Gytis RepečkaAfter setting up DNS over HTTPS, got curious how DNS leak test tools, which discover your DNS resolver, such as Browser Leaks, work 
Turns out, it's quite clever setup: while you are visiting browserleaks.com website, in the background it queries a number of hostnames generated especially for you, such as 9d0pafrc5tnu.dns4.browserleaks.net, 0zfannouveb4.dns4.browserleaks.org and so on.
Because the website generates those hostnames specifically for your session, it is able to associate your external IP to the hostnames you attempt to resolve.
Now because site operators controls authoritative name servers behind those generated hostnames - specifically ns2.browserleaks.net and ns1.browserleaks.net (also with .org), from logs they can check what exact DNS resolver asked for those unique hostnames.
Simply matching a resolver DNS that attempted to resolve those unique hostnames is enough to link it to your visit of a website session - it is often going to be the resolver of your internet service or virtual private network provider, unless you've explicitly changed your resolver to something else. Still, easily visible to authoritative DNS server.
Voila! No magic, just simple, nice setup 
Just think of how many fingerprinting schemes can big techs carry out to track you across the internet with vast compute resources available to them... 
#itsalwaysdns #dns #resolver #dnsleak #survelliance #tracking #privacy
Gytis Repečka (@[email protected])
Setting up DNS over HTTPS (DoH) is so much more complicated than DNS over TLS (DoT) :blobcatthinking: Funny enough Mozilla Firefox :firefox: supports DoH and sets it up on application level, while Android :android: uses DoT on operating system level :blobcatnerd: #itsalwaysdns #dns #dot #doh #sysadmin #linuxadmin
Gea-Suan Lin
Andrew 🏳️🌈 🖥 🧦
Piotrek Jeremicz
Bryan Legazzy
Techdirt
Pontiff Fractal Tiam
Hacker News
GD
Andreas Sikkema