Big ISPs aren’t happy about Google’s plans for encrypted DNS • Hacker News Board

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#331

Post by gog » Wed, Oct 02, 2019, 9:53 AM UTC

carokann wrote: post #292

tiew9Vii wrote: post #159

Earlier quoted context omitted.

I've worked on questionable projects at a big telecom. I refuse to run ISP provided modems/routers at home, i refuse to use my isps dns and use dns-tls etc etc based on what i have seen. The devs have often said things bad idea and raise concerns unfortunately you generally have no power, the decision to implement something is made above you. Generally the people making the decisions know things are questionable but…

Nice point. I've been considering changing my router for a while out of privacy concerns. Do you have a suggestion? I was wondering whether i could use my raspberry pi 3b+ for it.

I've been using Mikrotiks for over a decade, they just work and are pretty cheap. They do require you to know a little bit more about networking then the regular, end user oriented, routers.

Only negative I would mention is that some things are a little bit harder to setup, like a VPN for example (and it doesn't support OpenVPN over UDP).

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#332

Post by isostatic » Wed, Oct 02, 2019, 9:56 AM UTC

goguy wrote: post #316

kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

Here in the UK sky recently pushed out an update to their firmware which made it impossible to use another DNS server other than theirs. There was a decent amount of push back, I managed to get them to downgrade my firmware but who knows how long that will last before they "accidently" update it again.

Interesting. Time to switch ISP then.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#333

Post by dspillett » Wed, Oct 02, 2019, 10:02 AM UTC

_Understated_ wrote: post #323

mavhc wrote: post #317

Earlier quoted context omitted.

What's the best way to tell if they're intercepting queries to other dns servers and replying themselves? Say I manually set my dns to 1.1.1.1, is there a way to tell if the replies are really from 1.1.1.1?

An NSLOOKUP will tell you the DNS server that your query went to.

Unfortunately that will not help: if the requests to other servers are NATed when they hit the router it will look like your request went elsewhere when in fact to went to Sky. nslookup is reporting what it tried to connect to for an answer, not what actually answered.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#334

Post by dspillett » Wed, Oct 02, 2019, 10:09 AM UTC

_Understated_ wrote: post #321

goguy wrote: post #316

Earlier quoted context omitted.

Here in the UK sky recently pushed out an update to their firmware which made it impossible to use another DNS server other than theirs. There was a decent amount of push back, I managed to get them to downgrade my firmware but who knows how long that will last before they "accidently" update it again.

I use Sky. I wasn't aware of this. :( I also use my own router so I assume it doesn't affect me or does this mean that their network doesn't allow other DNS servers? How would that affect a VPN? I use PIA and they have their own DNS servers. I'll need to experiment with this when I get home I think.

> How would that affect a VPN?

If your DNS requests are going over the VPN then you will be fine as they will be in the encrypted tunnel before they travel through your router so it can't do anything about them. A change to the router firmware won't be able to override DNS server settings on other individual hosts.

If your router is providing the local VPN endpoint then that is another matter, but IIRC PIA runs on your local station. Do check that it is in fact setting your machine to send DNS requests over the link. I'd be surprised if it wasn't, but you never know.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#335

Post by pornel » Wed, Oct 02, 2019, 10:11 AM UTC

topranks wrote: post #267

Santosh83 wrote: post #187

What I fear will happen in several years is that local ISPs will also begin offering DoH by default (if you can't beat the competition, join them) and continue snooping on your traffic, just like Google or Cloudflare could do now technically, if they wanted to. Ultimately this boils down to which entity you trust more, your ISP or some other provider. Today Google/Cloudflare et al are by far the more trustworthy opti…

Why would you fear ISPs offering an encrypted service? It’s hardly a step backwards? DoT would be preferable to DoH (no additional metadata / cookies,) but either way ISPs should adopt encrypted DNS. You are correct it boils down to “who you trust.” In my country the ISP wins hands down over a foreign mega-corp so I end up making a different decision to you. The key thing is that is a choice for users, not something…

Because DoH is supposed to hide the DNS traffic from ISPs (among others). Sending the DNS traffic straight to the ISP defeats the purpose of it. That's like MITM on the first hop.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#336

Post by dspillett » Wed, Oct 02, 2019, 10:16 AM UTC

mavhc wrote: post #317

goguy wrote: post #316

Earlier quoted context omitted.

Here in the UK sky recently pushed out an update to their firmware which made it impossible to use another DNS server other than theirs. There was a decent amount of push back, I managed to get them to downgrade my firmware but who knows how long that will last before they "accidently" update it again.

What's the best way to tell if they're intercepting queries to other dns servers and replying themselves? Say I manually set my dns to 1.1.1.1, is there a way to tell if the replies are really from 1.1.1.1?

> What's the best way to tell if they're intercepting queries

Setup a simple DNS resolver in an external VM (use a service like DO where you can pay by the hour, and the test will cost you at most tens of pennies), configure it with a DNS zone that the rest of the Internet does not know about (thisdoesnotreallyexist.net). Then if you try query for that domain from that server but get an NXDOMAIN response your query was probably intercepted (of course test from other locations too, to make sure the problem isn't a mistake in the new resolver's config).

Or you could configure the test resolver to give different answers for an existing domain, of course, and check for which addresses you get back instead of checking for address or error - that would essentially be the same test.

Or, he says, thinking of the obvious after explaining the more long winded, if you have a DNS server in your control, simply turn on the relevant logging options and run a query against it and see if your query turns up in its logs.

This assumes they are intercepting and NATing all standard DNS requests (usually on UDP & TCP port 53), rather then just DNS traffic going to a list of known alternative DNS services. If they are doing the latter then there are tests you can do that rely on timing and TTL settings (get their server to cache a result, change the name->address mapping, then ask 8.8.8.8 or similar and see what answer you get).

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#337

Post by zzzcpan » Wed, Oct 02, 2019, 10:21 AM UTC

kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

> There is no actual technical reason

There exist pure technical reasons too, from address translation to DNS-level routing and load balancing. For example for ipv6-only network to access ipv4 resources there needs to be something like NAT64 embedding ipv4 addresses into ipv6 ones, but that would require overwriting DNS responses with DNS64 to actually work [1]

[1] https://en.wikipedia.org/wiki/IPv6_transition_mechanism#DNS6...

Keep in mind, encryption is not privacy. Encrypting DNS queries to a 3rd party resolver doesn't improve your privacy, it's a fight for control, not privacy. ISPs will still violate your privacy to the same extent, except said 3rd party will be able to do that too. If your ISP is not trustworthy the only way to save yourself from it is to use something like a VPN which effectively gives you a different ISP of your choice.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#338

Post by gnomewascool » Wed, Oct 02, 2019, 10:21 AM UTC

paulmd wrote: post #304

TimTheTinker wrote: post #186

Earlier quoted context omitted.

> Business majors have had ethics courses for as long as I can imagine I took a business ethics course in undergrad, and it was surprising how many students advocated all sorts of (to me) aberrant ethical views. (Note I’m pretty traditional, morally speaking. The environment was strongly postmodern, and this was before all the modern insanity about “free speech is bad because some people say bad/offensive things”.) N…

Most nations besides the US don't subscribe to an unlimited right to speech. Hell, the US doesn't subscribe to an unlimited right to speech. Should I be allowed to say that I think you should die for the opinion you just espoused? That is probably not a legal statement for me to make under the US principles of free speech. Should you be allowed to say that you think I should die for my genetics or the social group th…

> what arguments exactly do you feel could not legally be expressed in a modern first-world democracy, that actually should be expressed?

Many people use “free speech” to describe more than what is covered by the First Amendment in the USA. For instance, freedom from retaliation, by being fired from your job. According to that view, entities other than the government can engage in suppressing free speech.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#339

Post by belorn » Wed, Oct 02, 2019, 10:24 AM UTC

mavhc wrote: post #317

goguy wrote: post #316

Earlier quoted context omitted.

Here in the UK sky recently pushed out an update to their firmware which made it impossible to use another DNS server other than theirs. There was a decent amount of push back, I managed to get them to downgrade my firmware but who knows how long that will last before they "accidently" update it again.

What's the best way to tell if they're intercepting queries to other dns servers and replying themselves? Say I manually set my dns to 1.1.1.1, is there a way to tell if the replies are really from 1.1.1.1?

With no changes to your setup it is actually impossible. DNS as it currently exist is a plain text protocol.

If you run your own dns server at your local machine you can enable DNSSEC, which will protect against manipulations for domains that has that enabled. A recursive dns server is pretty easy to setup and it a step towards running your own authoritative server in the future for private domains.

If you want to resolve using googles DNS servers and be sure it is really them then the only method that I know that is also supported by google would be DoH. The other encryption method they support, DoT, do not provide authentication and draft-bortzmeyer-dprive-resolver-to-auth-00 is to my knowledge not implemented by google.

If you want a bit more privacy and have a mix of the two above then go with a VPN or build one yourself. Just note that without DoH you won't be authenticating between the VPN and google, so I would just use a resolver at the VPN.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#340

Post by dspillett » Wed, Oct 02, 2019, 10:25 AM UTC

gnu8 wrote: post #75

z9e wrote: post #40

Earlier quoted context omitted.

They definitely are. I know for a fact that they are running massive Hadoop clusters storing information on DNS records involved in their customer traffic. If I recall correctly they mirror a lot of the traffic to analytics environments.

I wonder why someone who knows how to do any of that, would think it is a good idea or go along with implementing that. The shitbirds who actually want to do this type of thing are not smart enough to execute it.

There are environments where traffic must be logged for regulatory or other legal reasons, so the technique and code to implement it is not universally malicious.

Implementing the mis-feature on a public ISP will be done by people who think the matter isn't worth risking their job by taking a stand on, and just saying no once the decision has been made several levels above their rank won't help anyone because if they don't implement the feature their replacement will.