Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Big ISPs aren’t happy about Google’s plans for encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

81–90 of 456 posts

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#81

Post by tptacek »

cyphar wrote: post #43
tptacek wrote: post #35

Earlier quoted context omitted.

If your PiHole servers a DoH endpoint, you're probably back to exposing plaintext DNS to your ISP. The whole point of DoH is to tunnel DNS out of your untrusted ISP network to anywhere else in the world where it can be trusted more. What is the case, however, is that you could set up a DoH endpoint on some other network and route your DNS there.

Why can't the PiHole create it's own DoH connection upstream? Y'know, the most classic way of doing a MitM on encrypted traffic?

Oh, it totally can, and there's nothing wrong with that. I would just hate for someone to terminate DoH on their home network and expose direct-to-the-roots DNS to their ISP, which is, if anything, marginally more attributable than normal ISP DNS. I'm definitely not talking down the idea of doing a PiHole setup.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#82

Post by dcow »

kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

We agree that ISPs should not need to view your browsing data without your consent. But there are many technical reasons for an ISP to want to run DNS outside the resolver privacy conversation:

For one some ISPs run content filtering services. Some users prefer to concede extreme privacy for what they view as a safer browsing experience. It might not be your jam, but it exists.

DNS is designed to be provider independent. It literally does not matter if a Google or Cloudflare or OpenDNS or DNSFilter or your ISP resolves requests. It was designed this way so that the system could be distributed and so that there is not a single point of failure for the internet’s arguably most important system.

Its distributed nature means there are technical performance advantages to doing the above: reduced request latency, localized traffic routing and reduced bandwidth, etc. You don’t need a giant any cast network to serve DNS. You just need to use the servers closest to you.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#83

Post by tptacek »

daedalus_j wrote: post #67
olliej wrote: post #53

Earlier quoted context omitted.

DNS requests are transmitted in plaintext through the ISPs connections. Because DNS is not remotely secure there isn’t any reason they couldn’t simply redirect your selected DNS to their own, or replace “not found” responses with a link to their own advertisements. So without DoH an ISP knows everything you request, even if you have a different DNS server set, and if they really wanted to they can simply hijack any c…

It's a good point, but it is preventable by the network admin. For example, I bypass that by tunneling everything out over a VPN, and the local resolver attempts to use HTTPS to connect to upstream anyway. Obviously not every user is in a position to protect themselves in such a way, so I get why the browser is attempting to protect them. Just seems very wrong to me to take the control away from the user/network-admi…

If you're going to the trouble of VPN'ing your DNS, you're fine in the Chrome scenario and could I suppose reasonably just disable DoH everywhere. Your ISP absolutely does not want you to do this, but they don't want you DoH'ing either. DoH is, after all, just a VPN for DNS.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#84

Post by tptacek »

daedalus_j wrote: post #74
tptacek wrote: post #27

Earlier quoted context omitted.

Google's design doesn't ask you to trust Google more than you already do if you use Chrome. It doesn't default you to Google's DNS servers, will honor your current nameservers, and will upgrade you to DoH at any of those servers who support it. I'm honestly not sure what more you could ask for from Google on this particular issue.

So it's more like HSTS for DNS? Auto-switch to encryption if our chosen target supports encryption? Because that seems MUCH more sensible than a lot of the stories/comments about this recently make it seem.

No. The HSTS security model is per-site; the DoH model covers all sites. If you get DoH working anywhere, it's working for you everywhere.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#85

Post by 1over137 »

wbl wrote: post #18
tbyehl wrote: post #13

Earlier quoted context omitted.

Death to PiHole and every other DNS-based ad block and security system. At least, by Mozilla's plan.

Did you read their plan? Because you can block a certain domain to stop DoH resolution.

Perhaps I read too fast, but I didn't see that. What's the domain to block?

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#86

Post by beached_whale »

kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

Could be caching too. Bunch of services like youtube and netflix, at least used, use DNS to direct users to local servers. This enabled a better experience for the users and lowered the amount of bandwidth

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#87

Post by tptacek »

dcow wrote: post #82
kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

We agree that ISPs should not need to view your browsing data without your consent. But there are many technical reasons for an ISP to want to run DNS outside the resolver privacy conversation: For one some ISPs run content filtering services. Some users prefer to concede extreme privacy for what they view as a safer browsing experience. It might not be your jam, but it exists. DNS is designed to be provider independ…

This is a pretty silly debate. All you have to do is look at AT&T's DNS, see it hijack NXDOMAIN to send you to ad sites, and know that mainstream ISP DNS isn't trustworthy. We don't need to weigh up counterfactuals.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#88

Post by darklajid »

tomjakubowski wrote: post #38
nimbius wrote: post #16

Strange these isps seem to have entirely ignored pihole, which for me is blocking around 30% of my DNS queries and overrides ISP DNS servers entirely.

Your ISP, by virtue of supplying the pipe to the internet, can (and very likely does) still snoop on any old-fashioned plaintext DNS requests you make across it, even when you're not using their servers.

I might have misread the GP, but I kinda felt that it also brought up the issue that a pihole (or similar solutions) might cease to work in a "DoH / I automatically pick the best resolver if I deem yours not good enough" world.

DNS privacy is awesome. Filtering malicious and annoying (read: ads) content at the DNS level is mandatory for me..

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#89

Post by windexh8er »

everdrive wrote: post #52
z9e wrote: post #40

Earlier quoted context omitted.

They definitely are. I know for a fact that they are running massive Hadoop clusters storing information on DNS records involved in their customer traffic. If I recall correctly they mirror a lot of the traffic to analytics environments.

How do you know this fact?

I worked for a Comcast subsidiary in 2010-2011 timeframe. The company owned the network end to end. They had about 250k subscribers at the time across 4 states and at the time was the first DOCIS 3.0 network in the US. They were collecting DNS log data back then. I've been told that hasn't stopped and has progressed. Don't trust your ISP to not be passively monitoring. This particular ISP had closets full of old Sandvines [0] hardware as well that I ran across one day. I asked what the hardware had been used for and the answer was simply: "network monitoring for law enforcement". At the time all of that old gear had been decomm'd. But as I've said in older posts the DC had a hands off, tamper taped mobile rack that was plugged into core routing installed by a 3 letter agency while I was employed. This was pre-Snowden and post 9/11, likely courtesy of all those fun programs we found out about that Clapper denied.

[0] https://en.m.wikipedia.org/wiki/Sandvine

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#90

Post by dcow »

tptacek wrote: post #87
dcow wrote: post #82

Earlier quoted context omitted.

We agree that ISPs should not need to view your browsing data without your consent. But there are many technical reasons for an ISP to want to run DNS outside the resolver privacy conversation: For one some ISPs run content filtering services. Some users prefer to concede extreme privacy for what they view as a safer browsing experience. It might not be your jam, but it exists. DNS is designed to be provider independ…

This is a pretty silly debate. All you have to do is look at AT&T's DNS, see it hijack NXDOMAIN to send you to ad sites, and know that mainstream ISP DNS isn't trustworthy. We don't need to weigh up counterfactuals.

I’m not saying that some ISPs aren’t malicious. But to say there is no reason for an ISP to serve DNS is absurd.
Post reply on HN