(How to) Check if your browser uses Secure DNS, DNSSEC, TLS 1.3, and Encrypted SNI

[Karlston]

Cloudflare's Browsing Experience Security Check online tool tests the capabilities of the web browser in regards to certain privacy and security related features.

 

For a subset of Internet users, privacy is of uttermost importance. While the majority seems indifferent, some try their best to implement protective mechanisms to eliminate or at least reduce what companies and maybe even State actors may find out about them when they use the Internet.

 

Whether that is successful or not depends on the program used to connect to Internet sites, e.g. a browser or media client, and also the system configuration.

 

The push to using HTTPS on the Internet ensured that much of the data that is transferred between a user's browser or program and Internet sites is encrypted. New technologies, such as Secure DNS or Cloudflare's own encrypted Server Name Indication (SNI) are designed to address leaks caused by DNS queries.

Browsing Experience Security Check

 

Browsing Experience Security Check tests a web browser's capabilities in regards to security and privacy features.

 

Note: The test is maintained by Cloudflare; the company designed Encrypted SNI which the test checks for among other things.

 

The test is straightforward: connect to the test page using your browser and hit the run button on the page to run the test.

 

It tests whether Secure DNS, DNSSEC, TLS 1.3, and Encrypted SNI are enabled. Here is a short description of each of the features:

• Secure DNS -- A technology that encrypts DNS queries, e.g. looking up ghacks.net to retrieve the IP address. Two standards, DNS-over-TLS or DNS-over-HTTPS fall under the category.
• DNSSEC -- Designed to verify the authenticity of DNS queries.
• TLS 1.3 -- The latest version of the TLS protocol that features plenty of improvements when compared to previous versions.
• Encrypted SNI -- Server Name Indication, short SNI, reveals the hostname during TLS connections. Anyone listening to network traffic, e.g. ISPs or organizations, may record sites visited even if TLS and Secure DNS is used. Encrypted SNI encrypts the bits so that only the IP address may still be leaked.

The only browser that supports all four of the features at the time is Firefox. Two of the features are still in development and testing though:

 

You may check out our Secure DNS setup guide for Firefox here. Here is a short list of instructions on setting up Secure DNS and Encrypted SNI in Firefox:

1. Load about:config in the Firefox address bar.
2. Confirm that you will be careful.
3. Encrypted SNI: Search for network.security.esni.enabled and toggle the value to True
4. Secure DNS: Search for network.trr.mode and set it to 2.  Search for network.trr.uri and set it to https://mozilla.cloudflare-dns.com/dns-query

Note that Secure DNS supports other servers if you don't want to use Cloudflare for that.

 

Source: Check if your browser uses Secure DNS, DNSSEC, TLS 1.3, and Encrypted SNI (gHacks - Martin Brinkmann)

[Cereberus]

just wondering but how exactly are you suppose to configure PIA VPN dns. should it be using PIA DNS, or ideally the 1.1.1.1  /1.0.0.1 ?

https://www.privateinternetaccess.com/archive/forum/discussion/comment/54697/#Comment_54697

 

because when i ran the leak test it says dns is leaking. router is alrdy using 1.1.1.1 but desktop PIA VPN app is using PIA DNS.

 

but i'm not sure if setting the PIA VPN dns to use 1.1.1.1 is the correct setting or not when using PIA VPN. any thoughts?

 

 

i also tried setting up firefox (yes because chrome can't get fully supported based on the site test), but then the test site wouldn't load at all as connection refused. Maybe because the dns issue was not resolved at the time because it failed? not sure what else it could be.

 

router using latest rt merlin FW.

 

 

also found this

https://www.privateinternetaccess.com/helpdesk/news/posts/january-2019-dns-leak-vulnerability

 

https://www.privateinternetaccess.com/helpdesk/kb/articles/private-internet-access-dnscrypt

 

https://www.reddit.com/r/PrivateInternetAccess/comments/a6iruj/pia_and_dns_question/

 

 

 

running this other test, i don't see any leaks though

https://ipleak.net/

 

 

 

[straycat19]

On 4/29/2019 at 12:22 PM, Karlston said:

Cloudflare's Browsing Experience Security Check online tool tests the capabilities of the web browser in regards to certain privacy and security related features.

 

6 hours ago, Cereberus said:

just wondering but how exactly are you suppose to configure PIA VPN dns

 

If you read the information posted on Cloudflare's site, it really doesn't make any difference if  your browser is secure or not.

 

Quote

Even if you pass all four tests, the domain you are visiting also needs to support these technologies. If the domain you visit doesn't support DNSSEC, TLS 1.3, and Encrypted SNI, you are still potentially vulnerable, even if your browser supports these technologies.