The DNS protocol is one of the most important protocols of the Internet.
In a nutshell, it translates a website's domain name, like google.com, into an IP address
that your computer needs to reach the site.
Without it, we would need to memorize the IP address of each site we want to visit.
Not very convenient.
You can learn more about DNS, in one of my previous videos.
In this video, however, I want to zoom in on two privacy issues with DNS.
First: the protocol does not use encryption.
Every time your computer needs to know an IP address, it asks a DNS resolver, but these
requests can be intercepted.
Allowing others to see the sites you visit.
This data could also be used to identify which devices you have in your home.
A smart thermostat, for instance, might communicate with a specific domain name.
An attacker that intercepts your DNS requests can see this, and then use that knowledge
to exploit a weakness in that device, possibly exposing your entire network.
This problem, however, is easy to solve.
Encrypt the connection between you and the DNS resolver with HTTPS.
The same technology that puts a green padlock in your browser.
Adding encryption means nobody can intercept your DNS requests and keep track of the sites
you visit.
This technique is called DNS over HTTPS or DoH for short.
So problem 1 is fixed, but the second problem is more fundamental.
The DNS resolver you use, will always be able to see who you are, based on your IP address
and what sites you visit, based on the DNS requests you make.
These resolvers are usually hosted by internet service providers, and some of these go as
far as selling your browsing history to third-parties.
What's more, governments can use DNS to monitor citizens and even to block content on the
internet.
Not cool!
To fix this problem, developers from Cloudflare, Apple, and Fastly worked together to create
Oblivious DNS, or ODNS for short.
And the idea is rather simple: introduce an intermediary that can only see who you are,
but not the sites you visit.
Here's how it works.
On end you have the ODNS resolver, a server somewhere on the internet that is capable
of translating domain names into IP addresses.
On the other end you have your device that wants to know the IP address of a given website.
In between is a proxy server that protects your privacy.
Now, imagine you want to visit google.com . Your computer will create a DNS request
and encrypt it so that only the ODNS resolver can read it.
Something you can do with asymmetric encryption, which you can learn more about in this video
here.
Anyway, this encrypted messages is then sent to the proxy server, which can see your IP
address but it can't see your DNS request because of the encryption.
All it does, is forward the request to an ODNS resolver.
This one does have the ability to decrypt your message and see what site you want to
visit.
However, it doesn't know who actually sent the request because the proxy is in between.
Great for privacy!
The ODNS resolver then looks up the IP address, encrypts the response so that only you can
read it, sends it back to the proxy, which relays it back to you.
And that's it!
The proxy server in the middle shields your IP address from resolvers that actually handle
your request.
So in summary, the proxy can see who you are, but not the sites you visit.
And the ODNS resolver can see the sites you visit, but not who you are.
This means that your privacy is protected as long as the proxy and the ODNS resolver
are run by separate organization that don't share data with one another.
If these two collude, they can link your IP address from the proxy server to the DNS request
in the ODNS resolver.
ODNS is, without a doubt, a great addition to protect our online privacy.
But does it have a bad influence on our browsing experience?
Surely these extra steps must slow everything down, right?
Well, kind of.
The team that developed ODNS ran some benchmarks, and they concluded that, yes, there is a performance
penalty, but it's not significant.
The encryption adds a delay of around 2ms and there is also some extra time needed because
your request has to go through a proxy, before hitting a resolver.
But it shouldn't be noticeable while browsing the web.
So there you go, that's how ODNS could protect your privacy on the internet.
Right now, it's not supported by any operating system, but Cloudflare has published an open-source
implementation that can be tested today.
Thanks for watching, please subscribe if you found this video interesting and I'll see
you in the next one!