Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Big ISPs aren’t happy about Google’s plans for encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

61–70 of 456 posts

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#61

Post by maratd »

zamadatix wrote: post #46
maratd wrote: post #42

Earlier quoted context omitted.

> Actually everyone should prefer the other guy do it rather than host it themselves. This isn't true. If you're hosting it, you can control it and you can make sure that it's always operational. The last thing you want is a 100 phone call of "my internet isn't working" and then trying to explain it's not your fault, but rather it's "some other guy".

If Google/Cloudflare are having significant issues resolving DNS everybody is getting a call anyways.

Not sure I understand. If you're using your ISP's DNS service, majority of your requests are going to hit their cache. You shouldn't notice any downtime as long as the cache doesn't expire.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#62

Post by jnwatson »

btgeekboy wrote: post #54

Something I’ve wondered: It isn’t quite clear from the various articles how they’re doing this monitoring. I can totally see how they could monitor their own caching resolvers. They might even passively monitor popular internet resolvers (1.1.1.1, 8.8.8.8). But if I run my own caching resolver at home, is that data being mined? I am aware it’s unencrypted and possible to do so, but is it actually happening? DoH sound…

Your resolver still makes DNS requests that the ISPs snoop. Unless that connection is encrypted, they have the same info as if you used the ISP’s servers.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#63

Post by nemonemo »

kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

Could the collected DNS info be used for their own proprietary investment? I was reading a book about Koch industries and it made me think about the potential that most of the infrastructure companies could have outsized profit out of the derivative investment based on the information gathered from the business they are better known at.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#64

Post by undersuit »

olliej wrote: post #22
kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

We already know they do - they’ve injected ads + “suggestions” instead of dns failures in the past. They’ve also injected permanently unique cookies in http requests. ISPs can’t be trusted as dumb pipes, they’re closer to “clueless criminal” pipes. But I agree with you, I don’t particularly trust google either.

I still have something like 15 Spectrum Bogus NXDomains blacklisted on OpenWRT. When I set it up the page they were redirecting too was still the Charter page with a half done Find/Replace of Charter/Spectrum.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#65

Post by rgbrenner »

tptacek wrote: post #27
olliej wrote: post #22

Earlier quoted context omitted.

We already know they do - they’ve injected ads + “suggestions” instead of dns failures in the past. They’ve also injected permanently unique cookies in http requests. ISPs can’t be trusted as dumb pipes, they’re closer to “clueless criminal” pipes. But I agree with you, I don’t particularly trust google either.

Google's design doesn't ask you to trust Google more than you already do if you use Chrome. It doesn't default you to Google's DNS servers, will honor your current nameservers, and will upgrade you to DoH at any of those servers who support it. I'm honestly not sure what more you could ask for from Google on this particular issue.

Yes, Google used the right approach here. They honor your DNS settings, and upgrade it if it's available. Firefox, on the other hand, plans to force all of their users to trust Cloudflare by default.. and most users won't even know they made that change.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#66

Post by Spivak »

daedalus_j wrote: post #50
shakna wrote: post #29

Earlier quoted context omitted.

Chrome's design attempts to use your current DNS settings to access a DoH resolver and fallsback to the current behaviour if it fails. The browser isn't interfering in any of your network operations.

So, assuming my local LAN DNS resolver, which serves my own custom DNS information to LAN clients, doesn't support DoH itself, but uses DoH to reach out to the authoritative servers, chrome will bypass this my local resolver? Sounds like interfering with the way my intranet operates to me.

Chrome doesn’t know that your local intranet is trusted or that the local resolver is trustworthy. You need to tell Chrome this by flipping a switch to either change your DoH provider or disable it all together.

This change is explicitly protecting users from malicious network operators. Since you control the endpoints it should be no big deal, you apply GPO, run Puppet, whatever and everybody is talking to your local DNS again but it is absolutely right to not trust local unencrypted DNS by default for every network you connect to.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#67

Post by daedalus_j »

olliej wrote: post #53
daedalus_j wrote: post #48

Earlier quoted context omitted.

Well no, because my router is proxying DNS requests, and it's not to my ISP's DNS servers. (It's also serving a number of custom DNS records for internal/work stuff.) I don't understand how trading one ISP for another (Cloudflare?) is an improvement long-run. The system itself needs to be resilient, not just depend on the kindness of the upstream gods.

DNS requests are transmitted in plaintext through the ISPs connections. Because DNS is not remotely secure there isn’t any reason they couldn’t simply redirect your selected DNS to their own, or replace “not found” responses with a link to their own advertisements. So without DoH an ISP knows everything you request, even if you have a different DNS server set, and if they really wanted to they can simply hijack any c…

It's a good point, but it is preventable by the network admin. For example, I bypass that by tunneling everything out over a VPN, and the local resolver attempts to use HTTPS to connect to upstream anyway. Obviously not every user is in a position to protect themselves in such a way, so I get why the browser is attempting to protect them.

Just seems very wrong to me to take the control away from the user/network-admin in any way. I mean, if you're gonna do it, go whole-hog. Delete HTTP from the browser entirely, right? I don't think that would go over well either, although it could certainly be justified by the same logic.

Maybe I'm misunderstanding something about the issue, there has been a fair bit of FUD, but I simply don't feel good about the browser taking authority outside it's "please render this code into a webpage" scope.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#68

Post by gruez »

rgbrenner wrote: post #65
tptacek wrote: post #27

Earlier quoted context omitted.

Google's design doesn't ask you to trust Google more than you already do if you use Chrome. It doesn't default you to Google's DNS servers, will honor your current nameservers, and will upgrade you to DoH at any of those servers who support it. I'm honestly not sure what more you could ask for from Google on this particular issue.

Yes, Google used the right approach here. They honor your DNS settings, and upgrade it if it's available. Firefox, on the other hand, plans to force all of their users to trust Cloudflare by default.. and most users won't even know they made that change.

[deleted]

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#69

Post by slig »

nimbius wrote: post #16

Strange these isps seem to have entirely ignored pihole, which for me is blocking around 30% of my DNS queries and overrides ISP DNS servers entirely.

There are a small number of people running anything of that sort vs the billions running Chrome.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#70

Post by zamadatix »

sologoub wrote: post #59
zamadatix wrote: post #32

Earlier quoted context omitted.

Actually everyone should prefer the other guy do it rather than host it themselves. Either way the bits have to be transported to the same colocated facilities it's a matter of who has to pay for and operate the servers. At least Cloudflare has KPMG audit them on their privacy claims. Better than nothing.

Tried searching, but couldn’t find a report by KPMG. Has one been produced already or is this a future thing? Regardless, impressive step to take.

That's a good question, they said it would happen annually so they should have had one by April 1st 2019. I put a question into support, we'll see if it goes anywhere.
Post reply on HN