431–440 of 456 posts
Earlier quoted context omitted.
> Your ISP knows even your bank details. Google was buying MasterCard records: https://www.bloomberg.com/news/articles/2018-08-30/google-an...
And they can use that if they know your identity, like if you provided them a phone number. But I don't believe they can't do much from an IP alone. Unless the ISP starts ratting us out.
2001.
Earlier quoted context omitted.
I think google is evil. But I know AT&T is.
Big G is driven by money like any other company, but they lose more money if they don't employ top security practices and prevent others from getting their data. ATT's main business isn't selling the data, it's selling the pipes that carry data, so security on their data lakes is probably less of a priority.
The last time I looked, the csrf token issued by the homepage of one of the big three mobile carriers was "undefined."
While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.
Earlier quoted context omitted.
Netflow data, DNS capture, enrichment of cell tower access data (location), reporting on non-usage (idle time, tracking), Bill and household information, credit account usage, etc. SPs are huge sellers in this market. We still need to encrypt the accessed resource and DNS queries everywhere. Even once that’s done, things like opencaching will be used by SPs to gather tons of data where they participate.
What about 8.8.8.8? I'm guessing we're just trusting Google here (and Cloudflare 1.1.1.1 who now also does 10gb free VPNs) + the good will of engineers with access to this information within Google.
I'm fine with encrypted DNS as long as it's from my router to the (encrypted) DNS provider of MY choice. Interference from browsers with network level operations is my real worry. As far as I'm concerned, as long as the browser speaks HTTPS to my router, and my router speaks HTTPS to the servers, no problem. I'm worried about the "to protect the users we've hijacked their DNS directly via the browser" possibility tho…
The question is whether Chrome is going to ignore system settings by default.
But it's cute how ISPs are trying to mash deploying of DoH support and default to Google server into one issue.
The last paragraph absolutely seems like fearmongering:
Moreover, the centralized control of encrypted DNS threatens to harm consumers by interfering with a wide range of services provided by ISPs (both enterprise and public-facing) and others. Over the last several decades, DNS has been used to build other critical internet features and functionality including: (a) the provision of parental controls and IoT management for end users; (b) connecting end users to the nearest content delivery networks, thus ensuring the delivery of content in the fastest, cheapest, and most reliable manner; and (c) assisting rights holders’ and law enforcement’s efforts in enforcing judicial orders in combatting online piracy, as well as law enforcement’s efforts in enforcing judicial orders in combatting the exploitation of minors. Google’s centralization of DNS would bypass these critical features, undermining important consumer services and protections, and likely resulting in confusion because consumers will not understand why these features are no longer working. This centralization also raises serious cybersecurity risks and creates a single point of failure for global Internet services that is fundamentally at odds with the decentralized architecture of the internet. By limiting the ability to spot network threat indicators, it would also undermine federal government and private sector efforts to use DNS information to mitigate cybersecurity risks.
I don't see how IoT management is going to be affected by DNS resolution made by a browser. CDN's DNS server in any case sits upstream and should be able to perform needed optimization. Google's or any other US DNS provider is not exempt from complying with the US law and court orders.
Earlier quoted context omitted.
True. Except that you don't need to trust anyone, entirely. That's the point of nested VPN chains. Let's say that you have three different VPN services in the chain. The first VPN knows your ISP-assigned IP address, and the IP address of the second VPN server. The second VPN knows the IP address of the first VPN server, and the IP address of the third VPN server. The third VPN knows the IP address of the second VPN s…
My first reaction on reading this is that it sounds expensive and difficult to configure. It also reminds me a little bit of how I understand tor to work - is that accurate at all?
It is expensive, I suppose. In that you must pay for multiple VPN services. I probably spend a few hundred dollars per year, on average. But that's ~nothing for me.
But it's not that difficult to configure. I use pfSense VMs as VPN routers. And pfSense has a very intuitive WebGUI. To create nested VPN chains, I just successively NAT one VPN router through another. Using VirtualBox internal networks. And pfSense optimizes MTU automatically.
Once it's setup, you just run the VMs, and it works.
Earlier quoted context omitted.
I didn't claim DNSSEC was good, but it is available and serves to at least verify the communication with the root servers. That is the main reason I think using the root servers is superior to your ISPs. And I thought the context was a pi-hole with a recursive resolver (like unbound) configured to use the root servers using DNSSEC. In this case it would protect against hijacking... wouldn't it?
How does DNSSEC at the roots actually protect you from an attacker manipulating DNS? They'll simply target the records from the authority server for the name you're querying --- in fact, that's what they're targeting already --- which are almost certainly not signed. Isn't "trusting the roots with DNSSEC" just security theater?
Again. I'm not comparing this to DoH, but to only using your ISP's DNS resolvers. To me it still seems like an improvement.
Earlier quoted context omitted.
Ads are a much smaller threat than unscrupulous ISPs. They have access to ALL your traffic.
Only the unencrypted traffic, which is increasingly becoming just DNS. But even if all DNS was encrypted, the default DNS servers you hit are those of your ISP so they’d still have access in the common/default case