https://dnscrypt.info/faq/ states for both DNS over HTTPS and DNS over TLS that it

Provides more information than regular DNS to resolver operators in order to fingerprint clients

How so?


TLS Resumption

TLS Resumption is a mechanism which allows the client to resume a recent TLS session so they can use the previously established session keys to continue encrypted communication and skip the key exchange step in the TLS handshake. However, it also allows sessions to be linked together by the server, so it can be used to track the client over longer periods of time.

HTTP Headers

Another way to fingerprint clients would be through User-Agent, Accept-Language and Cache HTTP headers to infer information about the client such as the client version, locale and possibly some information about a subset of the clients history, as mentioned in RFC 8484.

| improve this answer | |
  • Thank you! Does TLS Resumption offer anything more in terms of fingerprinting compared to if the resolver was just looking at the source IP address? – lucidbrot Jul 30 at 9:18
  • 1
    @lucidbrot Yes it does. IP addresses can change over time and several clients can be using one IP because of NATs. TLS resumption can link sessions from a specific client even across IP changes. – nobody Jul 30 at 9:29
  • Even without TLS Resumption, there are so many variables in a TLS handshake, and specifically what is in the ClientHello packet, that the content can enable to pinpoint a specific client out of a crowd. – Patrick Mevzek Aug 3 at 5:11
  • @PatrickMevzek Which variables do you specifically have in mind? – nobody Aug 3 at 7:49
  • All the content of ClientHello, like list of ciphers and their orders for one. – Patrick Mevzek Aug 3 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.