Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Big ISPs aren’t happy about Google’s plans for encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

141–150 of 456 posts

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#141

Post by aussieguy1234 »

beached_whale wrote: post #86
kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

Could be caching too. Bunch of services like youtube and netflix, at least used, use DNS to direct users to local servers. This enabled a better experience for the users and lowered the amount of bandwidth

They also used this method to block region restricted content. Here in Aus Foxtel has a monopoly on all the good shows, they charge >$100 per month if you want access to everything on their crappy, ageing cable tv network. After Netflix blocked the vpn workaround, alot of people went back to torrenting

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#142

Post by judge2020 »

dcow wrote: post #126
nathanlied wrote: post #120

Earlier quoted context omitted.

> Its distributed nature means there are technical performance advantages to doing the above: reduced request latency, localized traffic routing and reduced bandwidth, etc. You don’t need a giant any cast network to serve DNS. You just need to use the servers closest to you. My issue with this is that I've never been with an ISP that had a faster response time than Cloudflare/Google - and one would think they should,…

I'm taking issue at the hyperbolic nature of the comment. I'm not an ISP apologist. But to say there are zero technical reasons for an ISP to want to provide DNS is unfair and incorrect. Cloudflare and Google pay ISPs for the latency they get, FWIW. If I made my own resolver service today I would not be able to compete with your ISP without forking over $$$.

Do peering agreements usually have money exchanged if they're already both at the same IX?

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#143

Post by comex »

daedalus_j wrote: post #67
olliej wrote: post #53

Earlier quoted context omitted.

DNS requests are transmitted in plaintext through the ISPs connections. Because DNS is not remotely secure there isn’t any reason they couldn’t simply redirect your selected DNS to their own, or replace “not found” responses with a link to their own advertisements. So without DoH an ISP knows everything you request, even if you have a different DNS server set, and if they really wanted to they can simply hijack any c…

It's a good point, but it is preventable by the network admin. For example, I bypass that by tunneling everything out over a VPN, and the local resolver attempts to use HTTPS to connect to upstream anyway. Obviously not every user is in a position to protect themselves in such a way, so I get why the browser is attempting to protect them. Just seems very wrong to me to take the control away from the user/network-admi…

> Delete HTTP from the browser entirely, right?

It’s not being deleted, but Chrome at least has been gradually phasing in a warning in the address bar whenever you visit an HTTP site. [1] (Firefox will apparently do the same starting soon.) I wouldn’t be surprised if the warning UIs get more aggressive a few years down the line, as HTTPS adoption continues to increase.

[1] https://blog.chromium.org/2018/05/evolving-chromes-security-...

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#144

Post by turdnagel »

dcow wrote: post #121
shakna wrote: post #25

Earlier quoted context omitted.

PiHole supports DoH [0], via the cloudflared daemon. This won't change anything. [0] https://docs.pi-hole.net/guides/dns-over-https/

This is incorrect. Mozilla is ignoring your os/dhcp configured server and using Cloudflare. Your PiHole no longer sees the traffic. There is a way to configure your network to make Firefox not do this, so that's good. But it's not the default.

People who bother to set up a PiHole almost certainly know how to change DNS settings on their (and their family members') browsers.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#145

Post by judge2020 »

viraptor wrote: post #96
dcow wrote: post #82

Earlier quoted context omitted.

We agree that ISPs should not need to view your browsing data without your consent. But there are many technical reasons for an ISP to want to run DNS outside the resolver privacy conversation: For one some ISPs run content filtering services. Some users prefer to concede extreme privacy for what they view as a safer browsing experience. It might not be your jam, but it exists. DNS is designed to be provider independ…

ISPs are still able to run their filtering version of DNS server which the users are able to opt into. Nobody is going to take this away from them. But that is not a valid use case for filtering dns requests to other services.

I'd separate "valid" and "reasonable". UK ISPs have a "valid" reason to DPI DNS and block pornhub, but i wouldn't say its reasonable for them to mess with internet packets not destined for their network. Thankfully DoH pressures them to suck it up and accept that blocking needs to be done by parents via parental controls.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#146

Post by BLKNSLVR »

ggm wrote: post #6

In many economies, ISPs have legal immunity from acts done by users (customers) because of laws associated with 'common carrier' status. But that status is fragile. The ISP has to act like it knows its obligations in law, and there are things ISPs have been doing to work with LEA for a long long time, which they won't be able to do as simply, or as well, or in some cases at all. As a customer its easy to assume the o…

The fact that an ISP can snoop customers' data and DNS requests is a side-effect of their business. I don't buy any of the 'responsibility to law enforcement' argument at all, for a number of reasons but the one pertinent to this issue is that privacy legislation is about 30-years out of date - and it's basically this legislation-lag that's the loophole allowing ISPs to do whatever they want with the data.

And it's legislation that no Government is in any hurry to amend because it serves their purposes in maintaining the façade of 'keeping our citizens safe'.

Additionally, this statement is almost entirely the opposite of my understanding. DoH ENSURES that ISPs cannot be held responsible at least for the DNS content since they cannot see it for technical reasons:

TL;DR DoH and DoT are challenging established law in telecoms and big ISPs who have common-carrier defence depend on interception in DNS and DPI and the like, to perform their role facing LEA demands from the state which in many cases are entirely normal and justified

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#147

Post by frio »

_lqaf wrote: post #131
gnu8 wrote: post #75

Earlier quoted context omitted.

I wonder why someone who knows how to do any of that, would think it is a good idea or go along with implementing that. The shitbirds who actually want to do this type of thing are not smart enough to execute it.

Engineers are people who come in all ethical flavors. I used to know one whom I consider evil, in the actively, knowingly malicious sense. I've known a whole lot more who generally just don't think about these questions. Thinking knowledge, intelligence or capability correlates with ethics is a category error.

It's more an industry error, I suspect. The University I went to forced all the Software Engineers to do some of the traditional Engineering papers, including courses on ethics. The professional institute that accredits the University's ability to call their course an Engineering course required those courses.

Courses like that don't fix unethical people, but they make the rest of us aware that ethical concerns exist. Software/Computer Science is such a young discipline that, industry-wide, I don't think we've learnt that one from the other industries yet.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#148

Post by judge2020 »

GeekyBear wrote: post #91
rgbrenner wrote: post #65

Earlier quoted context omitted.

Yes, Google used the right approach here. They honor your DNS settings, and upgrade it if it's available. Firefox, on the other hand, plans to force all of their users to trust Cloudflare by default.. and most users won't even know they made that change.

>Firefox, on the other hand, plans to force all of their users to trust Cloudflare by default.. and most users won't even know they made that change. Mozilla has explicitly stated on their blog that they don't intend to make any change to a user's DNS settings without getting the user's consent. >When DoH is enabled, users will be notified and given the opportunity to opt out https://blog.mozilla.org/futurereleases/2…

This is something I really think should be opt-in, even if it's via a notification toast.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#149

Post by ryukafalz »

clatan wrote: post #122
kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

They do use that information, it's not necessarilly sketchy. They run analytics just like everyone else. In fact, one could argue Google's huge push for https was primarily motivated to deprive service providers of valuable data that Google has anyway.

>They do use that information, it's not necessarilly sketchy. They run analytics just like everyone else.

First of all, I think the extent of the data collection that many companies engage in is sketchy.

That aside, if a website runs analytics that you don't like, you can stop using it. There are usually alternatives, if you're willing to give up some convenience. But if your local ISPs are monitoring you, not using the internet isn't really an option these days.

I really wish we didn't have to treat our ISPs as adversaries in that regard, but we've been at that point for a while.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#150

Post by belltaco »

kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

It used to be illegal for ISPs to use web browsing data for advertising purposes but the Republican House, Senate and President passed a law allowing them to make it an opt-out.

https://arstechnica.com/tech-policy/2017/03/for-sale-your-pr...

Post reply on HN