Encrypted DNS Not Fully Private, Packet Timing Reveals Data

Despite the widespread adoption of encrypted DNS protocols like DNS over HTTPS (DoH) and DNS over TLS (DoT), new findings indicate that these methods do not fully shield user activity from sophisticated traffic analysis. A recent study has shown that an eavesdropper can still deduce which websites a user is accessing by meticulously observing the size and timing of encrypted data packets. This side-channel attack leverages the fact that different web pages and their associated resources generate distinct traffic patterns, which can be fingerprinted even when the actual DNS queries and web content are encrypted. The research involved analyzing network traffic generated when users visited various popular websites. The unique sequence and volume of packets, combined with their precise timing, allowed researchers to create profiles for specific sites. When these profiles were compared against encrypted traffic, it became possible to identify the visited sites with a notable degree of accuracy. This vulnerability underscores a critical limitation of current encryption practices, where the focus has largely been on content confidentiality, sometimes overlooking the privacy implications of metadata and traffic characteristics. For organizations and individuals relying on encrypted DNS for enhanced privacy, these findings present a challenge. While the content of DNS requests is indeed protected, the mere act of observing network flow can compromise anonymity. The implications are particularly significant for users in environments where network surveillance is prevalent, as it suggests that even with encrypted protocols, a determined adversary could still build a profile of online activities. To address this privacy gap, researchers have proposed several mitigation techniques. One approach involves the use of header elision and length equalization, which aim to standardize packet sizes and obscure the natural variations that contribute to unique traffic fingerprints. Another suggested method is to introduce more unpredictable timings in packet transmission. While such techniques might be challenging to implement in all scenarios, especially in latency-sensitive IoT deployments, they are considered viable in less constrained environments where operators control both ends of a compression hop. The research team has made their data, code, and results publicly available to facilitate further study and development in this area.