0

I read that when using a web proxy - your ISP can still see the DNS queries so it knows which site you're visiting, just not which pages and the pages' content assuming you're using HTTPS.

But what about using a proxy through a browser? Is that any different? (e.g. Firefox -> Options -> General -> network proxy -> settings.) Does the browser send the DNS queries through the proxy as well?

  • I think you are mixing up concepts. A web proxy by itself does not provide any privacy at all, i.e. is not the same as a VPN. And what is a proxy "through system" vs. "through browser". If you refer to the global proxy settings - these essentially just configure the proxy inside the browser if the browser is to be configured to use the system settings. And, if the DNS request is done through the proxy depends on the proxy type: true for HTTP proxy, false for SOCKS4, maybe for SOCKS5 (might depend on additional configuration). – Steffen Ullrich Dec 11 '17 at 20:57
  • @SteffenUllrich Thanks, I corrected the "VPN" to "proxy" in the last line of my question now. As for the answer itself - A web proxy by itself does not provide any privacy at all - I thought the difference between a VPN and a proxy is just whether it's for all connections from the computer or for the browser (in this case) only. But for the browser - why doesn't it provide privacy, if I'm using an HTTP proxy and the connection to the proxy is through HTTPS - doesn't that mean the the ISP can't (according to your comment) see anything, including which sites I visit? Doesn't it mean that (1/2) – ispiro Dec 11 '17 at 21:06
  • @SteffenUllrich (2/2) ... the only thing the ISP sees is the proxy's IP (plus the encrypted messages which, at least in theory, are secure)? – ispiro Dec 11 '17 at 21:07
3

If the DNS lookups are done by the proxy or by the client itself depend on the kind of proxy configured and less if the proxy is configured in the browser or global to the system. When using a HTTP proxy (which works for HTTPS requests too) the DNS lookup is done by the proxy. If this is a SOCKS4 proxy it needs to be done by the client. With SOCKS4a and SOCKS5 it depends on the actual client and maybe additional configuration.

Anyway, even if the DNS lookup is done by the proxy the ISP can still see which domain name gets accessed, no matter if you access HTTPS sites or not. In none of the proxy protocols the traffic between client and proxy gets encrypted by default. This means the target domain can be extracted from the SNI extension of the TLS handshake. Note that some proxies might be able to use a HTTP proxy over HTTPS. But this is not the case for most browsers and needs special add-ons or advanced configuration access for other browsers (like in Firefox).

Thus, to hide which domain you access you should use a VPN and not a proxy or make sure that you access the proxy itself by HTTPS and not only the site you visit.

  • Just to wrap up - when using a secure (https) connection between the browser and the proxy - the domain itself that I'm visiting will be hidden from my ISP if I'm using an HTTP proxy. Correct? – ispiro Dec 11 '17 at 21:16
  • @ispiro: in the connection to the HTTP proxy is encrypted itself the domain will be hidden. But note that most browsers don't support this or support this only using some advanced config or special extensions. – Steffen Ullrich Dec 11 '17 at 21:18
  • I'll just note that upon further reflection, I realized that an http proxy has an additional benefit even when not connecting to it over https, and even when browsing non https sites. That is that it seems like ISPs now have the right to sell our browsing history. As long as they just record one's browsing history, and not make an effort to find out what he's browsing through proxies, using a proxy we can acquire some privacy. – ispiro Dec 13 '17 at 13:53
2

If you use Firefox with a socks proxy there is an hidden config option you need to activate. Put about:config in the URL and then search for key network.proxy.socks_remote_dns. Enable it if you want your DNS queries to also use the socks proxy you may have defined. Otherwise the DNS queries would still be made locally.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.