Re:A cartoon intro to DNS over HTTPS (2018)
by xg15 on Sunday October 20, 2019 @09:38AM
(#21304053)
As another post on HN argued a few weeks ago and as is stated in this article again:
> After you do the DNS lookup to find the IP address, you still need to connect to the web server at that address. To do this, you send an initial request. This request includes a server name indication, which says which site on the server you want to connect to. And this request is unencrypted.
Note that, until encrypted SNI is in place, DoH does not actually increase your privacy. Your ISP can still track all domains you connect to by analyzing the SNI header. The only thing they cannot do anymore is block or redirect any of the domains.
> After you do the DNS lookup to find the IP address, you still need to connect to the web server at that address. To do this, you send an initial request. This request includes a server name indication, which says which site on the server you want to connect to. And this request is unencrypted.
Note that, until encrypted SNI is in place, DoH does not actually increase your privacy. Your ISP can still track all domains you connect to by analyzing the SNI header. The only thing they cannot do anymore is block or redirect any of the domains.