2

I read a whitepaper from Iovation in which they discussed unmasking the IP behind a proxy.

"The method wherein the connecting host is an anonymizing proxy or intermediate device, measuring inconsistencies in Geolocation of the connecting host IP Address and the IP Address of the DNS name server accessed by the client.The connecting host is caused to request a resource on a unique domain name meaning the domain name is different for each visit which will force the client's DNS server to connect to the domain owner's DNS server which the fingerprinting device has access to".

Another method I read on Stack Exchange is

"If you control the DNS server for your domain then you can see all requests coming in. By creating a unique subdomain address for each visitor and embedding it somewhere in the HTML, you can check the client's real IP on the DNS server."

What are the countermeasures for the methods discussed above?

Improve this question
2
  • please cite your sources
    – schroeder ♦
    Commented Oct 3, 2017 at 8:48
  • the countermeasure: make sure all DNS requests also go through the proxy
    – schroeder ♦
    Commented Oct 3, 2017 at 8:51

2 Answers 2

Reset to default
1

Make sure you use the proxy provider DNS or just set your system DNS to Open DNS or Google DNS.

Open DNS: 208.67.222.222 and 208.67.220.220

Google DNS: 8.8.8.8 and 8.8.4.4

Improve this answer
0

One countermeasure would be to ensure all your DNS traffic also went through your proxy provider, by for example using a VPN or a correctly configured SOCKS proxy.

If you just configure a proxy within you browser there is a high probability that this will not affect the DNS resolution.

One way of doing this well is to use a Docker container which has no access to the raw network and can only access the network through a SOCKS Proxy then do all your browsing from within that container.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .