6

DNS over TLS is now supported in Android Pie, which allows a user to define a private DNS server, and by DNS providers such as CloudFlare's 1.1.1.1. This opens up the world of DNS security to more people than ever before, so it seems like we ought to have a question regarding what security, exactly, the protocol provides.


Assume a user visits a website secured using HTTPS; their DNS query is sent to the DNS provider using the DNS-over-TLS protocol.

What information about the user's browsing is in principle available to each of the following, if they cared to access it?

  • The website
  • The DNS provider
  • The user's ISP
  • An eavesdropper

Which of these parties, if any, could obtain sufficient information to relate the user's browsing to a real-world identity or location?

How does this differ from accessing the same (HTTPS) website over standard (not-over-TLS) DNS?

1 Answer 1

8

What information about the user's browsing is in principle available to each of the following, if they cared to access it?

Since your question is asking about DNS over TLS, I'm not going to get into HTTP over SSL.

DNS typically goes over the wire in the clear and the information that can be seen is:

  • Source IP (user)
  • Destination IP (DNS server)
  • Query (e.g. www.example.com)
  • Response (e.g. 93.184.216.34)

By using DNS over TLS, only the following information would be visible to outsiders:

  • Source IP (user)
  • Destination IP (DNS server)

This definitely helps with privacy. Also, keep in mind that this helps with MITM attacks, since in order to establish a TLS session, you need to exchange certificates, thus allowing the ability to verify the server's identity.

The website

They will always have access to all of your information for each and every time you visit their site. Your history will be in their web server logs and will show your IP address (unless you use a VPN).

The DNS provider

They will see everything that you query and have a record of it if they keep logs, again, ties to your IP (unless you run a VPN).

The user's ISP

They won't be able to see the queries you are performing, but they can see the sites you are going to, but not what you are doing on them due to HTTPS. They may be able to tell the site by the destination IP address of your traffic and/or by the server name in the TLS client handshake. Again, if you use VPN, no one of it is visible to them.

An eavesdropper

Same as the user's ISP.

Which of these parties, if any, could obtain sufficient information to relate the user's browsing to a real-world identity or location?

No single party would be able to make that determination. It would be more likely to be someone obtaining logs from multiple sources in order to figure that out.

How does this differ from accessing the same (HTTPS) website over standard (not-over-TLS) DNS?

Honestly, I don't feel that there would be much of a difference, since in HTTPS, sniffers can see your destination IP and also most of the time the server name is specified in the TLS handshake.

Hope that answers your questions!

7
  • Work is ongoing to encrypt also the server name in the TLS handshake. Aug 10, 2018 at 6:18
  • wouldn't man-in-the-middle at the ISP level be able to use a fake certificate and unencrypt?
    – pcalkins
    Feb 12, 2020 at 23:12
  • @pcalkins A lot more software lately have been enforcing certificate verification when performing TLS handshakes. As long as the product you are using enforces certificate verification and aborts if it is invalid, then the ISP wouldn't be able to MITM using a fake certificate.
    – Damian T.
    Feb 14, 2020 at 0:07
  • There's no way to know it was fake... they could also pass along the real certificate.
    – pcalkins
    Feb 14, 2020 at 18:44
  • 1
    @pcalkins I would recommend looking into Public Key Infrastructure. en.wikipedia.org/wiki/Public_key_infrastructure
    – Damian T.
    Feb 14, 2020 at 19:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .