Big ISPs aren’t happy about Google’s plans for encrypted DNS • Hacker News Board

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#221

Post by sdfgh2019 » Wed, Oct 02, 2019, 5:38 AM UTC

zchrykng wrote: post #170

dodobirdlord wrote: post #124

Earlier quoted context omitted.

And yet, most of Google's plans do not warrant skepticism.

Everything warrants skepticism until proven otherwise. Especially things that are being given out for free. Google might be operating on the up and up, but Google is just a large collection of people and some of them will be ethically lacking. And Google's employees have a large incentive to not see any issues with collecting all the personal information that exists.

Disclaimer: I work at Google.

> And Google's employees have a large incentive to not see any issues with collecting all the personal information that exists.

I can only speak from personal experience. But I would not agree.

Collection of data needs to be covered in a privacy document. You must argue why you're collecting it. There has to be a retention plan, such that data is purged when the user account is deleted, and/or the data expires over time.

You can of course get exemptions, IF there is a valid business reason. But all of this needs to be reviewed and approved by privacy people.

If you want to get things done. The paperwork is a strong incentive to avoid keeping data you don't need.

Note. privacy reviews cover more than I mentioned here. This was just a highlight.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#222

Post by mindslight » Wed, Oct 02, 2019, 5:52 AM UTC

tptacek wrote: post #218

mindslight wrote: post #212

Earlier quoted context omitted.

For privacy, getting records signed is ultimately more long-term important than getting queries encrypted immediately. As DoH shows, bolting on transport layer security is trivial. For example, you'd never want to set your DoH resolver to an arbitrary TOR hidden service. But there would be no problem querying DNSSEC through TOR (assuming the setup wrapped the server-server protocol in something that allowed such forw…

What a strange argument. If you want to argue that Tor is superior to DoH, argue that. DNSSEC has nothing to do with it. Which, of course, is obvious: DNSSEC is passively observable by design.

I'm not arguing TOR is "superior" - rather it just demonstrates a use of not needing to trust an upstream. It's also another datapoint for how easy it is to bolt on transport security.

The general principle I'm appealing to is that it's better for a protocol to be missing more-critical qualities that are easier to add later, than less-critical but harder-to-change qualities that will forever be a hindrance. Signed records make for a fundamental security property that cannot be made up for with transport security.

Another way of looking at it is that the records in DNS/DNSSEC form a higher layer protocol than the server-to-server communication. Every party in the system has to agree on the format/semantics of those data objects, whereas the server-to-server protocols can be upgraded pairwise.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#223

Post by edf13 » Wed, Oct 02, 2019, 5:52 AM UTC

auslander wrote: post #184

NateEag wrote: post #179

Earlier quoted context omitted.

Perhaps because downloading Tor (or even searching for it / visiting its website) demonstrates an active interest in thwarting surveillance. Almost by definition, that means you're worth taking a closer look at. Once you're under the microscope, you'd better hope your opsec is flawless or that your activities are completely boring, or else the $TLA knows exactly what you've been up to, TOR or not. Disclosure: my acti…

> Perhaps because downloading Tor (or even searching for it / visiting its website) demonstrates an active interest in thwarting surveillance. Not if you access tor over VPN. VPN hides all traffic from ISP and Gov. Obviously, make sure your browser does not use Google or Cloudflare DNS.

Only hides it at the VPN entry point ~ you have to trust the VPN endpoint isn’t giving up your info too!

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#224

Post by ChuckMcM » Wed, Oct 02, 2019, 5:52 AM UTC

kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

It isn't even all that sketchy, its just providing broad snapshots of what sites are getting traffic and which ones aren't, which is used by advertisers when they bid on their ad placements.

So yeah, its going to chop off some of their revenue and they don't like it.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#225

Post by deadmutex » Wed, Oct 02, 2019, 5:55 AM UTC

dogecoinbase wrote: post #219

deadmutex wrote: post #204

Earlier quoted context omitted.

> developing nations -- but of course, Google doesn't care about those audiences Do you have a citation for your claims? There is plenty of evidence to the contrary: https://www.blog.google/technology/next-billion-users/ .

Yes, they designed a protocol which assumes low-latency highly reliable connections, which developing nations do not have. I care about what people _do_, not what they say in their PR blogs. Also, wow, your comment history is just jam-packed with defending Google. Just a fan? Or do you still work at Youtube ( https://news.ycombinator.com/item?id=13261130 ) ?

I tend to call people out when they make claims that are not accurate.

> I care about what people _do_, not what they say in their PR blogs.

Did you read the blog? It's not just words, they are talking about products they have shipped. E.g. Files Go. You can believe what you want, but if you're going to big claims, you should back those up with credible data.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#226

Post by janvidar » Wed, Oct 02, 2019, 6:02 AM UTC

Trisell wrote: post #116

tidepod12 wrote: post #108

Earlier quoted context omitted.

Why the implication that devs/engineers who have such technical expertise "know it's a bad idea"? There are plenty of devs and engineers who would have no moral issue with mass data collection and analytics. You don't magically become a paragon of morality just because you got a CS degree. Just ask Zuckerberg.

I’m working at a company and they want to do a massive amount of logging from our companies IOS app. Basically log everything in the name of security. I made the statement today what does legal think about the data we would be now storing? It has user locations, gps coordinates, all the other fun stuff you can get from a users phone. They all looked at me like I was crazy for even asking that question. And I don’t th…

If your company does business in the EU, or has users within the EU then the GDPR kicks in.

The legal department would care about that.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#227

Post by dogecoinbase » Wed, Oct 02, 2019, 6:04 AM UTC

deadmutex wrote: post #225

dogecoinbase wrote: post #219

Earlier quoted context omitted.

Yes, they designed a protocol which assumes low-latency highly reliable connections, which developing nations do not have. I care about what people _do_, not what they say in their PR blogs. Also, wow, your comment history is just jam-packed with defending Google. Just a fan? Or do you still work at Youtube ( https://news.ycombinator.com/item?id=13261130 ) ?

I tend to call people out when they make claims that are not accurate. > I care about what people _do_, not what they say in their PR blogs. Did you read the blog? It's not just words, they are talking about products they have shipped. E.g. Files Go. You can believe what you want, but if you're going to big claims, you should back those up with credible data.

https://blog.apnic.net/2018/01/29/measuring-quic-vs-tcp-mobi...

    Further, we found that QUIC consumes significantly more than its fair share of bottleneck bandwidth when competing with TCP flows, which can be detrimental to a wide range of applications.

https://blog.codavel.com/quic-vs-tcptls-and-why-quic-is-not-...

    QUIC is at its essence an ARQ protocol, i.e. feedbacks are required to recover from packet losses. And this design choice then leads to inefficiencies when evaluating link conditions. And, in links where latency and losses are unstable, these limitations lead to a significant performance loss.

if you're going to big claims, you should back those up with credible data.

I couldn't agree more. Please point to the credible data on the page you referenced: https://www.blog.google/technology/next-billion-users/files-...

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#228

Post by orthoxerox » Wed, Oct 02, 2019, 6:05 AM UTC

NateEag wrote: post #179

Santosh83 wrote: post #171

Earlier quoted context omitted.

So if VPN over Tor (or Tor over VPN) increases anonymity then why is it the popular advice on the Net is not to do it?

Perhaps because downloading Tor (or even searching for it / visiting its website) demonstrates an active interest in thwarting surveillance. Almost by definition, that means you're worth taking a closer look at. Once you're under the microscope, you'd better hope your opsec is flawless or that your activities are completely boring, or else the $TLA knows exactly what you've been up to, TOR or not. Disclosure: my acti…

> Disclosure: my activities are completely boring, and I don't use Tor, VPNs, or anything like them.

That's not what our logs show.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#229

Post by mirimir » Wed, Oct 02, 2019, 6:05 AM UTC

edf13 wrote: post #223

auslander wrote: post #184

Earlier quoted context omitted.

> Perhaps because downloading Tor (or even searching for it / visiting its website) demonstrates an active interest in thwarting surveillance. Not if you access tor over VPN. VPN hides all traffic from ISP and Gov. Obviously, make sure your browser does not use Google or Cloudflare DNS.

Only hides it at the VPN entry point ~ you have to trust the VPN endpoint isn’t giving up your info too!

True.

Except that you don't need to trust anyone, entirely.

That's the point of nested VPN chains. Let's say that you have three different VPN services in the chain. The first VPN knows your ISP-assigned IP address, and the IP address of the second VPN server. The second VPN knows the IP address of the first VPN server, and the IP address of the third VPN server. The third VPN knows the IP address of the second VPN server, and the IP address of the site that you're accessing.

An adversary would need information from all three VPNs, or from their data centers and/or ISPs.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#230

Post by mtgx » Wed, Oct 02, 2019, 6:07 AM UTC

gnu8 wrote: post #75

z9e wrote: post #40

Earlier quoted context omitted.

They definitely are. I know for a fact that they are running massive Hadoop clusters storing information on DNS records involved in their customer traffic. If I recall correctly they mirror a lot of the traffic to analytics environments.

I wonder why someone who knows how to do any of that, would think it is a good idea or go along with implementing that. The shitbirds who actually want to do this type of thing are not smart enough to execute it.

It's probably not for them:

https://techcrunch.com/2018/06/25/nsa-att-intercept-surveill...