• @PortugalSpaceMoon@infosec.pub
    link
    fedilink
    148 months ago

    What is it that you’re doing that is still not using some form of authenticated encryption? Almost everything is https, ssh, almost all mailservers have tls support, irc does have tls support… What’s left that needs to be encrypted by a VPN?

      • chiisanaA
        link
        68 months ago

        Strictly speaking, Encrypted Client Hello (ECH) paired with DNS Over HTTPS (DOH) can resolve this. But not many people have their systems setup this way, so it is still pretty niche.

        • @Vash63@lemmy.world
          link
          fedilink
          48 months ago

          That also doesn’t resolve the carrier seeing which IPs you’re connecting to, which can often be traced back to services or sites.

      • @PortugalSpaceMoon@infosec.pub
        link
        fedilink
        38 months ago

        What’s the threat model here? I can think of no DNS shennanigans that would not be detectable through the authentication mechainsms in TLS (chain-of-trust). Not having to trust network infrastructure is exactly what TLS is for.

        • chiisanaA
          link
          5
          edit-2
          8 months ago

          Most DNS requests are clear text, which is why DOH was introduced to secure it such that no one can snoop on you looking up something-embarrassing.com. Also, the initial request, before you get the SSL certificate from the web server, you must tell the server at 169.169.169.169 that you’re looking for the certificate for something-embarrassing.com before they can get you the correct certificate. This is why ECH was introduced. Neither of which have became mainstream yet, and so there are still some basic leakage going on.

    • @Dymonika@beehaw.org
      link
      fedilink
      38 months ago

      So this is a question I’ve been wondering: is public WiFi safe to treat like a private one if you’re using HTTPS everywhere?

      • @skuzz@discuss.tchncs.de
        link
        fedilink
        58 months ago

        You only use HTTPS everywhere until you don’t. It’s kinda like a security blanket to use a VPN in those situations. Someone could be running a MITM proxy and you’re dumb enough/in a rush/etc. and click accept on the expired cert. Or some new 0day vulnerability allows badness to happen without your knowledge. Even without being able to see your traffic, a bad actor could still see your DNS requests and narrow down what services you use for further targeting, especially if you frequent a place.