this post was submitted on 30 Jan 2024
1119 points (97.1% liked)
Memes
45633 readers
1157 users here now
Rules:
- Be civil and nice.
- Try not to excessively repost, as a rule of thumb, wait at least 2 months to do it if you have to.
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Technically incorrect unless you use http for some weird reason. The ISP can see the domain only, and (afaiu) not even that if encrypted client hello is used. At least kinda: they still see the IP which is not always unique.
Yes, this is why you should use DNS over TLS. My router signal to every DHCP client that it is the DNS resolver, and internally use DoT/dnssec to query IPs. It also intercepts every request on DNS port in case of some DNS are hard-coded on some devices.
DNS over TLS won't save you thanks to SNI. As there is a huge shortage of IPV4 addresses, same IP addresses serve multiple hostnames, and to provide a working encryption, TLS handshake includes the requested hostname in plain text so that SNI can be used to determine which certificate should be used. That plaintext hostname is something your ISP can easily log.
Rule of thumb is, Https does not provide anonymity, only encryption.
But the IP can also sometimes be meaningless if there are proxies or vhosts used.