DNS over https. It transmits your dns requests over https encrypted using tls so that the device handling them over the wire can’t inspect them.
When you type pornhub.com into your browsers address bar your computer doesn’t fucking know what that is so it asks the dns server what it is. Because of history and reasons it asks in plaintext. So your isp can see that a dns request was placed to some dns server for pornhub.com. Your isp could also edit or intercept that request. Isp means whatever WiFi you’re connected to as well. Assuming the isp allows your dns request and the servers response through, your browser will most likely connect to pornhub using https. In that case the isp won’t be able to record that you looked up shrek slime butts sheet cake sitting videos but they will know that you visited pornhub.
Doh prevents that situation.
I don’t know how you set up doh on your system because I don’t know what you’re running or how your dns is configured. I recommend you learn how to set this up yourself and verify that it’s working correctly so you can ensure your own security.
Even with doh set up, your computer reaches out to a dns server and trusts that server is what it claims to be. There are reasons and history that explain this behavior but there are also attacks that take advantage of it. Dnssec performs cryptographic identity verification to make sure you are asking the real dns server where Pornhub.com is as opposed to some on the wire or in the cloud interlocutor that might direct you to a website that looks alike or just sends you somewhere else entirely.
Please read the following in the voice of Glenda the good witch from the wizard of oz, or SpongeBob, or some other character who is on your side and would never say something mean to hurt your feelings, because I am on your side and would never say something mean with the intention of hurting your feelings:
A person who benefits from this kind of explanation would be best served by mullvad over any other vpn because it is much harder to misconfigure mullvad in a way that undoes your privacy goals.
DNS over https. It transmits your dns requests over https encrypted using tls so that the device handling them over the wire can’t inspect them.
When you type pornhub.com into your browsers address bar your computer doesn’t fucking know what that is so it asks the dns server what it is. Because of history and reasons it asks in plaintext. So your isp can see that a dns request was placed to some dns server for pornhub.com. Your isp could also edit or intercept that request. Isp means whatever WiFi you’re connected to as well. Assuming the isp allows your dns request and the servers response through, your browser will most likely connect to pornhub using https. In that case the isp won’t be able to record that you looked up shrek slime butts sheet cake sitting videos but they will know that you visited pornhub.
Doh prevents that situation.
I don’t know how you set up doh on your system because I don’t know what you’re running or how your dns is configured. I recommend you learn how to set this up yourself and verify that it’s working correctly so you can ensure your own security.
You also need dnssec, as noted above.
interesting examples 😭
i think i have it enabled on my pcs browser (librewolf) and my phones browser (ironfox)
Make sure you also have dnssec set up.
Even with doh set up, your computer reaches out to a dns server and trusts that server is what it claims to be. There are reasons and history that explain this behavior but there are also attacks that take advantage of it. Dnssec performs cryptographic identity verification to make sure you are asking the real dns server where Pornhub.com is as opposed to some on the wire or in the cloud interlocutor that might direct you to a website that looks alike or just sends you somewhere else entirely.
Please read the following in the voice of Glenda the good witch from the wizard of oz, or SpongeBob, or some other character who is on your side and would never say something mean to hurt your feelings, because I am on your side and would never say something mean with the intention of hurting your feelings:
A person who benefits from this kind of explanation would be best served by mullvad over any other vpn because it is much harder to misconfigure mullvad in a way that undoes your privacy goals.