Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Big ISPs aren’t happy about Google’s plans for encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

311–320 of 456 posts

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#311

Post by cm2187 »

taneq wrote: post #305
cm2187 wrote: post #291

Earlier quoted context omitted.

If you are not using gmail and google search, and are using adblockers, Google shouldn’t really have any information on your IP, so it is anonymised data. Your ISP knows even your bank details. But the limits of using google DNS (or even encrypted DNS) is that most commercial websites aren’t sharing IP addresses, so I bet the ISP can pretty much reconstruct the data it would get from DNS with very little effort just…

> Your ISP knows even your bank details. Google was buying MasterCard records: https://www.bloomberg.com/news/articles/2018-08-30/google-an...

And they can use that if they know your identity, like if you provided them a phone number.

But I don't believe they can't do much from an IP alone. Unless the ISP starts ratting us out.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#312

Post by Fnoord »

foobiekr wrote: post #173
z9e wrote: post #40

Earlier quoted context omitted.

They definitely are. I know for a fact that they are running massive Hadoop clusters storing information on DNS records involved in their customer traffic. If I recall correctly they mirror a lot of the traffic to analytics environments.

Netflow data, DNS capture, enrichment of cell tower access data (location), reporting on non-usage (idle time, tracking), Bill and household information, credit account usage, etc. SPs are huge sellers in this market. We still need to encrypt the accessed resource and DNS queries everywhere. Even once that’s done, things like opencaching will be used by SPs to gather tons of data where they participate.

As a European it baffles me that this is normal in the USA. Why is this even legal? This should be PII.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#313

Post by tinus_hn »

dcow wrote: post #82
kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

We agree that ISPs should not need to view your browsing data without your consent. But there are many technical reasons for an ISP to want to run DNS outside the resolver privacy conversation: For one some ISPs run content filtering services. Some users prefer to concede extreme privacy for what they view as a safer browsing experience. It might not be your jam, but it exists. DNS is designed to be provider independ…

The fact that some nasty hacks used to work doesn’t require anyone to keep them working. In fact, the sooner they stop working the better.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#314

Post by zifnab06 »

daedalus_j wrote: post #48
tptacek wrote: post #31

Earlier quoted context omitted.

If you're on a mainstream US ISP, interference from your browser with your ISP's "network level operations" is a privacy necessity. They're passively monitoring DNS to collect data on their customers and hijacking it to send users to advertising sites. ISP DNS is manifestly untrustworthy.

Well no, because my router is proxying DNS requests, and it's not to my ISP's DNS servers. (It's also serving a number of custom DNS records for internal/work stuff.) I don't understand how trading one ISP for another (Cloudflare?) is an improvement long-run. The system itself needs to be resilient, not just depend on the kindness of the upstream gods.

It doesn't have to be to their servers - they can just dump all data going anywhere on udp/53 from one of their routers. DNS isn't encrypted, anyone between you and whatever server you're using can see everything.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#315

Post by Nitramp »

dmix wrote: post #176
foobiekr wrote: post #173

Earlier quoted context omitted.

Netflow data, DNS capture, enrichment of cell tower access data (location), reporting on non-usage (idle time, tracking), Bill and household information, credit account usage, etc. SPs are huge sellers in this market. We still need to encrypt the accessed resource and DNS queries everywhere. Even once that’s done, things like opencaching will be used by SPs to gather tons of data where they participate.

What about 8.8.8.8? I'm guessing we're just trusting Google here (and Cloudflare 1.1.1.1 who now also does 10gb free VPNs) + the good will of engineers with access to this information within Google.

You don't need to just blindly trust, there are ToS and privacy statements. My TL;DR is that Google doesn't use logs outside of service health (eg vs DDoS).

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#316

Post by goguy »

kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

Here in the UK sky recently pushed out an update to their firmware which made it impossible to use another DNS server other than theirs. There was a decent amount of push back, I managed to get them to downgrade my firmware but who knows how long that will last before they "accidently" update it again.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#317

Post by mavhc »

goguy wrote: post #316
kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

Here in the UK sky recently pushed out an update to their firmware which made it impossible to use another DNS server other than theirs. There was a decent amount of push back, I managed to get them to downgrade my firmware but who knows how long that will last before they "accidently" update it again.

What's the best way to tell if they're intercepting queries to other dns servers and replying themselves?

Say I manually set my dns to 1.1.1.1, is there a way to tell if the replies are really from 1.1.1.1?

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#318

Post by Terretta »

sdfgh2019 wrote: post #221
zchrykng wrote: post #170

Earlier quoted context omitted.

Everything warrants skepticism until proven otherwise. Especially things that are being given out for free. Google might be operating on the up and up, but Google is just a large collection of people and some of them will be ethically lacking. And Google's employees have a large incentive to not see any issues with collecting all the personal information that exists.

Disclaimer: I work at Google. > And Google's employees have a large incentive to not see any issues with collecting all the personal information that exists. I can only speak from personal experience. But I would not agree. Collection of data needs to be covered in a privacy document. You must argue why you're collecting it. There has to be a retention plan, such that data is purged when the user account is deleted,…

> “You can of course get exemptions, IF there is a valid business reasons.”

For an ad revenue driven business, that’s a pretty big exception.

Ad targeting / re-targeting benefits from a richer picture of the user’s personal life choices. Maybe only a couple percentage points, but every % of a billion adds up.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#319

Post by Avamander »

tomschlick wrote: post #154
dcow wrote: post #121

Earlier quoted context omitted.

This is incorrect. Mozilla is ignoring your os/dhcp configured server and using Cloudflare. Your PiHole no longer sees the traffic. There is a way to configure your network to make Firefox not do this, so that's good. But it's not the default.

Thats also false. Mozilla added a canary domain (use-application-dns.net) that if blocked will default to the local dns resolver. There are several threads in the pihole community about blocking it by default so I expect that will be done before mozilla turns int on for the masses.

How do I configure Mozilla to ignore the blocking? I don't want to use internet that tries to force me to downgrade.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#320

Post by panpanna »

Nitramp wrote: post #315
dmix wrote: post #176

Earlier quoted context omitted.

What about 8.8.8.8? I'm guessing we're just trusting Google here (and Cloudflare 1.1.1.1 who now also does 10gb free VPNs) + the good will of engineers with access to this information within Google.

You don't need to just blindly trust, there are ToS and privacy statements. My TL;DR is that Google doesn't use logs outside of service health (eg vs DDoS).

So what pays for this service?
Post reply on HN