From 00b19dc34e662b80e1e9a6b70bfcf7ee32d72db3 Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Fri, 5 Jun 2020 01:31:41 -0400 Subject: [PATCH] add notes on fingerprinting via DNS / ad-blocking --- static/faq.html | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/static/faq.html b/static/faq.html index 467e574d..b537f826 100644 --- a/static/faq.html +++ b/static/faq.html @@ -531,7 +531,13 @@

VPN service apps can also provide their own DNS implementation and/or servers, including an alternate implementation of encrypted DNS. Private DNS takes precedence - over VPN-provided DNS and using Private DNS is still recommended with a VPN.

+ over VPN-provided DNS, since it's just the network-provided DNS.

+ +

Apps and web sites can detect the configured DNS servers by generating random + subdomains resolved by querying their authoritative DNS server. This can be used as + part of fingerprinting users. If you're using a VPN, you should consider using the + standard DNS service provided by the VPN service to avoid standing out from other + users.

Why does Private DNS not accept IP addresses? @@ -641,6 +647,12 @@ included by the project many years ago, but it needs to be reimplemented, and it's a low priority feature depending on contributors stepping up to work on it.

+

Apps and web sites can detect that ad-blocking is being used and can determine + what's being blocked. This can be used as part of fingerprinting users. Using a widely + used service like AdGuard with a standard block list is much less of an issue than a + custom set of subscriptions / rules, but it still stands out compared to the default + of not doing it.

+

Are ad-blocking apps supported?