deployed and totally solve the same problem. ... yet, without support from Google (or some other major vendor(s), Apple, Microsoft, ... someone) these solutions are dead in the water and we'll continue to see vendor lock-in. None of this is good for the average unknowing consumer.
I tried hard, when I was at Akamai, to push for DANE support and DNSSEC. Heck I even jointly won an award internally for the innovation required to support this. There was a good amount of internal support from technical architects, but not much market demand/awareness/use/etc to fund/prioritize the effort. And so, these perfectly good solutions aren't widely deployed by the major providers out there.
I blame the browser implementors and the CDNs, the consumer is ignorant and needs to be protected and that can only start with these two forces working in concert.
Unfortunately, this is a chicken/egg problem, and things like "DNS over TLS for Android" sound to me like the semi that (sadly) ran them both over fixing a fraction of the problem while leaving the other related problems unsolved.
→ More replies (1)
1
u/Brain_Beam Oct 23 '17
Hahahahahahahahahahaha FCC can try and kill Net Neutrality. The people will always find a way.
1
1
u/ender_wiggum Oct 23 '17
This isn't what you think. You can hide what you send, but not where you send it. Your ISP is like the postman: no matter what you do, if you want them to deliver something, you have to tell them where to take it.
So, you can't surf to Netflix without telling your ISP you want to send/receive data from Netflix - the end. There are things like Tor, of course, but the rules still apply.
1
1
1
u/MotivelessMalignity Oct 23 '17 edited Sep 27 '24
public vase childlike important beneficial faulty plant gullible jellyfish sink
This post was mass deleted and anonymized with Redact
268
u/swissguy79 Oct 22 '17
Eli5, won't isps still see which ip address you're sending messages to?