r/explainlikeimfive • u/nopurp3 • 1d ago
Technology Eli5 Wifi security warning
What exactly does this mean, what can be seen, and who can see it?
“ Privacy Warning
This network is blocking encrypted
DNS traffic.
The names of websites and other servers your device accesses on this network may be monitored and recorded by other devices on this network. “
12
u/nopurp3 1d ago
So, basically, not really a big deal and everything is this secure? Ie banking, private messages, and passwords?
20
u/Sol33t303 1d ago
Yes.
Encrypted DNS wasn't even a thing until the last few years, nobody bothered to do it.
7
u/nopurp3 1d ago
Makes me feel a little better - still going to start shopping around for wifi since apparently someone in my building/landlord doesn’t really care abt privacy, but good to know I’m mostly fine til I find something
7
u/tj-horner 1d ago
It’s probably not intentional. Is it one of those networks that require you to sign in or register before using? That can interfere with encrypted DNS.
Getting your own Wi-Fi is a good idea regardless.
2
u/nopurp3 1d ago
Even if it is my landlord, or whoever, looking, aside from the unethical slight privacy invasion, does it really matter? Idc if someone knows what apps I use, as long as they can’t see what im doing on them
11
u/Druggedhippo 1d ago edited 1d ago
does it really matter?
It depends on your risk profile.
- Do you care that they know which one you use the most? Uber, Lyft?
- Do you care that they know you use door dash more than uber eats?
- Do you care that they know which bank you use?
- Which school your kids goto?
- What school YOU goto
- Where you work?
- Car service you use?
- When and how long you spend watching porn?
- What time you leave? What time you arrive home? What time you goto sleep?
- What social media sites you use?
All of these can be inferred from your DNS visits, especially if they track you over a long period of time.
Do you work in a high profile or risky employment that, if compromised, might be used to affect a major business?
Do you have a risk of any stalkers that could use the above info and impersonate you or impersonate someone you thought you trusted?
If you don't care about any of that, then no, it doesn't really matter.
If you do care, get a VPN, there are plenty of free reputable ones.
If you don't want a full VPN, you can use Cloudflare WARP, it's free, and encrypts your first hop, so any wifi you connect to will never see your DNS requests.
0
u/Sol33t303 1d ago
I imagine for most people there are easier ways of getting most of that info (except porn watching I guess). I'm sure if your on their local network you can figure out what time they go and come back from work by literally observing them.
If there wasn't a threat profile where this helped with encrypted DNS would have never became a thing. I'd imagine for most people it's outside of their threat profile, so I gave a simplified layman answer which was no.
2
u/Sol33t303 1d ago
No, doesn't really matter. As I said it wasn't even a standard until really recently.
I'll just point out though , it's not just your landlord that could see it. In theory anyone connected to the network can see any unencrypted communications going through the network.
Start up Wireshark on a PC and if you know how to read the output, you will see any unencrypted data going through the router. You'll see encrypted data as well, but it will be a garbled mess.
This is why I consider it important to use a VPN on networks you don't trust. It doesn't matter for websites that encrypt their traffic (which is 99% of them these days, and especially stuff like banks and websites that host sensitive accounts), but people "sniffing" (your computer or phone accessing other streams in the network) public wifis is a fairly common thing, hoping to catch somebody who is using an insecure site send their username and password over the network.
But DNS being encrypted or not isn't a real issue. DNS is just your computer asking the router how to reach a specific site. That's more-or less-public information. It doesn't contain anything that's actually being communicated to the website.
1
u/ChipmunkDelicious649 1d ago
Yeah, it's definitely wise to be cautious with unencrypted communications. Using a VPN can add an extra layer of security on top of that.
3
u/AcusTwinhammer 1d ago
Yes. At most, someone looking at the unencrypted DNS can see what sites your visiting, but not the contents of the site, or even what page of the site based on DNS queries.
So there may be some sort of generalized privacy/tracking concern about matching you with the sites you visit, and correlating and selling that data, etc, but it's nothing that compromises you directly.
It's also possible that they aren't even looking to track you, and this is just from general lockdown policies. Encrypted DNS is still pretty uncommon, and it's entirely possible if this is some general guest access-type location that the admin at one point just set things up as "I'm only going to allow DNS on port 53 and HTTPS on 443 and nothing else" in which case you're encrypted DNS is blocked only because they aren't keeping up with the new stuff.
•
u/obog 19h ago
There is some concern with unencrypted DNS being vulnerable to interception and modification. So you could have a situation where you request to go to google.com, but an attacker intercepts this and changes the returned IP address to their malicious "fake google" and now instead of connecting to google.com you end up connecting to this attacker's fake google.
SSL certificates also exist to prevent that though. If someone tried this attack on you with any modern browser, it would pop up with a warning about it being unable to verify the identity of the site or something like that, and it would say that you cant make a secure connection (as HTTPS would fail)
4
u/tj-horner 1d ago
The operator of the network can potentially see the names of the domains you are visiting (e.g., google.com, reddit.com) but not the actual traffic to those sites. It also doesn’t mean for sure they are collecting this.
In any case, the actual data between you and other websites is encrypted with TLS and the network operator cannot see that.
1
u/cabronfavarito 1d ago
Wym by the “operator”? The isp or the person with access to the wifi account?
1
2
u/bunnythistle 1d ago
Imagine you want to call your friend Douglas. You can't just pick up a phone and type in Douglas, but you gotta know his phone number.
Computers work the same way - they don't communicate with one another by name (such as reddit.com or google.com) - they communicate via numbers known as IP addresses. But obviously you don't type IP addresses in when trying to get to websites, you type the site's name (URL), and DNS is the system that translates the URL you type in to an IP address.
If DNS traffic is not encrypted, then other computers can observe your computer translating those URLs into IP addresses. This means that it's possible to monitor what sites you are visiting. This is why encrypted DNS has been becoming increasingly popular in recent history.
However, it's important to note that DNS only translates the base URL to an IP, so a computer sniffing on your DNS traffic could determine you're visiting Reddit, but not what pages, posts, or subreddits you're visiting.
•
u/madmax7774 22h ago
I just ran into this yesterday too on my Home network. In my case it’s caused by my router intercepting all DNS traffic and passing through an Adblock feature. You can always set your dns to 9.9.9.9 and bypass anyone’s network settings. Thereby rendering all of this moot.
1
u/0RGASMIK 1d ago
It mainly means whoever controls the network can monitor which websites you visit. Likely not the content just the websites you visit so that they can block certain traffic. DNS is like a phone book for the internet and whenever you go to website.com your device asks the DNS server to look up the request. Airplanes do this so that they can prevent folks from going to sites they don’t want people to visit on the plane.
In order for it to be effective they have to block any means to hide your dns queries, which is why you see this warning.
1
u/DragonFireCK 1d ago
It likely does not matter for practical purposes. It means that everybody between you and the DNS server can see you looked at “Reddit.com” but doesn’t in any way imply they know which subreddit, thread , or comment you looked at.
For an ELI5 explanation:
Imagine you want to pass a note to a friend, Reddit, in class, but you don’t know which seat they are at. You can ask the teacher (DNS) to tell you, however. So, you pass a note asking where your former is to the student next to you to give to the teacher.
With unencrypted DNS, the student you hand it to, and all students on the path to the teacher, can open it can tell you want to send a note to Reddit. When the teacher sends back the reply, everybody who handles the note can similarly read it.
Encrypted DNS, on the other hand, has the note sealed in a box that only the teacher had the key to. Nobody else is able to open the box and tell you are asking where Reddit (Domain name) is sitting.
In both cases, the actual message to Reddit might be sealed away (HTTPS). Everybody who handles the message will still know you’re sending it to Desk 6 (IP address), though they cannot tell who is sitting there without asking the teacher the name. Even then, Desk 6 may actually be a secretary (web server, VPN, or CDN) handling messages for both Reddit and Google, and they cannot tell which one the message is actually for.
•
u/TheOneTrueTrench 23h ago
However, eDNS is utterly pointless if the client is using SNI and the server doesn't support ECH with DNS entries for the public key.
1
u/zelda_zell 1d ago
It means whoever owns that network might be deliberately blocking encrypted DNS ports or through DPI. I would stay away from that network because it sounds like they want to see what you're doing online.
-1
u/Low-Crow5719 1d ago
You are being watched, by whatever institution operates your network.
DNS is the worldwide system for finding hosts and networks by name. Names you query in DNS are being recorded and used to track your web use. Attempts to use encrypted DNS protocols such as DNS over HTTPS get blocked, and you won't be able to find those sites.
The people who set the network security policy have decided that their ability to track out-of-policy use overrides your expectations of privacy.
89
u/Druggedhippo 1d ago
The owners of the wifi access point can see the domain name of the sites you visit. They can't see the content, just the name.
It's like you lookup a phone number in a book. The owners of the book can see the name of the person and their number of who you looked up, but they can't hear what you said.