Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Big ISPs aren’t happy about Google’s plans for encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

391–400 of 456 posts

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#391

Post by necovek »

cm2187 wrote: post #287
necovek wrote: post #274

Earlier quoted context omitted.

While I definitely agree with the sentiment, I would much rather browsers used my own caching DNS server that I can configure to talk to root nameservers: this would be the best of both worlds (ISPs can't track me, and I wouldn't be handing data to another party either, except, well, root servers). I am sure it's going to be possible, but compared to setting it on my DHCP server, now every client's browser would need…

I don’t understand how that achieves anything. If your DNS server is in the cloud, your ISP can still see your unencrypted queries to that server. If it is at home, your ISP can still see the unencrypted queries of that server to the root servers. Unless you encrypt the traffic, DNS is transparent to the ISP whichever way you set it up. And unless you are also using a VPN, the ISP can learn most of what it can learn…

Oh sure, you are right. But the thing with collecting heaps of data is that it needs to be harder. If my ISP is going to filter and process all packets in realtime, sure they can get a lot of unencrypted stuff from me. In essence, other than heavy censoring countries like China, I don't think most ISPs do that (a number of users doing that is pretty small, so the effort on their part is not worth it).

And as you and others have said, it can be done by looking at IP addresses i connect to as well.

What I do achieve is that nobody has a "full" picture of me, but only some subset of data that I transmit.

I also use two independent ISPs in a loadbalancing/failover configuration, so that helps with the cause as well, thougb my primary use is fail-over since I am in this internet business :)

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#392

Post by rpmisms »

JasonFruit wrote: post #183
saagarjha wrote: post #163

Earlier quoted context omitted.

> In addition, my ISP does not provide DoH/DNSCrypt/DNSSec. None. Just 'vanilla' DNS. Furthermore, they also don't provide an unaltered DNS service: they block some websites from resolving, the list isn't made available, and is decided via extrajudicial means. You cannot opt-out, and all ISPs in the country adhere to this. They're not forced by law to do so. I'm also not in a normally thought of as a repressive count…

Many of us do consider EU nations repressive states, especially as regards protections for unpopular speech (and armed self-defense, but that's less relevant here).

Not sure why you're being downvoted. Personal freedoms are awful in the EU, but it's in exchange for increased safety and economic stability. Obviously an amazing tradeoff.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#393

Post by Kalium »

daedalus_j wrote: post #71
Spivak wrote: post #66

Earlier quoted context omitted.

Chrome doesn’t know that your local intranet is trusted or that the local resolver is trustworthy. You need to tell Chrome this by flipping a switch to either change your DoH provider or disable it all together. This change is explicitly protecting users from malicious network operators. Since you control the endpoints it should be no big deal, you apply GPO, run Puppet, whatever and everybody is talking to your loca…

In that context, I'd be perfectly happy if chrome had a "I'm on an untrusted network right now" switch, like incognito window. Not sure we should assume that the entire network between the browser and cloudflare is untrusted though. Aren't there some "hijacks" that are actually valuable to users? For example, if I run a network inside an extremely limited internet environment, I can hijack the user's DNS and redirect…

> Not sure we should assume that the entire network between the browser and cloudflare is untrusted though.

There's a strong case to be made that the vast majority of Chrome users aren't equipped to evaluate this question. These users are very unlikely to know if they're on an untrusted network and thus unable to make use of the kind of very useful switch you wisely suggest.

Perhaps offering a configuration option for the small percentage of technically sophisticated users who are willing to look in settings for it? Certainly Chrome Enterprise (which is a configuration management system, not a pay-for enterprise software offering) offers strong settings management tools.

Strictly from a security perspective, you always assume your network is untrusted and untrustworthy (and use protocols designed to work just fine in such situations). Especially when serving users who aren't equipped to make their own educated decisions. Can you help me understand why Chrome might want to behave otherwise?

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#394

Post by techslave »

kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

if the mechanism is DoH then in this age of non neutrality they do care. it makes it one nanobit harder to throttle (er, optimize) traffic because they capture DNS along with bulk web traffic.

let’s not munge it up either. they don’t care about encryption per se. they care about 3rd party resolvers.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#396

Post by jammygit »

mirimir wrote: post #229
edf13 wrote: post #223

Earlier quoted context omitted.

Only hides it at the VPN entry point ~ you have to trust the VPN endpoint isn’t giving up your info too!

True. Except that you don't need to trust anyone, entirely. That's the point of nested VPN chains. Let's say that you have three different VPN services in the chain. The first VPN knows your ISP-assigned IP address, and the IP address of the second VPN server. The second VPN knows the IP address of the first VPN server, and the IP address of the third VPN server. The third VPN knows the IP address of the second VPN s…

My first reaction on reading this is that it sounds expensive and difficult to configure. It also reminds me a little bit of how I understand tor to work - is that accurate at all?

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#398

Post by Wheaties466 »

Tepix wrote: post #395

I guess everyone who cares about privacy should run his own DNS server/cache somewhere on the internet. Same as mail, really.

How does that help at all? You're upstream DNS requests would still be unencrypted when they are forwarded to the root servers.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#400

Post by hobbes78 »

techslave wrote: post #399

“data competition”. lol. the ISPs are literally complaining that google will now have the DNS data, and they won’t .

> google will now have the DNS data

It wont necessarily be Google... From what I understood from the article, if you're currently using OpenDNS, Cloudflare DNS, etc., after the change you'll still continue to use them, only the protocol used to access them will change...

Post reply on HN