Introduction to Online Privacy Gaps
The ever-evolving landscape of online privacy means that even with numerous privacy toggles and apps, gaps remain where your ISP can still observe your online activities. The primary issue is the route your ISP takes for every online connection, which exposes crucial data points such as DNS, SNI, and destination IP addresses.
ISP's Role in Online Privacy
Every connection you make online is routed through your ISP at some point, and this role as an ISP means your carrier is included in the privacy concerns. While many privacy-focused tools and settings can be implemented at home, such as toggling encrypted DNS, forcing HTTPS everywhere, or using a privacy-focused browser, these solutions alone are not sufficient to fully protect your online privacy.
Data Exposure Through DNS and SNI
One of the main gaps is the exposure of data through DNS and SNI. Even with encrypted DNS providers like Quad9 or Cloudflare, the connection process can still expose the Server Name Indication (SNI), your IP address, and the target address in the raw communication between your device and the website, app, or service. If you're using unencrypted DNS, the whole lookup is sent in plaintext, making it easy for your ISP to see everything you search for and connect to.
TLS Handshake and Encrypted Client Hello
The TLS handshake, a core part of internet communication, also reveals information about you to your ISP. Even on a fully encrypted connection, the first message your device sends names the site you're after (the SNI again), and it typically travels in plaintext so the server knows the correct security certificate to apply. The solution to this is Encrypted Client Hello, which is already implemented in most browsers but not easily toggled on.
Destination IP and Encrypted DNS
The destination IP is another critical piece of data that can be exposed. Even with encrypted DNS, website fingerprinting is still possible, especially within the ISP's own IP block. The privacy and security settings you need to keep toggled include switching on encrypted DNS system-wide, which removes at least some of the data revealed to your ISP during the lookup and resolution process.
Encrypted Client Hello: A Solution to the SNI Gap
Encrypted Client Hello (ECH) is a solution that helps to close the gap in protection. It works by creating a second version of the handshake message, almost using it like a decoy. One encrypted message holds the real information, such as the hostname, while the other is sent in the clear with a generic placeholder name instead. The server unlocks the real version once it arrives and carries on as normal, but your ISP only ever sees the decoy.
ECH is now implemented in most browsers and is being rolled out almost everywhere to boost your privacy. Despite the gap in HTTPS, it's absolutely worth keeping switched on, and even to force every site to use it.
The Final Solution: Using a Virtual Private Network (VPN)
Despite the gaps in privacy solutions, the real solution is to use a VPN for everything. When you use a VPN, your DNS, SNI, destination IP, and pretty much everything else is routed through the VPN's encrypted tunnel, giving you a massive privacy boost and obscuring your online activities from your ISP.
Conclusion
While privacy toggles and apps can be effective, they do not provide a foolproof solution. The ISP's role in routing your connections remains a significant concern. The Encrypted Client Hello and the use of a VPN are two additional steps you can take to further protect your online privacy. However, it's important to remember that even with these measures, there will always be some data leakage to your ISP. Therefore, a comprehensive approach that includes a VPN is the best way to protect your data from your ISP at all costs.
Comments