Sure, but they could also study DNS traffic if they wanted to. Or at least, with Cloudflare's cooperation. If you want privacy, you never do DNS queries from an ISP-assigned IP address. Tor exits do DNS queries on behalf of clients. Decent VPN services also handle DNS queries for clients.
They don’t get raw DNS traffic. Ever.
Will they at least get processed information about the DNS traffic (like how much of it is normal recursive queries versus broken garbage which happened to go to port 53)?
I've seen some of the papers where people look at big chunks of unused address space and watch the probes etc. It is really quite amazing. Once I screwed myself royally by accidentally turning RIP on for the upstream side of my router (connected to the cable modem) and it advertised 192.168/16 which Comcast accepted and started routing random stuff from the local exchange to my router. It was pretty funny talking to…
Wow I’m surprised. That is such a low barrier to doing your own BGP hijackig.
Well, not really. It doesn't mean that Comcast was re-advertising it into BGP and also advertising it to their peers. Usually you use a combination of prefix-list filtering and route tagging so you don't advertise garbage to your peers.
RIP and other IGP protocols do not need to have their neighbors explicitly configured, they will find neighbors automatically on enabled interfaces. On some platforms they are enabled on all interfaces by default so it will form neighbor relationships with anything connected. A sane network design would be to only enable it on interfaces connected to your own routers (or customer interface, but on a different process ID) and also use a password.
It was reworded enough times to make their promise vague and not well defined.
I’m Cloudflare’s CEO. What questions do you have? I’ll start: do we ever store 1.1.1.1’s users’ IPs? No. They’re never written to disk. And APNIC never has access to them. What data do you provide to APNIC? We give APNIC reports on non-DNS data that’s hitting 1.1.1.1. It includes information like: what protocols are sending data to the IP, what’s the volume, where it it coming from? For DNS users of 1.1.1.1, we never…
Does APNIC get a sample of the raw packets of non-DNS and non-HTTP/HTTPS/QUIC protocols, so they can figure out what they actually are and why they're being sent towards that network?
If your ISP doesn't support IPv6, just try sending RA packets upstream and see what happens. If they're doing it wrong using blacklist instead of whitelist, then it might well leak. It's good to notice, that this doesn't affect IPv4 networking in any way.
If your ISP doesn't support IPv6, just try sending RA packets upstream and see what happens. If they're doing it wrong using blacklist instead of whitelist, then it might well leak. It's good to notice, that this doesn't affect IPv4 networking in any way.
I'm not a networking guy, but I'd like to try this. Can you explain how you would do it? (which tools, or a link to some docs would be nice)
Using radvd [1] is the easiest way with Linux. Or you can get it done using ICS on Windows. Personally I used burner laptop, with live distribution and runned radvd. Or if you like details, you can use Python Scapy on Linux to send RA packets. [1] http://www.litech.org/radvd/
No, wait. Users of the DNS service get the privacy guarantee. Non-users do not. If you floodping 1.1.1.1 you are not a user of the DNS service and the privacy terms don't apply to you. Rather you're a member of the Misconfiguration Club, and the site you're pinging has the usual right to analyse your pings.
What if somebody has a bad DNS resolver and what he qualifies as a valid DNS request, researchers do not. I get the general idea, but having "user-privacy oriented" and "we collect everything and make it available to many researchers" services under the same IP may lead to some issues.
Even a bad DNS resolver will still send to port 53. The privacy policy probably applies to anything on ports 53, 80, and 443.
>they can’t query anything on a specific user. What exactly do you mean by "user"? Can they query DNS traffic by IP address / subnet? Exactly what are all of the restrictions there? EDIT: Is there a whitelist of things they can query by or do you simply trust them to be good citizens, have a binding legal agreement, all of the above?
No. We have a legally binding agreement. And, more importantly, we don’t store or give them access to IPs or anything else that may be associated with any individual. Look at a DNS query, look at what could be identifying — let us know where concerns are. My hunch is we’ve thought of it. If not, we will fix. We don’t want personally identifiably info. It creates a legal risk for us. We purge it as quickly as we can.
We don’t want personally identifiably info. It creates a legal risk for us. We purge it as quickly as we can.
Ding ding ding, we have a winner. If more people would realize this, we would have less data breaches. To get there, a data breach must become more costly for the companies.
> AT&T Gigapower using 1.1.1.1 on an internal interface on at least one model of router-gateway, the Pace 5268AC Yup. I can't use 1.1.1.1 because my AT&T router is responding to it.
Ohh I see! I tested ping to 1.1.1.1 and the latency was less than 1ms I was surprised, now I see why. Funny :)
A German podcaster who has been working on networks for decades once said that he owns a large chunk of public IP addresses in the 192.68.0.0/16 subnet and it's impossible for him to use it because once he activates it he basically gets a DDOS of misdirected traffic. So many misconfigured networks out there...
I solidly feel it’s a cop out for an ISP to not filter their traffic to block spoofed IPs. In my eyes, there’s zero legitimate reason that this guy should get flooded, but alas, our industry gets lazier and more careless each year.