Comment by peterwwillis | Hacker News Reader

Comment by peterwwillis | Hacker News Reader

If you use Chrome or Firefox, almost all of your data is hidden from the ISP - increadingly more sites use HTTPS, and use a CDN, and browsers are implementing DNS over HTTPS and have their own DNS resolvers. In addition, providers like Google are literally proxying your mobile requests to unrelated sites to capture even more data.

Google and CloudFlare can see probably more than 90% of your traffic without even trying. Google's business model is dependent on selling advertisement based on your data. Your ISP can see maybe 50%, and it's shrinking fast.

All of these companies exist because you agreed to them. You're paying them to continue this behavior, or using their free services. Stop agreeing to free services and stop using monopolies. Lobby your local government to overturn laws preventing municipal internet providers.

That won't happen though, because people don't really care that much about surveillance to go to those lengths just to stop it. Hell, the NSA is still illegally wiretapping US citizens.

> If you use Chrome or Firefox, almost all of your data is hidden from the ISP

Can you elaborate on how Chrome and Firefox hide your traffic from your ISP, and what privacy advantages they have over IE, Safari or Opera?

Sure. Chrome and Firefox both implement (or are implementing) DNS over HTTPS, which hides what domains you're visiting by passing the request encrypted through a provider such as Google. Chrome also has a "data saver" on mobile that passes your traffic through Google's servers. Opera has had similar functionality for some time. Safari and IE will implement DNS over HTTPS once it's a standard, which should be soon. Don't know if they have plans to support tunneling too.

What is stopping yourisp from doing reverse dns and looking up what domain is pointing to the IP you are connecting to?

You can't do reverse DNS for sites using SNI. Multiple hosts use the same IP.

> Chrome and Firefox both implement (or are implementing) DNS over HTTPS, which hides what domains you're visiting by passing the request encrypted through a provider such as Google.

DNS over HTTPS doesn't actually hide the domains you're visiting, because TLS SNI means the server hostname is sent in plaintext as part of the TLS handshake.

And for major sites, they probably aren't sharing their public IPs with other sites, hence the ISP can know what site you're connecting to via knowing what IP you're sending datagrams to.

Ah, I had no idea it was already implemented in those browsers!

It appeared to be disabled by default in my Firefox install - for anyone else, I followed these instructions to enable it:

https://www.ghacks.net/2018/04/02/configure-dns-over-https-i...

Reply on news.ycombinator.com