4

DNS over TLS is now supported in Android Pie, which allows a user to define a private DNS server, and by DNS providers such as CloudFlare's 1.1.1.1. This opens up the world of DNS security to more people than ever before, so it seems like we ought to have a question regarding what security, exactly, the protocol provides.


Assume a user visits a website secured using HTTPS; their DNS query is sent to the DNS provider using the DNS-over-TLS protocol.

What information about the user's browsing is in principle available to each of the following, if they cared to access it?

  • The website
  • The DNS provider
  • The user's ISP
  • An eavesdropper

Which of these parties, if any, could obtain sufficient information to relate the user's browsing to a real-world identity or location?

How does this differ from accessing the same (HTTPS) website over standard (not-over-TLS) DNS?

5

What information about the user's browsing is in principle available to each of the following, if they cared to access it?

Since your question is asking about DNS over TLS, I'm not going to get into HTTP over SSL.

DNS typically goes over the wire in the clear and the information that can be seen is:

  • Source IP (user)
  • Destination IP (DNS server)
  • Query (e.g. www.example.com)
  • Response (e.g. 93.184.216.34)

By using DNS over TLS, only the following information would be visible to outsiders:

  • Source IP (user)
  • Destination IP (DNS server)

This definitely helps with privacy. Also, keep in mind that this helps with MITM attacks, since in order to establish a TLS session, you need to exchange certificates, thus allowing the ability to verify the server's identity.

The website

They will always have access to all of your information for each and every time you visit their site. Your history will be in their web server logs and will show your IP address (unless you use a VPN).

The DNS provider

They will see everything that you query and have a record of it if they keep logs, again, ties to your IP (unless you run a VPN).

The user's ISP

They won't be able to see the queries you are performing, but they can see the sites you are going to, but not what you are doing on them due to HTTPS. They may be able to tell the site by the destination IP address of your traffic and/or by the server name in the TLS client handshake. Again, if you use VPN, no one of it is visible to them.

An eavesdropper

Same as the user's ISP.

Which of these parties, if any, could obtain sufficient information to relate the user's browsing to a real-world identity or location?

No single party would be able to make that determination. It would be more likely to be someone obtaining logs from multiple sources in order to figure that out.

How does this differ from accessing the same (HTTPS) website over standard (not-over-TLS) DNS?

Honestly, I don't feel that there would be much of a difference, since in HTTPS, sniffers can see your destination IP and also most of the time the server name is specified in the TLS handshake.

Hope that answers your questions!

  • Work is ongoing to encrypt also the server name in the TLS handshake. – Patrick Mevzek Aug 10 '18 at 6:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.