Encrypted DNS Does Not Hide All Browsing Activity
· 2:55 · Watch on YouTube ↗
Summary
A packet-capture demonstration shows that DNS over HTTPS can hide DNS queries while a connection’s SNI remains visible. ECH can encrypt the ClientHello, but may affect enterprise filtering and does not always work.
Key points
- The demonstration uses a network tap and Wireshark to inspect traffic from a PC configured to use DNS over HTTPS in Firefox.
- Although the DNS query is not visible, the server name can appear in the unencrypted ClientHello SNI.
- ECH can encrypt the ClientHello when supported, concealing SNI in the demonstrated connection flow.
- Enterprise DNS filtering and transparent proxies may rely on unencrypted SNI to restrict access to phishing or malware sites.
- The presenter cautions that ECH does not always work and that encrypted DNS alone does not ensure browsing privacy.
Article Details
- Topics
- [00:00] Encrypted DNS privacy limits and visible SNI
- [00:19] Packet-capture demonstration using a network tap, Wireshark, Firefox, and Cloudflare DNS
- [01:33] ECH encrypts the ClientHello when supported
- [02:00] Enterprise DNS filtering and transparent proxies rely on SNI; ECH may affect filtering and does not always work