What ISP see when I use custom DNS?

Submitted ⁨⁨11⁩ ⁨months⁩ ago⁩ by ⁨dark@lemmy.one⁩ to ⁨privacyguides@lemmy.one⁩

Hello there friends, please explain me how it is with custom dns, adguard for example. I know with standard setttings my isp see everything, but if i will use some encrypted dns what they will see exactly? I know one thing - if i visit for example 9gag they will see that, but if i click memes category on that site they will know i clicked on that category or not? I also know if i want full privacy I must use tor or / with vpn but this time I asking about this situation. Thank you so so much.

source

Comments

Sort:hotnew top

TiffyBelle@feddit.uk ⁨11⁩ ⁨months⁩ ago
Encrypted DNS doesn’t really do much for privacy. It does, however, accomplish two main things:

Ensures the authenticity of the DNS server you’re receiving a response from due to the certificate exchange.

Preserves the integrity of the response as it would be difficult for it to be tampered with in-transit.

The domain names you visit are leaked in plain text regardless of your DNS provider and how you connect to them via the “client hello” process of TLS, specifically the Server Name Indication (SNI) portion. ISPs could, in theory, use this to see which domains you’re visiting, but not the specific pages within the domain.

Note that there are mechanisms like ECH (Encrypted Client Hello) and ESNI (Encrypted Server Name Indication) that attempt to solve the domain name leakage issue, but each require domains that wish to support these technologies to include an entry specific to those in their DNS records to facilitate key exchange for the encryption to be viable. Very few domains presently do this.
source
- Boinketh@lemm.ee ⁨11⁩ ⁨months⁩ ago
  The ISP can still see which IPs you’re visiting, so couldn’t they cover most cases by just doing their own lookup, but backwards?
  
  source
  - outlying_demotion_nemeses@lemmy.sdf.org ⁨11⁩ ⁨months⁩ ago
    A good chunk of the web uses CDNs (content delivery networks) which puts a bunch sites behind the same IP and those gateways rely on SNI to figure out which site to send to the requestor.
    
    source
- ViciousTurducken@lemmy.one ⁨11⁩ ⁨months⁩ ago
  Ad and tracker blocking at the DNS level is a solid way to improve privacy right? Whether it be using your VPN’s DNS or something like NextDNS.
  
  source
  - TiffyBelle@feddit.uk ⁨11⁩ ⁨months⁩ ago
    Yes. In fact, using DNS-based blocking solutions is pretty much the only way to protect against first party trackers that use CNAME cloaking tactics if you’re not using a Firefox browser with UBo, since Chromium browsers have no ability to defend against this type of attack (with the exception of Brave as they implemented their own method of protecting against this with their Shields system.)
    
    source
I_like_cats@lemmy.one ⁨11⁩ ⁨months⁩ ago
It doesn’t matter if you use the DNS of your ISP or not they can always see what websites you visit. What they cannot see is website contents if the website is using https, which most modern websites are.

That means your ISP can see that you went to youtube.com but they can’t tell which video you watched or what else you did on the website.

The only thing they could do is analyze the traffic and see that there are many requests in a short time and assume you are probably watching a video.

source
- HeckGazer@lemmynsfw.com ⁨11⁩ ⁨months⁩ ago
  
  there’s no reason for using a VPN as the VPN provider will see the exact same thing as your ISP.
  
  That statement feels intentionally misleading. The ISPs and VPNs product alignments/value propositions are very different, as well as the jurisdictions they operate under. For example here in Australia we have extremely fucked privacy laws, ISPs have to store your history for a minimum of 7 years and must comply with any warrentless government data request within a day if they want to so much as exist. The service they provide is internet, zero privacy. A VPN based in Sweden with none of my personal info being paid specifically to protect my privacy is providing a different service.
  
  source
  - merde@sh.itjust.works ⁨11⁩ ⁨months⁩ ago
    not to forget that in some territories you have to use a VPN even to access Wikipedia 🤷
    
    source
- amanneedsamaid@sopuli.xyz ⁨11⁩ ⁨months⁩ ago
  That last line is extremely oversimplified. If you find a VPN provider you trust more than your ISP, there are several benefits to routing that information through a VPN. Just because they could see the exact same thing does not mean they are redundant.
  
  source
- opt9@feddit.ch ⁨11⁩ ⁨months⁩ ago
  
  Also there’s no reason for using a VPN as the VPN provider will see the exact same thing as your ISP.
  
  This is not true for Tor Browser.
  
  And for regular VPN’s that depends on how hostile your ISP or government is. It may be much better to let some company in a far away country who don’t care about what you’re doing to see your stuff.
  
  source
gabriele97@lemmy.g97.top ⁨11⁩ ⁨months⁩ ago
The DNS is useful only to translate the hostname (9gag.com) to an IP address. If you use a different DNS then the one offered by your ISP, the ISP will not record the fact that you asked a translation of 9gag.com

source
- david@feddit.uk ⁨11⁩ ⁨months⁩ ago
  But I think they can still see that you visited 9gag, just not which pages in 9gag (possibly after the first request) because https hides the details after you connect to their server.
  
  source
vox@sopuli.xyz ⁨11⁩ ⁨months⁩ ago
use dns-over-tls if you want privacy.
also only domains are exposed in plain text.

source
- ninchuka@lemmy.one ⁨11⁩ ⁨months⁩ ago
  how does DNS over TLS help with privacy? please explain it to me, since the ISP can still see the IP your sending data to and getting data from and can just reverse DNS lookup that IP
  
  source
dark@lemmy.one ⁨11⁩ ⁨months⁩ ago
Thank you for all of you Dear Friends, for great explaining

source
MangoPenguin@lemmy.blahaj.zone ⁨11⁩ ⁨months⁩ ago
If the website you visit uses HTTPS (SSL), then your ISP can see that you’ve visited 9gag.com but not what specific URL.

source
solberg@lemmy.blahaj.zone ⁨11⁩ ⁨months⁩ ago
If you don’t want them to see your DNS requests, you can use DNS Over HTTPS (DoH) or DNS Over TLS (DoT) I think

source
- vox@sopuli.xyz ⁨11⁩ ⁨months⁩ ago
  DoT > DoH
  
  source
- DeusHircus@lemmy.zip ⁨11⁩ ⁨months⁩ ago
  DNS translates a hostname to an IP address. Once you get your IP address you’re going to be sending traffic to that address through your ISP so they’ll know what server you’re talking to regardless, DNS reverse lookup exists. Encrypted DNS is not for privacy, it’s for security
  
  source
  - solberg@lemmy.blahaj.zone ⁨11⁩ ⁨months⁩ ago
    Thanks for clearing that up. But it would still be better than not having it as multiple host names/websites could point to the same IP, right?
    
    Also I’m not sure how you read my comment since I deleted it right after I posted it 😂. Still learning this Lemmy stuff
    
    source
  - outlying_demotion_nemeses@lemmy.sdf.org ⁨11⁩ ⁨months⁩ ago
    CDNs muddy those reverse IP lookups. Encrypted DNS (not from your ISP!) + Encrypted Client Hello are effective in masking what site on a CDN is being accessed.
    
    source
TairikuOkami@lemmy.world ⁨11⁩ ⁨months⁩ ago
For starters, it prevents some censorship and filtering, because it is usually done on DNS level, like in UK.

ISP can to see, to what domains you have connected, but most webpages use CDN servers like cloudflare, so while he could presume that you have connected to piratebay, there is no guarantee. It could be just an AD on some webpage or a linked picture, because each time you connect to any webpage, your browser makes connection to 30-50 other webpages, so it is not as straightforward as DNS, so an encrypted helps.

source