News for hackers. Stuff that matters.

A comment on Big ISPs aren’t happy about Google’s plans for encrypted DNS. Parent comment

Re:Big ISPs aren’t happy about Google’s plans for encrypted DNS by necovek on Wednesday October 02, 2019 @03:59AM (#21134236)
While I definitely agree with the sentiment, I would much rather browsers used my own caching DNS server that I can configure to talk to root nameservers: this would be the best of both worlds (ISPs can't track me, and I wouldn't be handing data to another party either, except, well, root servers). I am sure it's going to be possible, but compared to setting it on my DHCP server, now every client's browser would need reconfiguration.
[ Parent | on HN ]
Re:Big ISPs aren’t happy about Google’s plans for encrypted DNS by cm2187 on Wednesday October 02, 2019 @04:08AM (#21134280)
I don’t understand how that achieves anything.

If your DNS server is in the cloud, your ISP can still see your unencrypted queries to that server. If it is at home, your ISP can still see the unencrypted queries of that server to the root servers.

Unless you encrypt the traffic, DNS is transparent to the ISP whichever way you set it up.

And unless you are also using a VPN, the ISP can learn most of what it can learn with DNS just by looking at the IPs you send packets too. Most commercial websites that matter aren’t sharing IPs.

[ Parent | on HN ]
Re:Big ISPs aren’t happy about Google’s plans for encrypted DNS by necovek on Wednesday October 02, 2019 @10:03AM (#21136537)
Oh sure, you are right. But the thing with collecting heaps of data is that it needs to be harder. If my ISP is going to filter and process all packets in realtime, sure they can get a lot of unencrypted stuff from me. In essence, other than heavy censoring countries like China, I don't think most ISPs do that (a number of users doing that is pretty small, so the effort on their part is not worth it).

And as you and others have said, it can be done by looking at IP addresses i connect to as well.

What I do achieve is that nobody has a "full" picture of me, but only some subset of data that I transmit.

I also use two independent ISPs in a loadbalancing/failover configuration, so that helps with the cause as well, thougb my primary use is fail-over since I am in this internet business :)

[ Parent | on HN ]