Stories
Slash Boxes
Comments

SoylentNews is people

Android to Add 'DNS Over TLS' to Keep ISPs From Spying on You

posted by Fnord666 on Thursday October 26 2017, @04:28AM   Printer-friendly
from the DNS=Do-Not-Share dept.

MrPlow writes:

Submitted via IRC for SoyGuest31999

Android, the world's most popular mobile operating system, will soon enable a security protocol that helps keep internet service providers (ISPs) from spying on users. "DNS over TLS" adds a level of encryption to your DNS requests that are (mostly) inaccessible by your ISP.

[...] Using current methods, the requests happen through UDP or TCP protocols, not the more secure TLS. When Android makes the switch, you'll get the same results, only now with HTTPS-level security. That is to say, snoops now know when you've connected to a website, but not which one. Pornhub, for example, is the same as Gmail. Or, it is for the person spying on you. You'll still have to live with the fact you're watching Pokemon Go porn (safe-ish for work).

Source: https://thenextweb.com/mobile/2017/10/23/android-to-add-dns-over-tls-to-keep-isps-from-spying-on-you/

Original Submission

 
This discussion has been archived. No new comments can be posted.
Android to Add 'DNS Over TLS' to Keep ISPs From Spying on You | Log In/Create an Account | Top | 38 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 3, Informative) by KiloByte on Thursday October 26 2017, @11:59AM (2 children)

    by KiloByte (375) on Thursday October 26 2017, @11:59AM (#587769)

    Not quite the same in all cases.
    E.g. many web sites share the same IP address, but if you can't see the content of the payload, you'll never know with of the sites was contacted.

    Which is exactly the main case I'm talking about! The way SSL is implemented, target hostname is sent in open.

    Just run tcpdump and connect to a https site, to see it yourself.

    --
    Ceterum censeo systemd esse delendam.
    Starting Score:    1  point
    Moderation   +1  
       Informative=1, Total=1
    Extra 'Informative' Modifier   0  
    Karma-Bonus Modifier   +1  
    Total Score:   3  

  • (Score: 2) by c0lo on Thursday October 26 2017, @12:12PM

    by c0lo (156) Subscriber Badge on Thursday October 26 2017, @12:12PM (#587773) Journal

    Ah, yes, right.

    --
    https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford

  • (Score: 0) by Anonymous Coward on Thursday October 26 2017, @04:29PM

    by Anonymous Coward on Thursday October 26 2017, @04:29PM (#587869)

    One of the suggested improvements for TLS 1.3 was to also encrypt the SNI portion of the exchange or at least hash. Based on the last time I checked, that was ultimately rejected because most of the suggested techniques (not all) required increasing the number of packets exchanged. Of course, the techniques that didn't were rejected as "unfeasible" because there is no possible way for all servers to know the domain names or SLDs that they will be serving in advance, or because it would require reordering some packets, or because exchanging a hashed+salted SLD isn't secure due to bruting concerns or CDN certs with 100 SANs, etc.