0

Seems like a modern ISP would already be equipped with some basic level of packet inspection to identify outgoing TCP connections even if just for doing traffic shaping or carrier-grade NAT, and maintaining a reverse lookup does not sound prohibitively expensive.

  • TLS encrypts all traffic so no packet inspection is possible without clearly missing with server certificates. Using DNS over HTTPS or TLS means that your question is encrypted (no one on the network can see the name you ask for) and that the response is encrypted (not always useful since the DNS is public anyway) and protected against tampering, so an on-path attacker can not inject or change DNS records. – Patrick Mevzek Oct 1 at 4:32
  • 1
    That is not true because under regular SNI the host name is sent in plain text during the initial TLS handshake before key negotiation even takes place – user4234092342 Oct 1 at 9:39
  • A minor unrelated point, since "encrypted SNI" is soon to be a standard, and TLS 1.3 encrypts also far more of the handshake. You could then as well said that the ISP sees the IP and can deduct some (but not all) things from that too. – Patrick Mevzek Oct 1 at 14:29
  • Which is in fact what I'm saying. – user4234092342 Oct 1 at 14:30
2

Normally DNS traffic is in clear and can easily be sniffed by the ISP (just sniff port 53), making it possible to create user profiles. And not only could the traffic be sniffed but it could also be redirect to the ISP's DNS server in order to give a different answer. This is a typical way to block domains at the ISP level.

DoH uses HTTPS for transport and this way gets the protection of HTTPS against sniffing and traffic modification. Sure the DoH server itself now has all the information and can also provide a different answer, i.e. the ability for profiling and domain blocking did not vanish but it moved to another party. Ideally this party would be more trusted than the ISP though.

... maintaining a reverse lookup does not sound prohibitively expensive.

A reverse lookup is of not much use today since often many domains are hosted by the same server (and thus IP) or since they are served by a CDN where even more domains have the same IP address. So there is often only a weak association between the IP address and the domain. A deeper traffic analysis might reveal the hostname from the Host header in case of plain HTTP and from the TLS handshake (server_name extension of ClientHello) in case of HTTPS. But plain HTTP gets less and less used and for HTTPS they are working on hiding the name in the TLS handshake too with Encrypted SNI.

In summary DoH does not solve all privacy problems caused by the ISP. But it is another step to make it harder and more expensive to create user profiles in the hope that the value of the remaining profiling for the ISP is less than the investments needed for the profiling.

  • I think it's reasonable to assume that DPI for hostname and non-encrypted SNI server_name is used by an ISP that derives a commercial benefit from profiling his customers (not to mention state actors), so basically it only provides privacy for sites behind collateralizing edge nodes with ESNI enabled on both the CDN and the client. Is there any data on the scope of ESNI deployment beyond the cloudflare-chrome-firefox use case ? – user4234092342 Oct 1 at 11:51
  • @user4234092342: DPI to get SNI is more expensive then just redirecting DNS so that it gets handled by the ISP's server. Also, as I said DoH also prevents DNS based blocking. – Steffen Ullrich Oct 1 at 13:16
  • This is only true if the ISP does not already employ DPI for other purposes, if it does then outsourcing DNS actually saves ISP the cost of maintaining a highly available high-load service. Re. blocking - if it is mandated either by law or by customer demand it would just be reimplemented as IP blocking based on reverse lookup and blacklists or if cheaper - signing an agreement with the DoH provider. – user4234092342 Oct 1 at 13:51
  • @user4234092342: blocking by IP will not work for the reasons I've already said: the common use of multiple domains on the same IP address. And DPI is not DPI: there is DPI for traffic optimization and there is DPI for deeper protocol analysis. DPI used for traffic optimization will not necessarily be able to be used for tracking. – Steffen Ullrich Oct 1 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.