News for hackers. Stuff that matters.

A comment on Shutting down our unencrypted public DNS service. Parent comment

Re:Shutting down our unencrypted public DNS service by manigandham on Tuesday December 13, 2022 @11:08AM (#33970734)
It offers privacy too. With encrypted DNS, you can only see that the source IP is making a request to the destination IP, not what type of request or what it contains.

If the source device then connects to whatever IP was in the answer, and you have that IP mapped, then you can reveal what they might be connecting to, but that requires more data and processing compared to plaintext DNS and still won't reveal the actual encrypted traffic.

With shared IPs from CDNs, hosting providers, and VPNs, it provides far more obfuscation for the average user.

[ Parent | on HN ]
Re:Shutting down our unencrypted public DNS service by TurningCanadian on Tuesday December 13, 2022 @12:00PM (#33971675)
There's still TLS Server Name Indication leaking the hostname.
[ Parent | on HN ]
Re:Shutting down our unencrypted public DNS service by manigandham on Tuesday December 13, 2022 @12:13PM (#33971924)
SNI can be encrypted in an extension of TLS 1.3 called ESNI (encrypted server name indication). With both EDNS and ESNI, there's sufficient privacy coverage.

The next standard is ECH (encrypted client-hello) which secures the entire handshake: https://blog.cloudflare.com/encrypted-client-hello/

[ Parent | on HN ]
Re:Shutting down our unencrypted public DNS service by gsich on Tuesday December 13, 2022 @02:33PM (#33974473)
Is it still in draft state?
[ Parent | on HN ]
Re:Shutting down our unencrypted public DNS service by manigandham on Tuesday December 13, 2022 @03:10PM (#33974999)
Yes: https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-15
[ Parent | on HN ]