Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Big ISPs aren’t happy about Google’s plans for encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

401–410 of 456 posts

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#401

Post by boomlinde »

gnu8 wrote: post #75
z9e wrote: post #40

Earlier quoted context omitted.

They definitely are. I know for a fact that they are running massive Hadoop clusters storing information on DNS records involved in their customer traffic. If I recall correctly they mirror a lot of the traffic to analytics environments.

I wonder why someone who knows how to do any of that, would think it is a good idea or go along with implementing that. The shitbirds who actually want to do this type of thing are not smart enough to execute it.

The nasty dilemma that capitalism poses is that of "take the moral high ground" vs "know whether I'll afford rent next month". It's not your moral compass that determines your worth to society, it's how much people are willing to pay you for your work. If they aren't, you are worth so little to society that you may be out of a home.

Developers may be in a pretty sweet situation, generally, but if you don't have money saved or another job lined up you don't have much choice.

I also think that people are great at finding excuses for what we're doing. I've read somewhere about a hypothesis that conscious thought is mostly just intellectual justification for subconscious urges.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#402

Post by tptacek »

belorn wrote: post #339
mavhc wrote: post #317

Earlier quoted context omitted.

What's the best way to tell if they're intercepting queries to other dns servers and replying themselves? Say I manually set my dns to 1.1.1.1, is there a way to tell if the replies are really from 1.1.1.1?

With no changes to your setup it is actually impossible. DNS as it currently exist is a plain text protocol. If you run your own dns server at your local machine you can enable DNSSEC, which will protect against manipulations for domains that has that enabled. A recursive dns server is pretty easy to setup and it a step towards running your own authoritative server in the future for private domains. If you want to re…

If you run your own DNS server at your local machine, you'll be exposing all your queries to your ISP, which will log and monetize them. You'll gain support for a DNSSEC protocol that virtually nobody on the Internet uses --- DNSSEC only functions on signed zones, and in 25 years almost nobody has signed a zone --- and so your ISP will almost always be able to manipulate your queries anyways.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#403

Post by claudiawerner »

JasonFruit wrote: post #183
saagarjha wrote: post #163

Earlier quoted context omitted.

> In addition, my ISP does not provide DoH/DNSCrypt/DNSSec. None. Just 'vanilla' DNS. Furthermore, they also don't provide an unaltered DNS service: they block some websites from resolving, the list isn't made available, and is decided via extrajudicial means. You cannot opt-out, and all ISPs in the country adhere to this. They're not forced by law to do so. I'm also not in a normally thought of as a repressive count…

Many of us do consider EU nations repressive states, especially as regards protections for unpopular speech (and armed self-defense, but that's less relevant here).

It's quite possible that EU member states simply have different philosophical views and considerations as to the value and effects of freedom of speech. In fact, the United States is quite exceptional, but it too draws the line somewhere (assault, threats, child pornography).

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#404

Post by GoblinSlayer »

calmworm wrote: post #377
belltaco wrote: post #150

Earlier quoted context omitted.

It used to be illegal for ISPs to use web browsing data for advertising purposes but the Republican House, Senate and President passed a law allowing them to make it an opt-out. https://arstechnica.com/tech-policy/2017/03/for-sale-your-pr...

Good article, but no link or details on how to actually opt-out?

Up to implementation:

https://arstechnica.com/information-technology/2017/03/how-i...

all the major ISP lobby groups signed on to a voluntary set of privacy principles based partly on the FTC framework. They specifically pledged to follow FTC guidance for opt-in consent before sharing sensitive information and to “offer an opt-out choice to use non-sensitive customer information for personalized third-party marketing.” Browsing history would be subject to an opt-out system.

Harris encourages Internet users to go to their ISP’s website or call the ISP to figure out exactly how they can opt out of tracking. It’s not convenient, but the option should be there.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#405

Post by GoblinSlayer »

vbezhenar wrote: post #378
rcarmo wrote: post #233

Earlier quoted context omitted.

I worked at a couple of major telcos at my country, and at the last one - where we had literally millions of active ISP and mobile users - we were approached by a company willing to pay for DNS resolver data. It is definitely a thing (and possible income source) even if you don’t do that kind of analytics yourself. But I’m fascinated by the legal implications. Right now in Portugal sites are DNS-blocked for copyright…

I'm living in Kazakhstan which blocks some websites. Also Russia blocks a lot of websites. I can't wait to see how eSNI will play out with all those blocks, if Cloudflare and other big networks will dare to roll it out.

Cloudflare collaborates with censors and reserves a fixed IP for the blocked site so censors can block that IP, they don't block by DNS, eSNI won't help, use Tor.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#406

Post by xorcist »

comex wrote: post #135
daedalus_j wrote: post #48

Earlier quoted context omitted.

Well no, because my router is proxying DNS requests, and it's not to my ISP's DNS servers. (It's also serving a number of custom DNS records for internal/work stuff.) I don't understand how trading one ISP for another (Cloudflare?) is an improvement long-run. The system itself needs to be resilient, not just depend on the kindness of the upstream gods.

> I don't understand how trading one ISP for another (Cloudflare?) is an improvement long-run. The system itself needs to be resilient, not just depend on the kindness of the upstream gods. Mozilla and Cloudflare negotiated a special privacy policy for Firefox DoH requests [1] that limits what Cloudflare can do with the data – in particular, most information must be deleted after 24 hours. There is no technical measu…

Oh, they promised not to be evil, did they?

That link isn't very reassuring. Who are parties to the contract? Who can enforce it? What does it cost to breach?

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#407

Post by beached_whale »

aussieguy1234 wrote: post #141
beached_whale wrote: post #86

Earlier quoted context omitted.

Could be caching too. Bunch of services like youtube and netflix, at least used, use DNS to direct users to local servers. This enabled a better experience for the users and lowered the amount of bandwidth

They also used this method to block region restricted content. Here in Aus Foxtel has a monopoly on all the good shows, they charge >$100 per month if you want access to everything on their crappy, ageing cable tv network. After Netflix blocked the vpn workaround, alot of people went back to torrenting

I wonder if that will be a side effect of this. If the default is DNS via Google, then sites can differentiate on that and do nasty things like block non-google or give different results.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#408

Post by NateEag »

vbezhenar wrote: post #365
NateEag wrote: post #179

Earlier quoted context omitted.

Perhaps because downloading Tor (or even searching for it / visiting its website) demonstrates an active interest in thwarting surveillance. Almost by definition, that means you're worth taking a closer look at. Once you're under the microscope, you'd better hope your opsec is flawless or that your activities are completely boring, or else the $TLA knows exactly what you've been up to, TOR or not. Disclosure: my acti…

That's why more people should use it. You can't take a closer look at everyone.

Theoretically, maybe.

Self-interest rears its head, though. If you don't have anything to hide, running Tor is extra work you don't gain any benefit from. Arguably you just subsidize those who use the tools for evil.

I have yet to be convinced that full anonymity is actually a societal good.

As a pragmatic defense against corrupt governmental agencies, it is probably useful.

I'm not so sure it's a net gain for society as a whole.

And, in a nutshell, I suppose that's why I've never gone down this road.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#409

Post by belorn »

tptacek wrote: post #402
belorn wrote: post #339

Earlier quoted context omitted.

With no changes to your setup it is actually impossible. DNS as it currently exist is a plain text protocol. If you run your own dns server at your local machine you can enable DNSSEC, which will protect against manipulations for domains that has that enabled. A recursive dns server is pretty easy to setup and it a step towards running your own authoritative server in the future for private domains. If you want to re…

If you run your own DNS server at your local machine, you'll be exposing all your queries to your ISP, which will log and monetize them. You'll gain support for a DNSSEC protocol that virtually nobody on the Internet uses --- DNSSEC only functions on signed zones, and in 25 years almost nobody has signed a zone --- and so your ISP will almost always be able to manipulate your queries anyways.

If you use google servers under plain text you will be exposing all your queries to your ISP and to google, which will log and monetize them. DNS under plain text is so easily captured that all entities. ISP that spans the traffic to google, google itself, and ISP that spans from google to the resolver can capture, log and monetize the information. Monetizing can occur by logging who queried, what was queried, and in either as a combination or in isolation. A lot of companies consider the later to not be private information or covered by GDPR.

The effectiveness of DNSSEC depend on where you are. If you live in Netherlands or Sweden and visits mostly Swedish or Dutch sites then a larger portion will be signed.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#410

Post by dcow »

kelnos wrote: post #280
dcow wrote: post #90

Earlier quoted context omitted.

I’m not saying that some ISPs aren’t malicious. But to say there is no reason for an ISP to serve DNS is absurd.

I don't think anyone is arguing that there's no reason for an ISP to serve DNS.

> There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

That’s the part of your comment I am replying to. Anyway I see you’re arguing ISPs shouldn’t care which provider you use, not that they shouldn’t want to default you to running their own. Perhaps I misunderstood your point.

Regardless I’d argue the problem in the us is that any DNS provider can abuse your data. Today it’s big ISPs, tomorrow it’s Cloudflare. Unless we actually prevent (technically and/or socially) DNS from being an open book and develop strategies to mitigate the privacy issues it’s just a game of pick your poison, and that‘s what bothers me.

Post reply on HN