upvote
If I set my DNS provider to use DoH or DoT, my ISP will no longer see my DNS requests. I'm confident that my ISP doesn't do DPI at scale to extract SNI, so the lack of ECH doesn't break the entirety of the privacy benefit.

The fact that they could perform DPI doesn't change the reality that most ISPs probably aren't doing it, unless mandated by law, because it's expensive and in my main country of residence they can't sell that data to offset the cost.

I'm surprised to see such lack of nuance coming from you.

reply
It doesn't fix privacy but it does work around censorship. Has a court or the government ordered your ISP to usurp its enemies' DNS records? If so, you need to talk to a different resolver, not constrained by your government or courts.
reply
> but it does work around censorship

* for the countries/ISPs that don't also hijack all DNS

https://en.wikipedia.org/wiki/DNS_hijacking#Manipulation_by_...

reply
There are gaps depending upon the client configuration, but "bupkis" is simply wrong or horribly obsolete.

Encrypted DNS isn't an "any day now", basically every platform and browser and provider supports it, and 100% of my household's DNS requests are opaque to anyone watching the wire. And basically every system like Cloudflare supports ECH, so SNI isn't a thing for the vast majority of sites.

reply
DoH and ECH fix that
reply
Any moment now...
reply
deleted
reply
deleted
reply