News for hackers. Stuff that matters.

A comment on Personal VPN Services are Snake-Oil. Parent comment

Re:Personal VPN Services are Snake-Oil by aborsy on Sunday April 14, 2024 @04:32PM (#40034218)
You can set mullvad (which offers VPN service) as your DNS over https server. Traffic is also mostly encrypted by https. Your ISP still gets the destination IP addresses, though they are harder to track.

Wouldn’t that address your concern?

[ Parent | on HN ]
Re:Personal VPN Services are Snake-Oil by yjftsjthsd-h on Sunday April 14, 2024 @04:42PM (#40034301)
No; until Encrypted Client Hello is ubiquitous HTTPS still has domains in cleartext. Also, I don't think we should be casually dismissing tracking by IP addresses.
[ Parent | on HN ]
Re:Personal VPN Services are Snake-Oil by hnlmorg on Sunday April 14, 2024 @04:39PM (#40034282)
IP addresses and host names (as defined in SNI).

https://en.m.wikipedia.org/wiki/Server_Name_Indication

[ Parent | on HN ]
Re:Personal VPN Services are Snake-Oil by SV_BubbleTime on Sunday April 14, 2024 @04:38PM (#40034272)
I think this is the old way of thinking about it.

Skipping the broader discussion of AI, the ridiculous amount of automatic and human impossible pattern, matching and correlation with seemingly harmless data is something that I don’t think we are equipped to fully comprehend.

The time at which I hit some meta CDN, seems harmless. Until combined with some cookie and some access time to some asset it uniquely identifies me to previously anonymized data.

So no, I do not think HTTP and a good DNS are enough.

[ Parent | on HN ]