Trang này chưa có bằng ngôn ngữ của bạn. Bạn đang đọc bản tiếng Anh.
Glossary
DNS leak
A DNS leak is your own machine asking which address a site has, while the visit itself goes out through a proxy.
Why a name leaves a trace
A browser cannot open a site by name alone, so something has to turn that name into a number. Whoever answers the question sees both the name and who asked it.
- 1
The name is looked up
Either your machine asks its own name server, or the request leaves with the name inside it.
- 2
The answer comes back
None of this is visible on the page, and the visit loads either way.
- 3
A record stays behind
Whoever answered keeps the name, the time and the address that came asking.
One way out for every scheme
A profile is given one proxy rule that covers every scheme, so the browser has a single way out and the request it sends carries the name of the site.
A proxy that cannot be turned into a usable rule stops the launch instead. Going out with your own address while the window claims otherwise is the one failure worth refusing over.
Your own server as the exit
A server you already rent can be the exit instead of a bought proxy. A tunnel is raised next to the profile, and the browser is handed a plain local address to use.
Names then travel to the far end of that tunnel and are answered there. With the tunnel down the launch refuses, rather than quietly going out direct.
What a leak test needs
A real test serves a name nobody has ever asked for and watches which name server comes asking for it. That takes a server on the far side, which is why a page in your browser cannot do it.
Our free check reads what this browser hands out during call setup. It says nothing about name resolution, and it does not pretend otherwise.
Often confused with
WebRTC leak
There the browser hands a page addresses from your own network. Different surface, different rule, separate check.
Encrypted DNS
Encryption hides the question from the network along the way. Whoever answers still reads the name and still knows who asked.
A VPN resolver
A VPN usually answers the questions itself. A browser behind a proxy is a different path, and the questions can keep going the old way.
What this does not do
- Our free leak check does not test DNS. It reads the addresses this browser hands out during call setup, and nothing about name resolution.
- It does not prove where a name was resolved. Proving that needs a server on the other side of the question, and this site does not run one.
- It does not change the resolver of your computer. Everything outside a profile keeps asking names the way it asked them before.
- A profile with no proxy leaves through your own address on purpose. There is nothing to separate then, and the profile page says so rather than hinting at it.
Check it
One rule, one refusal, one tunnel, and each of them is in a file you can open.
- One rule for every scheme, built where a profile launches
- apps/desktop/src/main/main.js
- The rule is executed here, and a scheme-only form fails the stand
- apps/desktop/test/proxy-covers-https.js
- A profile whose proxy cannot be used refuses to open
- apps/desktop/src/lib/forkEngine.js
- Your own server as the exit, tunnel and refusal alike
- apps/desktop/src/lib/sshTunnel.js · apps/desktop/test/выход-по-ssh.js
Questions
- Can a site see which name server I use?
- It can, by serving a name nobody has asked for and watching who comes asking. That takes a server on their side, not a script on the page.
- Is encrypted DNS enough?
- It hides the question from the network between you and the answer. Whoever answers still sees the name, and so does anyone they report to.
- Does the proxy resolve the names?
- The browser has one way out for every scheme, and the request it sends carries the name of the site rather than a number resolved at home.
- Does the app tell me my names are safe?
- The network check in the app tells you whether names resolve at all. Where they were resolved is a different question, and it does not answer that one.
- Does incognito help?
- No. Incognito clears storage, while a name is resolved below the window and leaves no page to clear.
Next to this
WebRTC leak
The addresses a browser hands out on its own, and the check for them.
Leak check
The addresses this browser hands out, read on the spot and sent nowhere.
Set a proxy for a profile
Where the address goes and where the password is kept.
Leave through your own server
A server you rent as the exit, with the tunnel raised for you.
Give every profile one way out
Install ARMANOS, put an address behind a profile, and a profile that cannot use its address refuses to open.