• Vash63@lemmy.world
    link
    fedilink
    arrow-up
    5
    ·
    7 months ago

    The addresses themselves that you’re connecting to as one example. Also often DNS.

    • chiisana@lemmy.chiisana.net
      link
      fedilink
      arrow-up
      6
      ·
      7 months ago

      Strictly speaking, Encrypted Client Hello (ECH) paired with DNS Over HTTPS (DOH) can resolve this. But not many people have their systems setup this way, so it is still pretty niche.

      • Vash63@lemmy.world
        link
        fedilink
        arrow-up
        4
        ·
        7 months ago

        That also doesn’t resolve the carrier seeing which IPs you’re connecting to, which can often be traced back to services or sites.

    • PortugalSpaceMoon@infosec.pub
      link
      fedilink
      arrow-up
      3
      ·
      7 months ago

      What’s the threat model here? I can think of no DNS shennanigans that would not be detectable through the authentication mechainsms in TLS (chain-of-trust). Not having to trust network infrastructure is exactly what TLS is for.

      • chiisana@lemmy.chiisana.net
        link
        fedilink
        arrow-up
        5
        ·
        edit-2
        7 months ago

        Most DNS requests are clear text, which is why DOH was introduced to secure it such that no one can snoop on you looking up something-embarrassing.com. Also, the initial request, before you get the SSL certificate from the web server, you must tell the server at 169.169.169.169 that you’re looking for the certificate for something-embarrassing.com before they can get you the correct certificate. This is why ECH was introduced. Neither of which have became mainstream yet, and so there are still some basic leakage going on.