I was wondering if a VPN would add any kind of security or privacy if one is connecting to a host with a client/browser that supports DNS over HTTPS and that host supports encrypted client hello. Is there a way for the ISP or anything in between to shape traffic or even know what is being accessed? The only thing that should be visible is traffic between two IP addresses right?
Depending on your threat model, if you know your ISP is tracking everything, then a reputable VPN doesn’t add risk. If you have guaranteed observation and recording at your ISP level, which is most people: then using a VPN, paid with cash or crypto, probably gives you more privacy. At worst case it’s the same level of observation.
In your scenario, using a browser with encrypted hello, using fully encrypted DNS, the only thing the ISP would see is your connection to the web server. If that web server, like cloudflare, serves multiple things, then it may obscure who you’re talking to.
That being said, if somebody is observing enough of the network, they can look at network traffic flows, and determine what other service you’re actually speaking with. IE unique traffic patterns to play a game, watch a video, interact with a app. Those can get exposed by the size of packets and frequency of packets transiting.
The main difference between a VPN, and an encrypted socket, for traffic flow analysis, is the VPN traffic gets all lumped together, so a third party doesn’t know which pattern belongs to which stream. So if you’re streaming videos, well doing other stuff on the VPN, it becomes harder to identify your traffic flow.
The browser traffic flow analysis is much easier, because each individual stream of data is observable by the ISP.
But how easy is it to actually make up what’s going through a socket? If my ISP sees 1TB of data being continuously downloaded (from another IP address that they don’t already know what its usually involved with) maybe I’m downloading some illegal movies, maybe I’m retrieving a hard drive backup, right?
Torrent traffic that doesn’t go through a VPN is probably easy to make up, it’s tons of packets from 50+ addresses, but if it’s a Usenet download from one address, or SSH traffic from a seedbox, that should be more complicated to figure out right?
It’s unlikely anyone is going to do traffic analysis to catch piracy.
Whistle blowing, human rights reporting, political opposition gets the traffic analysis heuristic identification attack.
The DNS traffic might be encrypted but that doesn’t mean that other protocols are. A VPN tunnel encrypts all traffic passing through regardless of protocol.
This is the correct answer. A VPN encrypts and obfuscates all your connections, not just the web browser.
If all you care about is hiding the websites you visit from your ISP, DNS over TLS is fine. But just remember that you’re bleeding data by using your real IP (ISP, geolocation, etc.). And any other connection, is just unabashedly, you.
Well I was mostly thinking about Usenet but I guess everything else applies. Websites really can leak everything.
But so does TLS right?
Yes, HTTPS traffic is encrypted also, but I wouldn’t trust that all of your activity online is hidden just because DNS and HTTPS are encrypted.
Up to you, but I use a VPN when online.
That "traffic between two IP addresse"s is enough reason to use a VPN you trust.
Put it this way, bit torrent traffic can be encrypted and routed over standard ports to make it look like regular web traffic, so still “just traffic between two IP addresses” but you wouldn’t run that without a VPN, would you?
deleted by creator
[This comment has been deleted by an automated system]
To add to what the others have said, a VPN requires one end to authenticate to the other. Regular HTTP and DNS connections don’t.
If you need to access a service remotely, doing it over VPN requires the user to authenticate (to use the VPN).
If you simply expose the service publicly, even if the connection to it is encrypted, it doesn’t prevent random strangers from accessing it or trying to break in.
HTTPS does enforce at least one sided authentication though. In the scenario the service they access is most likely being hosted by a server that does authenticate via X.509 cert.
Unless it’s p2p of course.
In this case, a VPN only offers obscuring that you are connecting to the dns over http end point.
