News for hackers. Stuff that matters.
Re:Wikimedia DNS by briHass on Thursday September 07, 2023 @12:37AM (#37414814)
At the ISP level, does it really matter that they can sniff my queries/SNI? They're just as capable of seeing the IP4/6 I'm connecting to and rDNSing that to know the hostname. SNI gets them past the multiple sites on a single IP, but even encrypted Hello might only hide your activities in the vanishingly rare instances where IPs are actually shared. The obvious analogy is sending postal mail to an address without the recipient's name: it's still pretty obvious who you're communicating with.

Maybe I'm just bitter because I've found DoH (and even DoT) to be slow and occasionally unreliable. Even using Cloudflare, which is my fastest DNS, I see my local caches hitting strange resolve errors or in the minimum, durations 4-10x slower than good old UDP.

Re:Wikimedia DNS by acdha on Thursday September 07, 2023 @07:13AM (#37417274)
> At the ISP level, does it really matter that they can sniff my queries/SNI? They're just as capable of seeing the IP4/6 I'm connecting to and rDNSing that to know the hostname.

Shared hosting breaks that. If I connect to an IP used by AWS, Akamai, Fastly, etc. there are literally millions of things I could be using but the SNI header will tell them which one.

As a practical example, if a school administrator in Texas sees a connection to 104.16.12.208 they only know that someone is connecting to one of the millions of sites behind Cloudflare. SNI tells them it’s Planned Parenthood and they can call the police to report an offense against the church.

Re:Wikimedia DNS by pabs3 on Thursday September 07, 2023 @11:22PM (#37428847)
I can't find it right now, but there was a study about this that concluded shared hosting actually mostly doesn't break IP to domain correlation.