Could my internet service provider see which websites I am looking at if I turn on DNS over HTTPS?
Could my internet service provider see which websites I am looking at if I turn on DNS over HTTPS?
I am not sure what DNS over HTTPS is all about. Does it actually help with my privacy? Will my internet company tell me which websites I visit while I use this special protocol?
If you are using their DNS server, yes. Change your DNS server to something else and then they can't see that traffic. It still needs to be encrypted with HTTPS to keep them from seeing the traffic though. Quick search for encrypted DNS will yield a ton of public options to use.
That's right. Anyone trying to find out what you need them to look for must already know exactly what you're asking for. What they do with that info depends on who is doing it. The only way around this situation is to tell the computer your actual ip address, so no dns server will have any part of the job to do.
If anyone gathers this data, they have a big reason to use it for money rather than protecting privacy. That scares me because I don't think we've found better tools yet that can handle DNS requests privately and safely without relying on centralized systems. Maybe blockchain could help fix this issue?
DNS is just a giant phone book that matches domain names with their IP addresses. There are hundreds of main servers around the world, plus tons of smaller ones kept by different groups. It's all set up so the registry stays correct and updates travel down to everyone else so they're always in sync. You can't really keep your own private archive updated and online at the same time anyway. Blockchain might be a new way to store that giant database, but when it gets used, someone somewhere will still know who looked what. It's physically impossible for two people to look at something without knowing what they're seeing. Sure, it costs money and gets exploited, but that's the price of using the web. At least encrypted DNS keeps your questions safe from prying eyes except for you right there on the end point. That is the best you can do. If you have the real IP address typed in manually, then you don't need DNS to look it up for you. That's your only workaround. Edit: Basically, what you're doing breaks the law and your internet service provider hates it. You face bigger problems than just your ISP seeing what they think you are doing. I can tell them that their routers won't start following you around the web once your traffic passes through them and they stop caring. That doesn't mean someone else will trace your path back to you from the other end, but that's not the ISP or in their control. In the end, your data packet has to be addressed to your IP address. You can't deliver a letter with no address on it; just like how the post office needs an address to sort mail correctly, the internet routing is based on where you live. There are ways to hide that final address until the last second but in the end it must be sent to you and someone somewhere will eventually know exactly where it goes.
I don't think that's true. Eventually people will figure it out. If you check Monero for example, it is really good at exchanging value in private way too. There is also the Tor network. And I just looked and they are working on a DNS over Tor project which would solve privacy problems. Now, is it possible to scale these technologies all around the world?
right that is the issue. The internet covers the whole world. If the DNS server isn't finished, and you type www.facebook.com while it's not in the list, you get an error and can't reach that site. Tor isn't as private as people think. Google Silk Road showed how the Tor network got broken (and is still broken) and their supposed anonymity fell apart quickly. Unless you are personally checking things out, whoever does it knows what they're looking for. There is no "blind and quiet servant" who works without talking to anyone else. No matter where you store your DNS entries or route traffic around, eventually everything looks like a request going to the server. At that point, someone asking for an IP address makes them known. If they want to do it, they can easily trace the traffic back to its source. You just have to make it really hard to figure out where the path is. Every stop along the way knows exactly where the traffic came from and which direction it's going. With the right tools, you can follow that path no matter how much you try to hide it. Many VPNs claim they don't keep any logs, which would mean once your traffic was followed so far there wouldn't be a log to continue tracing it. But even this isn't always true. Your ISP honestly doesn't look past their own servers if all you care about is that. If everything boils down to just them blocking you, it's easy to encrypt the traffic before they see it.