Third party DNS is at best a very minor hiccup in the ease of an ISP monitoring where you're going, though in combination with things like HTTPS Everywhere it's a start - mostly if you're going to good-sized sites where most of your traffic actually goes to CDN providers.

Hm, thinking about it as I write, I could see how encrypted DNS plus everything being encrypted and served via CDN could actually cut down a lot on what carriers can see. Still far from perfect, but not quite as bad as I was originally thinking.

Edit: I wasn't familiar with Server Name Indication (destination hostname is unencrypted even though the rest of the URL and session are encrypted).

Without encryption, they can see who you talk to, what you are saying, the rate, the frequency, from where and when.

With encryption (https), they can see who you talk to, the rate, the frequency, from where and when. They can't see the actual URL (just the hostname) or data (encrypted).

With VPN, they see you are talking to a VPN, the rate, the frequency, from where and when. VPNs cut down on knowing who you are talking to (assuming they aren't logging or being monitored which they could easily do).

Other services could be added to obfuscate rate, frequency and when I would assume, but even then those services would only be additive obfuscation (unless you cache packets for a short term... just thinking as I type).

Someone check me if i'm off on this these points...

You're close. There's actually well understood technology for obfuscating the rate and frequency - the field for manipulating these variables is called "traffic analysis".

One simple technique is to always transmit X packets/sec where Y packets/sec are real and the other packets are dummy packets (Y < X). If the channel is encrypted, it's impossible to distinguish the dummy traffic from the real traffic, and if you're over a VPN, it's difficult to identify the destination.

A slightly more sophisticated approach is to vary X over time, to make it shaped like streaming video, for example, to obfuscate the fact that you're using traffic analysis countermeasures.

If you are repeatedly going to sites A,B,C, then over time even if you are sending bogus packets, the sites you do go to will rise to the top.

It’s similar to differential privacy where even with a bunch of bogus data patterns in aggregate can be determined.

It's not one of encryption or tunneling or packet shaping that does the work, but rather all of these techniques together work to reduce an adversary's traffic analysis capability.

I'm not familiar with how to set this up. Do you have a link to a guide to use such a service for me and others?