4

I am using google image a lot. I discovered through Wireshark, any images under preview mode of google images search result actually expose the dns where that image was hosted from.

For example, my url bar shows that image was https://image.google.com/xxxxcxc

But the leak dns revealed that image was directly from www.example.com

So it gives my ISP an impression I was visiting example.com instead of google.com

What should I do to avoid these dns exposures from happening?

I am using iOS by the way.

Improve this question
1
  • 1
    Since it queried dns for that website, of course ISP can see that unless you use VPN.
    – Tryna Learn Somethin
    Commented Jan 4, 2018 at 23:38

2 Answers 2

Reset to default
1

Regular DNS traffic over port 53 is plaintext so any requests made will be visible to your ISP (For more background on DNS, check out the RFCs, start with 883 and then go to 7626 "DNS Privacy Considerations")

Therefore, in order to prevent eavesdropping between your client and the DNS service you would need to either use a secure-DNS extension or tunnel your regular DNS traffic through a VPN or proxy. However, if you are using your ISPs DNS servers than this is a moot point.

Depending on your circumstance you may want to use a VPN for all traffic or you may want to consider using something like Tor or a simple web based HTTP privacy proxy like AnonyMouse. However, if you are worried about DNS requests you might not want your ISP seeing you use privacy services.

Some options include:

Note: DNSSEC does not provide confidentiality:

DNSSEC does not provide confidentiality of data; in particular, all DNSSEC responses are authenticated but not encrypted.

Also consider, that if you have prefetch (see also) (predictive loading) enabled your browser will load the page and do more than the DNS lookups. You may want to disable this and due some research on the best secure browser configuration and addons to meet your needs.

If you are worried about inappropriate content you are not expecting, try enabling Safe Search.

More reading:

Improve this answer
4
  • Thank you. You raised really good point. Do you believe the following combination would achieve the maximum result of DNS protection: Double VPN + FireFox Focus Browser + Google Public DNS ? Besides, I do hear about DNS-OVER-HTTPS by google; And I also hear about DNSCrypt; Unfortunately, I am an ios user......It's difficult for me implement those two over my phone browsing experiences...Any tips?
    – Karl Bean
    Commented Jan 5, 2018 at 8:51
  • An increase in layers can help security, but complexity introduces more opportunities for errors. I personally do not have any experience with Double VPN or FFF so I cannot recommend for or against those options. Google is a major provider who turn over logs, you may want to look for a public DNS from a university, etc. You should update your original question to include OS and browser you were using originally.
    – Eric G
    Commented Jan 5, 2018 at 15:38
  • @KarlBean if your have a home router with alternate firmware installed, you could configure it to provide DNScrypt to your entire network.
    – multithr3at3d
    Commented Jan 5, 2018 at 15:51
  • Thanks! I fully understand google could hand over their logs....regarding DNS. But if my main concern was on google image search dns leaks, then that should be google bear the responsibility, right?at the end of day, I am just a passive user of their service, not an abuser of their service
    – Karl Bean
    Commented Jan 5, 2018 at 17:11
0

You have several options to protect your DNS traffic:

  1. Use a VPN service to protect all your traffic. (Then your VPN provider will see this traffic.)
  2. Use Tor (including DNS tunneling, so setting only your browser to use Tor may or may not be sufficient)
  3. Use DNSCrypt to just encrypt DNS traffic. Note that this won't help with other possible information leaks, such as CRL lookups, HTTP traffic, etc.
Improve this answer
2
  • Double VPN + FireFox Focus Browser + Google Public DNS ; Do you believe the above combo work the best to secure my dns privacy? I can't use DNS Crypt coz I am an ios user.
    – Karl Bean
    Commented Jan 5, 2018 at 8:53
  • Tor Browser does DNS automatically through the Tor network. If you configure a different browser to use Tor, you will be reducing your anonymity set and making yourself easy to fingerprint, so don't do that.
    – forest
    Commented May 27, 2019 at 0:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .