Beru Learning

When you place an order or view account balances in a browser or desktop trading app, the session contents are protected by Transport Layer Security (TLS). But basic web traffic still exposes connection metadata. You can protect retail trading privacy with DoH (DNS-over-HTTPS) and Encrypted Client Hello (ECH) to prevent local network observers and internet providers from cataloging the brokerages you use.

Without these protections, network operators, hotel Wi-Fi administrators, and Internet Service Providers can record the trading domains you reach, the frequency of your visits, and the timestamps of your market data feeds.

The Two Invisible Leaks in Standard HTTPS

The lock icon in a browser confirms that page contents are encrypted. However, standard connections leak two critical pieces of metadata during setup:

Plaintext DNS Queries: Before reaching a broker, the computer asks a DNS resolver for the server's IP address. Standard DNS sends this request in plaintext over UDP port 53.
Server Name Indication (SNI): During the TLS handshake, your machine sends the destination domain name in clear text so the hosting server presents the right certificate.

Anyone observing your local link or upstream connection can use these two leaks to log which brokerages you visit and when you place trades.

How DNS-over-HTTPS Encrypts the Name Lookup

DNS-over-HTTPS routes domain queries over an encrypted HTTPS connection using TCP port 443. Instead of sending an open DNS broadcast, your computer sends the request inside an encrypted tunnel.

This mechanism provides two defenses:

Snoop prevention: Observers on your local network or ISP see standard HTTPS traffic instead of plain DNS queries containing your broker's domain name.
Tamper resistance: Local routers cannot alter DNS responses or route traffic to spoofed IP addresses intended for phishing.

Closing the Final Gap with Encrypted Client Hello (ECH)

DoH secures the initial lookup, but the destination domain can still leak via the SNI field in the TLS handshake. Encrypted Client Hello (ECH), introduced in TLS 1.3, resolves this.

ECH divides the handshake into an outer packet and an inner packet. The outer handshake carries a generic public server name, while the inner handshake contains the actual destination and is encrypted using a public key published by the host. Only the destination server can decrypt the inner packet. An observer monitoring network traffic sees only a connection to a shared content delivery network or hosting provider.

Practical Configuration for Trading Workstations

Turning on these protections requires changes in your operating system and browser:

Enable Secure DNS: In your browser or OS network settings, select an encrypted DNS resolver using strict mode.
Activate TLS 1.3 and ECH: Modern browsers support ECH, though some require enabling an experimental flag. Test your setup using a cryptographic network test page.
Bypass Local Router DNS: Configure your machine's network adapter to use an encrypted DNS provider directly instead of the DNS server assigned by local DHCP.

FAQ

Does using DoH and ECH hide my IP address from my brokerage?

No. The broker still sees your public IP address to process orders and run fraud checks. These tools protect your traffic from observers on the network between you and the broker.

Will DNS-over-HTTPS increase trading latency?

The initial DNS lookup can add a few milliseconds to the first connection. After the connection opens, persistent TCP sessions handle order traffic without added delay.

Is DoH the same thing as a Virtual Private Network (VPN)?

No. A VPN routes all device traffic through an intermediary server, which changes your outward IP address. DoH only encrypts domain name lookups and does not alter how data packets travel to the destination.

Key Takeaways

Standard HTTPS exposes destination domains via cleartext DNS queries and the SNI field.
DNS-over-HTTPS hides DNS requests inside encrypted port 443 traffic.
Encrypted Client Hello encrypts the SNI header in the TLS 1.3 handshake.
Using DoH and ECH together prevents ISPs and local network admins from logging your broker visits.
These tools do not hide your IP address from the platform you log into.

DNS-over-HTTPS and Encrypted Client Hello: Shielding Retail Trading Privacy