0

I've been using VPN lately which I configured on Ubuntu machine in Germany, and I do not feel comfortable using it because of high latency. So I found DNScrypt. Since I only want to keep my browsing activity mine.

If I am visiting only SSL protected websites (these days sites that have SSL are rapidly increasing) and using DNScrypt (which protects my DNS lookups from being spoofed), is there any way my ISP can determine web addresses I am visiting?

Improve this question
2

1 Answer 1

Reset to default
4

DNSCrypt only protects the DNS lookup. The HTTPS connection is still made to the original target which thus reveals the target IP address to the ISP. And, if deep packet inspection is done the target hostname can also be extracted from the TLS handshake (SNI extension in ClientHello). This means the ISP can see which sites you visit but not the exact URL on this site. Although in case of well known public resources on the site traffic pattern might reveal too which of these resources you have accessed.

Improve this answer
6
  • I'd like to add that if you want to hide the domain you are visiting from your ISP, you should use a VPN or a proxy.
    – Ninja_Coder
    Aug 7, 2017 at 6:39
  • 1
    @Ninja_Coder: a proxy does not necessarily hide the domain, it depends on the specific application and usage. Especially just using an external HTTP or Socks proxy will not hide the domain because these proxy protocols add no encryption by themselves. And, as can be seen from the question, the OP is well aware of VPN but does not like the overhead.
    – Steffen Ullrich
    Aug 7, 2017 at 6:46
  • You're right! I should have read better. Also didn't realize SOCKS did no encryption.
    – Ninja_Coder
    Aug 7, 2017 at 6:54
  • @Ninja_Coder: Is SOCKS secure?, SOCKS proxy security concerns ...
    – Steffen Ullrich
    Aug 7, 2017 at 8:12
  • 1
    @Luka: SNI contains the FQDN (fully qualified domain name). Thus the ISP can see the site visited (www.example.com) but not the exact URL (page) with full path (http://www.example.com/secret/) at this site.
    – Steffen Ullrich
    Aug 7, 2017 at 11:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .