Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Big ISPs aren’t happy about Google’s plans for encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

121–130 of 456 posts

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#121

Post by dcow »

shakna wrote: post #25
tbyehl wrote: post #13

Earlier quoted context omitted.

Death to PiHole and every other DNS-based ad block and security system. At least, by Mozilla's plan.

PiHole supports DoH [0], via the cloudflared daemon. This won't change anything. [0] https://docs.pi-hole.net/guides/dns-over-https/

This is incorrect. Mozilla is ignoring your os/dhcp configured server and using Cloudflare. Your PiHole no longer sees the traffic.

There is a way to configure your network to make Firefox not do this, so that's good. But it's not the default.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#122

Post by clatan »

kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

They do use that information, it's not necessarilly sketchy. They run analytics just like everyone else. In fact, one could argue Google's huge push for https was primarily motivated to deprive service providers of valuable data that Google has anyway.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#123

Post by [deleted] »

daedalus_j wrote: post #48
tptacek wrote: post #31

Earlier quoted context omitted.

If you're on a mainstream US ISP, interference from your browser with your ISP's "network level operations" is a privacy necessity. They're passively monitoring DNS to collect data on their customers and hijacking it to send users to advertising sites. ISP DNS is manifestly untrustworthy.

Well no, because my router is proxying DNS requests, and it's not to my ISP's DNS servers. (It's also serving a number of custom DNS records for internal/work stuff.) I don't understand how trading one ISP for another (Cloudflare?) is an improvement long-run. The system itself needs to be resilient, not just depend on the kindness of the upstream gods.

[deleted]

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#124

Post by dodobirdlord »

dangero wrote: post #57
dodobirdlord wrote: post #41

Earlier quoted context omitted.

Google's plans usually have carefully laid out technical justifications, and are mostly kinda boringly/obviously good, like QUIC/HTTP3. That you're usually skeptical of any plan coming from Google suggests that your skepticism is miscalibrated.

Google makes the majority of its revenue by knowing things about their users and then allowing them to be targeted with ads. Google's plans being usually "obviously good" is a highly subjective opinion.

And yet, most of Google's plans do not warrant skepticism.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#126

Post by dcow »

nathanlied wrote: post #120
dcow wrote: post #82

Earlier quoted context omitted.

We agree that ISPs should not need to view your browsing data without your consent. But there are many technical reasons for an ISP to want to run DNS outside the resolver privacy conversation: For one some ISPs run content filtering services. Some users prefer to concede extreme privacy for what they view as a safer browsing experience. It might not be your jam, but it exists. DNS is designed to be provider independ…

> Its distributed nature means there are technical performance advantages to doing the above: reduced request latency, localized traffic routing and reduced bandwidth, etc. You don’t need a giant any cast network to serve DNS. You just need to use the servers closest to you. My issue with this is that I've never been with an ISP that had a faster response time than Cloudflare/Google - and one would think they should,…

I'm taking issue at the hyperbolic nature of the comment. I'm not an ISP apologist. But to say there are zero technical reasons for an ISP to want to provide DNS is unfair and incorrect.

Cloudflare and Google pay ISPs for the latency they get, FWIW. If I made my own resolver service today I would not be able to compete with your ISP without forking over $$$.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#127

Post by evilsnoopi3 »

dcow wrote: post #72
daedalus_j wrote: post #24

I'm fine with encrypted DNS as long as it's from my router to the (encrypted) DNS provider of MY choice. Interference from browsers with network level operations is my real worry. As far as I'm concerned, as long as the browser speaks HTTPS to my router, and my router speaks HTTPS to the servers, no problem. I'm worried about the "to protect the users we've hijacked their DNS directly via the browser" possibility tho…

Exactly this. I build a DNS security product that works at the router level. Everything is secure on home networks running the product and it uses DoT for privacy so that ISPs can’t view your data—no browser intervention needed. Browsers interfering with user-configured defaults is incredibly presumptuous. I’m worried browsers are becoming less user-agent and more platform-agent...

Great. Now I've taken my laptop out of my house (where I'm using your router) to the coffee shop downstairs where they use an ISP provided gateway... And the ISP is spying on me again. Until DNS request is encrypted there are no solutions outside of a wholly self-managed network.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#128

Post by chrismorgan »

olliej wrote: post #53
daedalus_j wrote: post #48

Earlier quoted context omitted.

Well no, because my router is proxying DNS requests, and it's not to my ISP's DNS servers. (It's also serving a number of custom DNS records for internal/work stuff.) I don't understand how trading one ISP for another (Cloudflare?) is an improvement long-run. The system itself needs to be resilient, not just depend on the kindness of the upstream gods.

DNS requests are transmitted in plaintext through the ISPs connections. Because DNS is not remotely secure there isn’t any reason they couldn’t simply redirect your selected DNS to their own, or replace “not found” responses with a link to their own advertisements. So without DoH an ISP knows everything you request, even if you have a different DNS server set, and if they really wanted to they can simply hijack any c…

I encountered this in a local ISP in India in 2012: they were intercepting all DNS requests and forcibly using OpenDNS’s annoying NXDOMAIN advertising thing. When I returned in 2016 they’d stopped doing that. No idea if the technique is widespread.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#129

Post by dodobirdlord »

munk-a wrote: post #47
dodobirdlord wrote: post #41

Earlier quoted context omitted.

Google's plans usually have carefully laid out technical justifications, and are mostly kinda boringly/obviously good, like QUIC/HTTP3. That you're usually skeptical of any plan coming from Google suggests that your skepticism is miscalibrated.

I think you're being a bit over generous, the days of "Do no evil" have come and gone. Still, ISPs are definitely higher up on the evil-o-meter.

I don't think I'm being generous. Google's large scale plans are mostly about making the internet and technology ecosystem faster, safer, and more widely available. Of course, this is because their revenue scales as a factor of the number of people using the internet, the number of pages each person using the internet browses, and the willingness of people to spend money on the internet. But don't let the motive distract from the plans. Consider the plans on their own merits.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#130

Post by mulmen »

tidepod12 wrote: post #108
jdironman wrote: post #102

Earlier quoted context omitted.

He is speaking of the developers and engineers who have the technical expertise and should know it's a bad idea but still agree to implement it regardless of their moral compass.

Why the implication that devs/engineers who have such technical expertise "know it's a bad idea"? There are plenty of devs and engineers who would have no moral issue with mass data collection and analytics. You don't magically become a paragon of morality just because you got a CS degree. Just ask Zuckerberg.

To be fair Zuckerberg didn’t get a CS degree. Your point still stands of course.
Post reply on HN