Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.
Sign up to join this community
A person on my same Wifi network is tracking name of the websites that I visit using tools like Wireshark. Does DNS over HTTPS hide the name of the sites that I visit?
My DNS settings are -
If it does not hide the site names, what are the solutions other than VPN to achieve the same? Please ask for clarifications if needed as I don't know much about all this stuff.
Yes and no.
DoH will encrypt the communication between you and the DNS server, making it extremely difficult to track through DNS BUT
If your traffic can be sniffed this information is also available - unencrypted - as part of the https negotiation - so for websites it can still be tracked. (only the requested domain - not the full URL.)
Your options for preventing this are limited if you don't use a VPN - you will need an analog - likely a proxy that has encryption or tunnel which effectively do the same thing - wrap your traffic in a second encrypted layer outside the control of people between. Look at SSH tunneling and SOX.
NO
Secure DNS only hides your DNS traffic. So as the name implies it only secures what you do with DNS not what you do with the information you got from DNS.
"Does DNS over HTTPS hide the name of the sites that I visit?" was in question. So what happens if you only employ DNS security,is it prevents data from being openly visible when the you ask for whatever.com to your DNS server which in most home arrangements if off YOUR network..
Your computer then however takes that response of the IP it resolved to and makes a connection. That connection will be in the form of an IP, and IP addresses can be traced back to the site hosted on them (Often). IN the case of multiple sites on the same IP it can be vague, but say for instance one is adult content and the other is crocheting, etc.... Logical deductions can be made.. Now the data to and from that site will almost assuredly be encrypted. So what you did while on the site, will not be known. Nor will what you asked DNS for, but it does nothing to hide what you ultimately connected to.
See image, packet captures WILL show traffic to and from IP addresses. So with secure DNS you would not have seen my computer asked specifically for facebook.com, but you could see the IP it was connected to belonged to facebook
Yes, it is just like when you visit a site using HTTPS, nobody sniffing your internet traffic can really see the contents of it, just you and the server. Acording to the RFC8484 Section 8.1 they claim: "DoH encrypts DNS traffic and requires authentication of the server." and that it "mitigates both passive surveillance RFC7258 and active attacks that attempt to divert DNS traffic to rogue servers".
It also uses the port 443 which is used in almost 99% of HTTPS traffic so if someone is trying to sniff your traffic using Wireshark it will be very difficult to identify the DoH traffic because it will be mixed with the normal HTTPS traffic (Websites).
Side note: It also prevents DNS Filtering, what I mean is that if there is some firewall in your network that filters specific domains (like malware sites), by using DoH the firewall will not be able to block any domain you enter.
The DNSCrypt FAQ website also has a good list of advantages and disadvantages of using DoH here but if you are just looking to prevent simple Wireshark sniffing, DoH is more than enough.
