Hacker News Reader

Comment by trumped | Hacker News Reader

but your ISP will still be able to see all your connections even if you don't use its DNS servers unless you use a VPN... this just spreads the information to a third party.

View on HN

https://en.wikipedia.org/wiki/Server_Name_Indication#Securit...

Downvote me all you want, but domain names are still being sent to the ISP unencrypted, as of TLS 1.3... so it doesn't matter who processes your DNS queries, your ISP still knows everything about which sites you are accessing... but anyways, bare IP addresses still reveal a lot (metadata)

right - but we're coming for cleartext sni too:

https://tools.ietf.org/html/draft-rescorla-tls-esni-00

interestingly, something like DoH is a pre-requisite for pulling off esni.

that's great, but are you coming for the ip addresses too (probably the bigger challenge)?

wrt esni the anonymity pool is definitely the set of content that can share the same address pool. In a world with lots of CDNS (and several multi-CDN switching services) this covers a huge amount of content - but I agree - not everything.

If you think about the best/worst case scenario, would you be happy if one CDN would deliver everything? I think that we would be in a worst situation... ideally, I think that everyone would have their own servers and that your ISP would not even be able to see which IP addresses you are talking too (completely decentralized)

cdn switchers/sharers are very interesting here. e.g. cedexis

Yes, we are. After ESNI we’re working on DNS IP address randomization.

is that a joke? sorry I don't see how that would help... where could I get more info?

Reply on news.ycombinator.com