Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Big ISPs aren’t happy about Google’s plans for encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

351–360 of 456 posts

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#351

Post by knorker »

goguy wrote: post #316
kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

Here in the UK sky recently pushed out an update to their firmware which made it impossible to use another DNS server other than theirs. There was a decent amount of push back, I managed to get them to downgrade my firmware but who knows how long that will last before they "accidently" update it again.

BT's DSL router/modems also only hand out BT DNS servers. You have to turn off their DHCP server and run your own to be able to hand out anything else.

Their tech support (the one that's "if we solve the problem we'll charge you") said they could not solve this for me.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#352

Post by judge2020 »

ekimekim wrote: post #185
Crazyontap wrote: post #139

I may not have the technical expertise to understand this fully but right now I'm doing adblocking by using adguard's DNS IPs in my router (1). It kinda works everywhere but for some apps like Chromecast I have to null route two IP addresses (8.8.8.8 and 8.8.4.4) otherwise it doesn't work. Those are both Google's IPs afaik. So my question is: will I be able to keep doing it after this? I am asking because I am extrem…

Yes, 8.8.8.8 and 8.8.4.4 are Google DNS resolvers. Sounds like your Chromecast has them hard-coded instead of respecting your locally configured DNS. In comparison to your current position, where you're black-holing the hard-coded addresses and the app is falling back to your configured DNS: yes you will be able to continue doing that, assuming the Chromecast will maintain the same fallback behaviour. The exact addre…

The reason for 8^4 being used for "can I connect to the internet" is valid since the DHCP DNS might be an internal router that's up even when the internet is unreachable; why it's being used for all DNS queries is less defensible. How long till it uses DoH to https://dns.google ?

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#353

Post by knorker »

zzzcpan wrote: post #337
kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

> There is no actual technical reason There exist pure technical reasons too, from address translation to DNS-level routing and load balancing. For example for ipv6-only network to access ipv4 resources there needs to be something like NAT64 embedding ipv4 addresses into ipv6 ones, but that would require overwriting DNS responses with DNS64 to actually work [1] [1] https://en.wikipedia.org/wiki/IPv6_transition_mechan…

> DNS-level routing and load balancing

How do you mean? Why should my ISPs hijack communication between me and a content provider and reroute it? This is as if I'm in a phone meeting and when I say "let me call you back at 15:00" the phone company injects "19:00" instead, because that's a time the phone network is less loaded so it'd help them.

> NAT64 embedding ipv4 addresses into ipv6 ones

NAT64 is a good point, actually. But at least in 2019 if you're on IPv6 and switch to your own DNS server that doesn't do DNS64, then it just plain won't work. I doubt Firefox or Chrome will have implementations that break like that.

> If your ISP is not trustworthy

Or country.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#354

Post by antisemiotic »

mirimir wrote: post #297
lawrenceyan wrote: post #242

Earlier quoted context omitted.

You're still vulnerable at the operating system and hardware level. It doesn't matter what you do after booting up if you're computer has already successfully been infiltrated from the Hardware/BIOS/OS initialization that always happens before.

I have considered those issues. I don't use hardware that I've purchased using my meatspace identity. The machines mainly come from yard sales and swap meets. Typically nowhere near where I've lived. And all purchased with cash. So I'm pretty confident that they're not backdoored. I have purchased SSDs from stores, but also for cash. I'm relatively confident that Debian hasn't been backdoored. Windows perhaps, but I…

Do you also browse the web through a daemon that emails you pages, Stallman-style?

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#355

Post by chopin »

goguy wrote: post #316
kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

Here in the UK sky recently pushed out an update to their firmware which made it impossible to use another DNS server other than theirs. There was a decent amount of push back, I managed to get them to downgrade my firmware but who knows how long that will last before they "accidently" update it again.

Don't you run an own router/firewall behind the ISPs? I own my internet facing router AND I run a second one for sensitive parts of my network. As well, I run an own recursive resolver.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#356

Post by swebs »

Fnoord wrote: post #312
foobiekr wrote: post #173

Earlier quoted context omitted.

Netflow data, DNS capture, enrichment of cell tower access data (location), reporting on non-usage (idle time, tracking), Bill and household information, credit account usage, etc. SPs are huge sellers in this market. We still need to encrypt the accessed resource and DNS queries everywhere. Even once that’s done, things like opencaching will be used by SPs to gather tons of data where they participate.

As a European it baffles me that this is normal in the USA. Why is this even legal? This should be PII.

Who says it's not also happening in Europe?

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#357

Post by cj »

mtbcoder wrote: post #348
Fnoord wrote: post #312

Earlier quoted context omitted.

As a European it baffles me that this is normal in the USA. Why is this even legal? This should be PII.

Wholesale data collection has become normalized in the US. For-profits, non-profits, it doesn't matter the industry, everyone is obsessed with capturing as much data as possible and believe it's just the standard way of business. No one outside of HN cares about PII or has an understanding of things like GDPR (it's just for the Europeans). Consumers are clueless or otherwise feel hopeless.

Just want to say for the sake of others reading that this comment is exaggerating + generalizing a bit.

Everyone is not obsessed with turning data into revenue. Most smaller tech companies (ie. Sub billions in revenue) are not in the game of monetizing data. My feeling is the market exists mostly between very well establish and very large companies (such as ISPs, advertising networks), but that same market doesn’t exist between newer / smaller companies that haven’t reached massive scale.

To anyone in the EU: is GDPR something that your non-technical friend will have heard of and knows what it is? Or is it similar to the US, where 75% of people probably haven’t heard of it or if they have, couldn’t say what the regulation does.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#358

Post by _57jb »

kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

There has been an agenda against DoH from the start.

China is attacking it, ISP's are attacking it, all with loose arguments and fear-mongering.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#359

Post by zzzcpan »

knorker wrote: post #353
zzzcpan wrote: post #337

Earlier quoted context omitted.

> There is no actual technical reason There exist pure technical reasons too, from address translation to DNS-level routing and load balancing. For example for ipv6-only network to access ipv4 resources there needs to be something like NAT64 embedding ipv4 addresses into ipv6 ones, but that would require overwriting DNS responses with DNS64 to actually work [1] [1] https://en.wikipedia.org/wiki/IPv6_transition_mechan…

> DNS-level routing and load balancing How do you mean? Why should my ISPs hijack communication between me and a content provider and reroute it? This is as if I'm in a phone meeting and when I say "let me call you back at 15:00" the phone company injects "19:00" instead, because that's a time the phone network is less loaded so it'd help them. > NAT64 embedding ipv4 addresses into ipv6 ones NAT64 is a good point, ac…

Some authoritative DNS servers may respond with incorrect IP addresses for specific IP subnets of an ISP (i.e. pointing to unreachable or slow far away servers), so it could be useful to fix this either statically or by forwarding domains to another DNS resolver which gets proper responses. Things like that.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#360

Post by mirimir »

antisemiotic wrote: post #354
mirimir wrote: post #297

Earlier quoted context omitted.

I have considered those issues. I don't use hardware that I've purchased using my meatspace identity. The machines mainly come from yard sales and swap meets. Typically nowhere near where I've lived. And all purchased with cash. So I'm pretty confident that they're not backdoored. I have purchased SSDs from stores, but also for cash. I'm relatively confident that Debian hasn't been backdoored. Windows perhaps, but I…

Do you also browse the web through a daemon that emails you pages, Stallman-style?

I'm not sure that I see the point. I mean, the daemon would need to run somewhere. And it'd need to render stuff. I guess that there'd be less going on, so less that's exploitable.

But no, I haven't done that.

I mainly depend on compartmentalization. This VM runs on a host that contains no information about my meatspace identity. And the machine with that information is on a different LAN.

Edit: But upon reflection, I have done something like that. Sometimes I run remote dedicated servers. Accessed via Tor (via nested VPNs) and paid with well-mixed Bitcoin. With LUKS and dropbear, of course.

If I run VirtualBox, I can basically do the same thing I do locally. I use pfSense VMs as VPN gateways, to create nested VPN chains. And then Whonix instances, which hit Tor through those VPNs. And I access the remote VMs via VRDP via SSH via Tor etc.

Post reply on HN