Hello there friends, please explain me how it is with custom dns, adguard for example. I know with standard setttings my isp see everything, but if i will use some encrypted dns what they will see exactly? I know one thing - if i visit for example 9gag they will see that, but if i click memes category on that site they will know i clicked on that category or not? I also know if i want full privacy I must use tor or / with vpn but this time I asking about this situation. Thank you so so much.
I know with standard setttings my isp see everything, but if i will use some encrypted dns what they will see exactly
Basically the same thing.
Encrypted DNS is not for privacy, it is for stopping someone from altering your queries basically, because normal DNS is not encrypted. Domains are exposed through other various methods we explain. Please see our website where we’ve gone to the effort to explain this https://www.privacyguides.org/en/advanced/dns-overview/ we have a flow chart that characterizes the above methods of obtaining the domains you’re requesting.
Encrypted DNS doesn’t really do much for privacy. It does, however, accomplish two main things:
• Ensures the authenticity of the DNS server you’re receiving a response from due to the certificate exchange.
• Preserves the integrity of the response as it would be difficult for it to be tampered with in-transit.
The domain names you visit are leaked in plain text regardless of your DNS provider and how you connect to them via the “client hello” process of TLS, specifically the Server Name Indication (SNI) portion. ISPs could, in theory, use this to see which domains you’re visiting, even if you’re using encrypted DNS, but not the specific pages within the domain.
Note that there are mechanisms like ECH (Encrypted Client Hello) and ESNI (Encrypted Server Name Indication) that attempt to solve the domain name leakage issue, but each require domains that wish to support these technologies to include an entry specific to those in their DNS records to facilitate key exchange for the encryption to be viable. You’ll also need a DNS client that supports ECH/ESNI. Very few domains and clients presently do this, meaning it is almost certain all/the vast majority of your visited domains would be transmitted in plain text at this point in time.
Ad and tracker blocking at the DNS level is a solid way to improve privacy right? Whether it be using your VPN’s DNS or something like NextDNS.
Yes. In fact, using DNS-based blocking solutions are pretty much the only way to protect against first party trackers that use CNAME cloaking tactics if you’re not using a Firefox browser with UBo, since Chromium browsers have no ability to defend against this type of attack (with the exception of Brave as they implemented their own method of protecting against this with their Shields system.)
deleted by creator
A good chunk of the web uses CDNs (content delivery networks) which puts a bunch sites behind the same IP and those gateways rely on SNI to figure out which site to send to the requestor.
use dns-over-tls if you want privacy.
also only domains are exposed in plain text.how does DNS over TLS help with privacy? please explain it to me, since the ISP can still see the IP your sending data to and getting data from and can just reverse DNS lookup that IP
With plain DNS the ISP can see that you request example.tld to 1.1.1.1
With encrypted DNS (DoT, DoH, DoQ, DNSCrypt…) the requests are encrypted with TLS or other, o only see that you connected to dns.cloudflare.com not the domain that you request, so it cannot see that you requested example.tld
It doesn’t matter if you use the DNS of your ISP or not they can always see what websites you visit. What they cannot see is website contents if the website is using https, which most modern websites are.
That means your ISP can see that you went to youtube.com but they can’t tell which video you watched or what else you did on the website.
The only thing they could do is analyze the traffic and see that there are many requests in a short time and assume you are probably watching a video.
Edit:
They will of course also not see if you clicked on a category on 9gag.
Also there’s no reason for using a VPN as the VPN provider will see the exact same thing as your ISP.
there’s no reason for using a VPN as the VPN provider will see the exact same thing as your ISP.
That statement feels intentionally misleading. The ISPs and VPNs product alignments/value propositions are very different, as well as the jurisdictions they operate under. For example here in Australia we have extremely fucked privacy laws, ISPs have to store your history for a minimum of 7 years and must comply with any warrentless government data request within a day if they want to so much as exist. The service they provide is internet, zero privacy. A VPN based in Sweden with none of my personal info being paid specifically to protect my privacy is providing a different service.
Also there’s no reason for using a VPN as the VPN provider will see the exact same thing as your ISP.
This is not true for Tor Browser.
And for regular VPN’s that depends on how hostile your ISP or government is. It may be much better to let some company in a far away country who don’t care about what you’re doing to see your stuff.
