Tor Browser: a legacy of advancing private browsing innovation

Re:Tor Browser: a legacy of advancing private browsing innov... by claudiawerner on Saturday January 29, 2022 @01:28PM (#30128915)

Forgive me if you will, but I don't really understand the idea behind privacy on DNS. If you're not using a VPN, even if the DNS resolution is private, the ISP can still see what IP you're connecting to. It's trivial to do a reverse lookup on that. And if I'm not mistaken, even on HTTPS sites, the domain is visible in the request in plaintext too. So why is there so much focus on proxying DNS?

[ Parent | on HN ]

Re:Tor Browser: a legacy of advancing private browsing innov... by commoner on Saturday January 29, 2022 @02:52PM (#30129758)

While encrypted DNS does conceal the domain name from the ISP, it also prevents the ISP from intentionally returning an incorrect IP address in response to a DNS request. This behavior is known as DNS cache poisoning[1] (or DNS spoofing) and has been used by governments to censor websites and perform DDoS attacks on other websites.[2]

[1] https://en.wikipedia.org/wiki/DNS_spoofing

[2] https://www.crowdstrike.com/blog/cyber-kung-fu-great-firewal...

[ Parent | on HN ]

Re:Tor Browser: a legacy of advancing private browsing innov... by commoner on Saturday January 29, 2022 @05:42PM (#30131327)

> And if I'm not mistaken, even on HTTPS sites, the domain is visible in the request in plaintext too.

I originally misread this sentence. Yes, HTTPS requests expose the domain/subdomain name in plaintext to support Server Name Indication, which allows a server to host multiple HTTPS sites.[1] The domain/subdomain name can be concealed from the ISP with Encrypted SNI,[2] which Cloudflare's 1.1.1.1 DNS resolver supports.

Firefox used to support ESNI as an about:config option, but in version 85, Firefox replaced it with support for an improved mechanism called Encrypted Client Hello.[3][4] ECH is not widely used yet, though Cloudflare is testing it on some of its servers.[5]

With DNS over HTTPS/TLS and ECH, the entire process of connecting to an HTTPS site can be done without leaking the domain/subdomain name to the ISP. The only remaining parts exposed in plaintext are the remote IP address and port.

[1] https://https.cio.gov/faq/#why-are-domain-names-unencrypted-...

[2] https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn...

[3] https://blog.mozilla.org/security/2021/01/07/encrypted-clien...

[4] https://blog.cloudflare.com/encrypted-client-hello/

[5] https://blog.cloudflare.com/handshake-encryption-endgame-an-...

[ Parent | on HN ]

Re:Tor Browser: a legacy of advancing private browsing innov... by claudiawerner on Sunday January 30, 2022 @12:46PM (#30139271)

Thanks a lot for the responses, I understand now :)

[ Parent | on HN ]