Re:Mozilla VPN
by __turbobrew__ on Thursday June 18, 2020 @04:02PM
(#23567309)
Unless you are using a VPN/Wireguard/Proxy your ISP can simply look at the source address on the IP packets and do a reverse IP lookup to find out what site you are accessing. Doesn't matter if you are using DoH, DNS over TLS, DNSCRYPT, etc....
At a conference I was talking to one of the OpenDNS engineers on the DoH project and when I asked "so how does DoH help snooping if people can just look at IP headers?" they conceded that it really doesn't help if someone is determined to snoop.
Doesn’t work with a large number of sites because of Cloudflare.
Edit: it _is_ easy to read the destination address from TCP packets though.
Re:Mozilla VPN
by __turbobrew__ on Thursday June 18, 2020 @04:39PM
(#23567751)
Yea, you are correct. I got it mixed up, your ISP would look at the destination address of outgoing packets from your home.
If you want privacy with your DNS, you should setup DoH using dnscrypt-proxy or perhaps DNS over TLS.
Personally, I think a better strategy with this whole vpn aspect is to just setup a vpn with pis in various countries + pihole. At least that way I know what the setup is happening in each locations and what expectations of privacy I can expect.