Wow. As long as they don't try to do it for https which is probably impossible unless some major flaw is found or you install some plugin. I think in 2016, installing software for an ISP is so outdated, reminds me of AOL and if they went that route I doubt they'd be able to even write software/plugins for all the devices people use such as iOS. It'd basically be spyware.
I do know though with my ISP DNS, I do get ads and search like results on domains where DNS doesn't resolve, but with Google DNS that never happens :)
HTTPS doesn't encrypt the SNI information so Comcast can still tell what sites you're visiting. They can also sniff all your DNS traffic even if it's going to Google's DNS server. DNSoTLS is not deployed anywhere except in testing at this point.
So does that mean if a rogue ISP wanted to, they could serve up Twitter.com on their internal network and return their fake DNS record instead assuming the user's cache expired?
Kinda like a man in the middle but at the DNS level... Only problem is pretty much every, if not all SSL cert company requires domain verification. So they couldn't probably easily fake the SSL part for Twitter.
With DNS encryption your ISP still sees IPs correct? Then it can do reverse DNS lookup. Then it can also serve whatever it wants on said IP.
When I write in browser twitter.com/give-me-lots-of-pr0n does it first connect with twitter.com's port 80 and sends an unencrypted GET request with /give-me-lots-of-pr0n to receive redirect to https://twitter.com/?
> When I write in browser twitter.com/give-me-lots-of-pr0n does it first connect with twitter.com's port 80 and sends an unencrypted GET request with /give-me-lots-of-pr0n to receive redirect to https://twitter.com/?
Probably not, in this case, because Twitter has implemented HSTS[1], and are[2] in a list that comes with your browser that specifies never to connect to the site unencrypted. If they're in the browser list, your browser will never actually connect on port 80; it will silently redirect client-side to HTTPS.
I do know though with my ISP DNS, I do get ads and search like results on domains where DNS doesn't resolve, but with Google DNS that never happens :)