7

For example, I'm using DNS over TLS in Android Pie. This happens:

  1. I visit a website (google.com).

  2. I send a DNS query to the DNS server, and the response is the IP address of google.com. The ISP knows I contacted the DNS server, but doesn't know the query or the response.

  3. Next, I connect to the IP of google.com. The ISP knows I contacted google.com's IP now.

And yet, news articles (and some questions in this site) says that the ISP won't see the websites you visit if you use DNS over TLS. Am I missing something here?

Improve this question
8
  • 1
    Some IP addresses are used for many websites. Cloudflare is a great example.
    – AndrolGenhald
    Dec 21 '18 at 18:01
  • @AndrolGenhald Oh I get it now, the IP changes. But the ISP still sees the IP address of the website I'm trying to visit, right?
    – Avery Alejandro
    Dec 21 '18 at 18:04
  • 3
    @AndrolGenhald With shared hosting, wouldn't the ISP still see either the HTTP host header or the SNI field in the TLS client hello?
    – ztk
    Dec 21 '18 at 18:07
  • @ztk Very good point. TLS 1.3 should change that but it'll be a while before it's widely used.
    – AndrolGenhald
    Dec 21 '18 at 18:09
  • 2
    @AndrolGenhald No TLS 1.3 does not change any of that, the SNI is still in the clear. However separate works are right now being done to be able to have an "encrypted SNI". See for example blog.cloudflare.com/encrypted-sni
    – Patrick Mevzek
    Dec 21 '18 at 18:23
8

It doesn't. DNS over TLS is not designed to keep your privacy from ISP. Like HTTP, DNS is vulnerable to MITM. DNS over TLS provides the same level of security as HTTPS.

As DNS over TLS is encrypted, your ISP can't see the domains you query for but they don't have to. TLS uses Server Name Indication, a TLS extension which appears on the outside of HTTP host header. SNI field contains the domain name of the server you want to talk to. Once you visit that site, your ISP can see that unless you use a VPN.

Cloudfare has recently released support support for encrypted SNI(ESNI) for the websites that are hosted by Cloudfare. This actually prevents your ISP from seeing the site you visit provided you are also using DNS over TLS. But for ESNI to work browsers have to natively support it. Mozilla landed support for ESNI in Firefox Nightly, so you can now browse Cloudflare websites without leaking the plaintext SNI TLS extension to on-path observers ISPs, coffee-shop owners, firewalls.

Improve this answer
6
  • But can they still see the IP of the website I'm trying to visit?
    – Avery Alejandro
    Dec 22 '18 at 14:57
  • @Avery Alejandro Of course they can but single IP Address is shared by many hosts in CDN. So it is useless because there can be many sites running on that IP. With the help of SNI, ISP can see which one you are visiting.
    – defalt
    Dec 22 '18 at 16:30
  • And all websites in Cloudflare already support it? Like, all of them? Is ESNI forced on Cloudflare websites?
    – Avery Alejandro
    Dec 22 '18 at 16:57
  • ESNI only works for domains which are hosted by Cloudfare. ESNI is supported by the CDN and not the websites. You also need a supported browser like firefox.
    – defalt
    Dec 22 '18 at 17:33
  • I use Firefox Nightly. My question is, does all the websites that are using CDN have ESNI already? Like, a website owner made a website, used CDN, and doesn't know about the new ESNI feature. Does Cloudflare force him to use ESNI, or is it something that website owners have to choose from their dashboards?
    – Avery Alejandro
    Dec 22 '18 at 17:49
2

Using DNS over TLS will prevent the ISP from reading/altering your DNS traffic.

With unencrypted DNS, an ISP can monitor your DNS traffic or redirect the traffic to their own DNS server. (I'm not sure if this is ever done in practice)

To hide the websites you are visiting, you will need to use a VPN, which will prevent the ISP from seeing the true destination of your traffic.

Improve this answer
5
  • So this is false? - xda-developers.com/android-dns-over-tls-website-privacy
    – Avery Alejandro
    Dec 21 '18 at 18:29
  • The bold claim in the second paragraph is false, however, a caveat is added in the second paragraph of the addendum saying you need a VPN
    – ztk
    Dec 21 '18 at 18:32
  • 1
    ...and the VPN will hide your traffic from your local ISP, but the VPN server will see what IPs you are talking to...
    – yourcomputergenius
    Dec 21 '18 at 19:48
  • ...essentially, it’s kinda not possible to use a connected infrastructure without someone somewhere seeing who you’re connecting to
    – securityOrange
    Dec 21 '18 at 22:51
  • 1
    @securityOrange No, it is possible. That is what Tor does. It ensures that no two servers simultaneously know both who you are and where you are connecting.
    – forest
    Dec 23 '18 at 3:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.