0

I've been using VPN lately which I configured on Ubuntu machine in Germany, and I do not feel comfortable using it because of high latency. So I found DNScrypt. Since I only want to keep my browsing activity mine.

If I am visiting only SSL protected websites (these days sites that have SSL are rapidly increasing) and using DNScrypt (which protects my DNS lookups from being spoofed), is there any way my ISP can determine web addresses I am visiting?

4

DNSCrypt only protects the DNS lookup. The HTTPS connection is still made to the original target which thus reveals the target IP address to the ISP. And, if deep packet inspection is done the target hostname can also be extracted from the TLS handshake (SNI extension in ClientHello). This means the ISP can see which sites you visit but not the exact URL on this site. Although in case of well known public resources on the site traffic pattern might reveal too which of these resources you have accessed.

  • I'd like to add that if you want to hide the domain you are visiting from your ISP, you should use a VPN or a proxy. – Ninja_Coder Aug 7 '17 at 6:39
  • 1
    @Ninja_Coder: a proxy does not necessarily hide the domain, it depends on the specific application and usage. Especially just using an external HTTP or Socks proxy will not hide the domain because these proxy protocols add no encryption by themselves. And, as can be seen from the question, the OP is well aware of VPN but does not like the overhead. – Steffen Ullrich Aug 7 '17 at 6:46
  • You're right! I should have read better. Also didn't realize SOCKS did no encryption. – Ninja_Coder Aug 7 '17 at 6:54
  • @Ninja_Coder: Is SOCKS secure?, SOCKS proxy security concerns ... – Steffen Ullrich Aug 7 '17 at 8:12
  • 1
    @Luka: SNI contains the FQDN (fully qualified domain name). Thus the ISP can see the site visited (www.example.com) but not the exact URL (page) with full path (http://www.example.com/secret/) at this site. – Steffen Ullrich Aug 7 '17 at 11:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.