News for hackers. Stuff that matters.

A comment on Comcast, AT&T and Verizon pose a greater surveillance risk than Facebook. Parent comment

Re:Comcast, AT&T and Verizon pose a greater surveillance ris... by peterwwillis on Saturday April 07, 2018 @03:47AM (#16779838)
Sure. Chrome and Firefox both implement (or are implementing) DNS over HTTPS, which hides what domains you're visiting by passing the request encrypted through a provider such as Google. Chrome also has a "data saver" on mobile that passes your traffic through Google's servers. Opera has had similar functionality for some time. Safari and IE will implement DNS over HTTPS once it's a standard, which should be soon. Don't know if they have plans to support tunneling too.
[ Parent | on HN ]
Re:Comcast, AT&T and Verizon pose a greater surveillance ris... by gsnedders on Saturday April 07, 2018 @06:19AM (#16780161)
> Chrome and Firefox both implement (or are implementing) DNS over HTTPS, which hides what domains you're visiting by passing the request encrypted through a provider such as Google.

DNS over HTTPS doesn't actually hide the domains you're visiting, because TLS SNI means the server hostname is sent in plaintext as part of the TLS handshake.

And for major sites, they probably aren't sharing their public IPs with other sites, hence the ISP can know what site you're connecting to via knowing what IP you're sending datagrams to.

[ Parent | on HN ]
Re:Comcast, AT&T and Verizon pose a greater surveillance ris... by GordonS on Monday April 09, 2018 @06:40AM (#16791841)
Ah, I had no idea it was already implemented in those browsers!

It appeared to be disabled by default in my Firefox install - for anyone else, I followed these instructions to enable it:

https://www.ghacks.net/2018/04/02/configure-dns-over-https-i...

[ Parent | on HN ]
Re:Comcast, AT&T and Verizon pose a greater surveillance ris... by iggg on Saturday April 07, 2018 @05:10AM (#16780000)
What is stopping yourisp from doing reverse dns and looking up what domain is pointing to the IP you are connecting to?
[ Parent | on HN ]
Re:Comcast, AT&T and Verizon pose a greater surveillance ris... by peterwwillis on Saturday April 07, 2018 @11:27AM (#16781143)
You can't do reverse DNS for sites using SNI. Multiple hosts use the same IP.
[ Parent | on HN ]