Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Big ISPs aren’t happy about Google’s plans for encrypted DNS

arstechnica.com

Post reply on HN
Print view View original

421–430 of 456 posts

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#421

Post by eikenberry »

tptacek wrote: post #197
eikenberry wrote: post #152

Earlier quoted context omitted.

I don't get why you'd think direct to the root DNS servers would be worse than using your ISPs servers. Using the root servers means you get DNSSEC which would prevent the greatest threats, hijacking and injection.

There is virtually no DNSSEC deployed on any major sites on the Internet and, because DNSSEC is a terrible protocol, it's unlikely there ever will be. I'm a broken record on this; you can just search "author:tptacek DNSSEC" in the bar below to get lots of different reasons why. The most important thing for this thread though is that DNSSEC provides zero privacy and, in ordinary deployments (where you talk to a namese…

I didn't claim DNSSEC was good, but it is available and serves to at least verify the communication with the root servers. That is the main reason I think using the root servers is superior to your ISPs. And I thought the context was a pi-hole with a recursive resolver (like unbound) configured to use the root servers using DNSSEC. In this case it would protect against hijacking... wouldn't it?

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#422

Post by tptacek »

b6z wrote: post #272
topranks wrote: post #250

Earlier quoted context omitted.

I think the missing piece here is the constant focus on the US. In Europe ISPs are under much stricter rules about data privacy and generally cannot do things like the above. Having worked for several ISPs here I’ve never found them misusing DNS data (although sometimes it was logged for a time for management / troubleshooting.) For a European; with reasonable trust in my ISP, I don’t want Mozilla sending all my quer…

I absolutely agree with you. I have more trust into my local European ISP than into Google, Cloudflare and such.

Nobody is asking you to trust Google more than you already do (if you don't run Chrome, this doesn't impact you at all). But the real question is: do you trust your European ISP more than anybody else that might ever run DNS for you? That seems like an extraordinary amount of trust. What DoH allows you to do is trust someone, anyone else to safely run DNS for you, without exposing anything to your ISP. That's a capability you think Europeans shouldn't want?

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#423

Post by tptacek »

eikenberry wrote: post #421
tptacek wrote: post #197

Earlier quoted context omitted.

There is virtually no DNSSEC deployed on any major sites on the Internet and, because DNSSEC is a terrible protocol, it's unlikely there ever will be. I'm a broken record on this; you can just search "author:tptacek DNSSEC" in the bar below to get lots of different reasons why. The most important thing for this thread though is that DNSSEC provides zero privacy and, in ordinary deployments (where you talk to a namese…

I didn't claim DNSSEC was good, but it is available and serves to at least verify the communication with the root servers. That is the main reason I think using the root servers is superior to your ISPs. And I thought the context was a pi-hole with a recursive resolver (like unbound) configured to use the root servers using DNSSEC. In this case it would protect against hijacking... wouldn't it?

How does DNSSEC at the roots actually protect you from an attacker manipulating DNS? They'll simply target the records from the authority server for the name you're querying --- in fact, that's what they're targeting already --- which are almost certainly not signed. Isn't "trusting the roots with DNSSEC" just security theater?

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#424

Post by JasonFruit »

claudiawerner wrote: post #403
JasonFruit wrote: post #183

Earlier quoted context omitted.

Many of us do consider EU nations repressive states, especially as regards protections for unpopular speech (and armed self-defense, but that's less relevant here).

It's quite possible that EU member states simply have different philosophical views and considerations as to the value and effects of freedom of speech. In fact, the United States is quite exceptional, but it too draws the line somewhere (assault, threats, child pornography).

Yes, that's probably true. Just because I say repressive in a pejorative tone doesn't mean the people who live in those states are bothered by it. They may prefer not to have to hear some of the speech I find regrettable but a necessary cost of freedom. (I think there's a very good argument for drawing the line where the US does and not somewhere else, but that's a different matter.)

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#425

Post by afiori »

tidepod12 wrote: post #417
afiori wrote: post #296

Earlier quoted context omitted.

Saying that business majors are full of unethical people is like saying that politics is full of unethical people, it is the job that attract those characteristics. The objective of those ethical classes is to move the neutral/good majority in hope in hope to counterbalance the unethical minority.

And computer science is just as full of unethical people. The highest paying jobs available to those in their 20s and 30s, by far, are computer science jobs. That alone attracts an incredible amount of people only in it for the money. On top of that, companies which are usually regarded as some of the most unethical companies on the planet (especially in regards to privacy) are companies like Facebook, Amazon, Micros…

I do not disagree with this, but it stands that the presence/prevalence of unethical people is not really an argument against ethic courses, as they are meant to do little more that containing the problem

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#426

Post by Faark »

A4ET8a8uTh0 wrote: post #364
paulmd wrote: post #304

Earlier quoted context omitted.

Most nations besides the US don't subscribe to an unlimited right to speech. Hell, the US doesn't subscribe to an unlimited right to speech. Should I be allowed to say that I think you should die for the opinion you just espoused? That is probably not a legal statement for me to make under the US principles of free speech. Should you be allowed to say that you think I should die for my genetics or the social group th…

I read the argument and then re-read it. Went through few odd stages of amusement and I still disagree. Defending Nazi right to express free speech is more necessary now than ever given that people apparently forgot what an important right it is. As for the argument that, opinion gets people killed, I can only reply with the following. Opinions don't kill people. People kill people. It is important to know the differ…

I totally agree, nuclear bombs don't kill people, people kill people. There is no reason people should be unable to build their own weapons and bombs. And don't even start with the WMD slippery slope.

More seriously, limiting speech should not be necessary in a good society were people don't let such stuff spread. But that doesn't seem to be how humans work. The marketplace of ideas does not necessarily prevent bad outcomes. And pretending that a root cause analysis for a genocide doesn't include speech as a vital segment in the chain leading to that atrocity seems illusory to me.

So yes, having reasonable rules doesn't seem that wrong to me. It certainly comes with all the usual problems of gov/regulation. I'm kind of fine with what we have here in Germany. Not that its perfect... but it kind of reminds me of that saying about aerospace rules... they are written in blood.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#427

Post by Faark »

kd913 wrote: post #367
topranks wrote: post #250

Earlier quoted context omitted.

I think the missing piece here is the constant focus on the US. In Europe ISPs are under much stricter rules about data privacy and generally cannot do things like the above. Having worked for several ISPs here I’ve never found them misusing DNS data (although sometimes it was logged for a time for management / troubleshooting.) For a European; with reasonable trust in my ISP, I don’t want Mozilla sending all my quer…

Wouldn't the US company resolver be based in the EU though and subject to EU Law? That would have to be the case without the DNS resolver having ridiculously slow DNS query times. I don't think the US govt can ask for data present/originated from the EU.

This seems pretty wrong. I seem to suck at googling such topics, with [0] being an okay-ish summary. And from what I understand, this is only law enforcement, thus does not even mention NSLs and such.

[0] https://www.lexology.com/library/detail.aspx?g=5649fdce-4345...

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#428

Post by lilsoso »

NicolaiS wrote: post #324
gudok wrote: post #237

How exactly encrypted DNS will reduce spying? ISPs will still be able to observe IP addresses users connect to and even particular host names in SSL handshakes.

Due to shared hosting you can't map every IP to a hostname, and encrypted SNI is a thing.

But the ISP can likely map most of the IPs to hostnames, as one would expect shared hosting to only be used for smaller sites.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#429

Post by tiergaryen »

daedalus_j wrote: post #24

I'm fine with encrypted DNS as long as it's from my router to the (encrypted) DNS provider of MY choice. Interference from browsers with network level operations is my real worry. As far as I'm concerned, as long as the browser speaks HTTPS to my router, and my router speaks HTTPS to the servers, no problem. I'm worried about the "to protect the users we've hijacked their DNS directly via the browser" possibility tho…

Your key takeaways align with mine, but FYI:

> the browser speaks HTTPS to my router, and my router speaks HTTPS to the servers

Usually this isn't the case. Browsers that aren't configured to use a proxy connect directly to some web server using TCP and as speak HTTP to it. On a lower level, it's being facilitated by IP traffic routed by your own router, the ISP and the Internet.

There are "Forward" HTTP proxies (e.g. software like Squid) that act like HTTP clients on the web and provide the real user with results. I suppose they're being set up at large organizations by IT, or at home by privacy geeks but I know no consumer router that does that out of the box.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#430

Post by Faark »

daedalus_j wrote: post #71
Spivak wrote: post #66

Earlier quoted context omitted.

Chrome doesn’t know that your local intranet is trusted or that the local resolver is trustworthy. You need to tell Chrome this by flipping a switch to either change your DoH provider or disable it all together. This change is explicitly protecting users from malicious network operators. Since you control the endpoints it should be no big deal, you apply GPO, run Puppet, whatever and everybody is talking to your loca…

In that context, I'd be perfectly happy if chrome had a "I'm on an untrusted network right now" switch, like incognito window. Not sure we should assume that the entire network between the browser and cloudflare is untrusted though. Aren't there some "hijacks" that are actually valuable to users? For example, if I run a network inside an extremely limited internet environment, I can hijack the user's DNS and redirect…

My problem with your "solution" is that it only works under very narrow assumptions. E.g. how does the Netflix client handle such a redirect? At best with "bad connection", I'd presume. I'd hope they would at least forward a better message when using a proper standard to do the blocking, if they consider this worth the effort.

(And yes, I set up a similar easy makeshift DNS solution to "authenticate" for the un-encrypted WLAN i had many years ago)

Post reply on HN