this post was submitted on 03 Oct 2023
639 points (98.9% liked)
Firefox
17049 readers
698 users here now
A place to discuss the news and latest developments on the open-source browser Firefox
founded 4 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Does this mean your isp can't see the sites you visit anymore?
Sort of. They can still see which IP address you're connecting to, which by itself or in combination with some minor traffic analysis is quite often enough to identify which website you've visited. Perhaps it isn't if the website puts absolutely everything through a giant CDN like Cloudflare, but in that case it's Cloudflare which gets to see all the sites you visit which isn't a whole lot better than the status quo.
Still, it's a little less information given away at least some of the time. Better to do it than not do it.
That's the status quo. CF holds the private keys to all reverse proxy'd sites hosted on it.
To be more precise, my belief is that the main thing ECH does is make it more difficult some of the time (depending on the details of how the site works) for observers of network traffic to directly see which website you've visited if it's one of those that have chosen to give all that data to Cloudflare or some similar system instead.
There also do still exist some simple web hosting setups that share many independent domain names on the same IP, but I think it's not as common as it probably was when they first came up with the idea of encrypting the tls server name many years ago. Maybe it'll make a comeback for sites whose users need to avoid censorship in this way if it's true that domain fronting has generally become more difficult.
Yes. Use a VPN. I recommend https://mullvad.net/en
Using a VPN just hands all of this information to them instead. That could be an improvement, but how do you know?
Well they can see your browsing history, sure. But HTTPS will stop them from seeing the content you actually see on the web. At this point we are just getting into discussions of layers of trust, which are generally impossible to solve if you don’t trust anyone. If you don’t trust anyone don’t use the internet, ever. I do trust mullvad. They’re explicit about who is involved, I have the name of every team member, and through peer review I consider them trustworthy.
https://mullvad.net/en/about
For more info about how they are transparent, you can read their article about how they responded to a search warrant earlier this year:
https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised/
Sure, but that was true for your ISP as well. I'm not questioning what data you're leaking. I'm saying that it's the same data and you only change who you leak it to if you choose to use a VPN.
It seems like you've thought about it and you have made an informed choice. That's great and I don't have anything to argue against here. The only reason I commented is that there seems to be a trend of "just use VPN and your data is protected" mentality, especially with all the ads in gaming/tech related content. There was no way for me to know if you or the other users who would read your initial comment were aware that using a VPN doesn't magically protect your data if you don't know who your provider is, so I though I'd point it out.
Well, for half of the internet they are going to see AWS ELBs addresses.
Yes and no. If your isp is still providing unencrypted DNS for you, then they can still see the domain name you're visiting.
What if you force a dns, like say cloudflare?
Ordinary DNS requests are always plaintext and readable to anyone between you and the DNS server. So regardless of which DNS server you use, your ISP can see all your DNS lookups. For any amount of privacy for DNS, the minimum is something like DNS-over-TLS or DNS-over-HTTPS, the latter of which Firefox uses by default in some countries and supports everywhere.
I mean with this + DNS over HTTPS can we guarantee the isp can no longer see anything?
They'll only see the IP you're connecting with and encrypted data packets being transferred on.
Not just readable... The ISP can inject their own responses too. Regular DNS is both unencrypted and unauthenticated, with most clients not enforcing DNSSEC.
so you're saying self host an authoritative DNS server
It's easy to setup something like AdGuard Home that provides malware blocking, ad blocking if you're interested in that, and supports DNS-over-HTTPS out of the box (unlike PiHole, which needs a bunch of manual setup)
That's how I understood it. With regular https your doing on those websites is already encrypted, but your ISP or whoever sits in between can still se which sites you're visiting. As far as I understand this standard would encrypt this step too.