this post was submitted on 06 Oct 2024
732 points (90.8% liked)

Technology

60042 readers
2807 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
732
What the hell Proton! (r.nf)
submitted 2 months ago by [email protected] to c/[email protected]
259 comments fedilink hide all child comments
 

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 9 points 2 months ago (2 children)

With TLS and DoH, how is your bank and other information leaked?

[–] [email protected] 10 points 2 months ago (1 children)

Possibly the domain is visible with a traffic monitoring tool. Everything else is between you and the bank via HTTPS. Having said that, whatever is not over https is visible to whoever sits on the same network as yourself.

[–] [email protected] 6 points 2 months ago

Importantly, you probably don’t know what all is encrypted in every app you use on your phone, so it’s best practice to encrypt the transport.

[–] [email protected] 11 points 2 months ago (1 children)

He said "which bank", which could be determined by the sniffing DNS requests, or seeing which IPs his computer is connecting to.

Not a breach of his personal information (assuming the bank that he's using and the client he's using after putting everything in TLS properly).

[–] [email protected] 0 points 2 months ago (2 children)

But with DoH you can’t sniff the DNS, that’s the whole point.

[–] [email protected] 1 points 2 months ago

You actually still can. Have a look at DNS fingerprinting

[–] [email protected] 7 points 2 months ago (1 children)

But you can see the ip address, which will id the bank. They can derive other information by ip addresses or leaked data and there's still things using unencrypted connections even today. I generally just connect to my home vpn so at least it's inly my isp spying on me.

[–] [email protected] 2 points 2 months ago (1 children)

Generally you can also read the SNI.

[–] [email protected] 1 points 2 months ago

I think this is one of the things that ech is meant to solve. But ech/esni is still not widespread on smaller sites yet I think.