Hacker News new | past | comments | ask | show | jobs | submit login

It's possible to extract much much more information [1] than DNS queries for an ISP with off the shelf products, they don't really need your DNS queries for that (yes, DoH people are lying like crazy that it improves privacy). What ISPs do care about is keeping control over DNS, being able to use it for address translation, routing around problematic servers, blocking and intercepting domains, etc.

[1] There is lots of stuff leaking all over the place in IP packets passively, not just IP addresses, but like website identifying TLS metadata in case it shares IP address with other websites, user machine and OS identifying metadata, etc. Also when you visit a website, you make requests not just to a single IP address, but also to a bunch of other IP addresses specific to the website to load resources that the page includes that send back responses of specific size and all of this is nicely clustered and mappable to a specific machine you were using. Even if you hide TLS metadata, it only takes a single user visiting a website in the open to identify all the rest who did too and that user can be a headless browser going through alexa top million websites. Active probing is yet another thing that can reveal a lot, ISP can connect to the same port from your IP address, send various things to figure out the protocol and so on, that's how all kinds of obfuscation can be detected.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: