Big ISPs aren’t happy about Google’s plans for encrypted DNS • Hacker News Board

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#441

Post by comex » Thu, Oct 03, 2019, 6:19 AM UTC

xorcist wrote: post #406

comex wrote: post #135

Earlier quoted context omitted.

> I don't understand how trading one ISP for another (Cloudflare?) is an improvement long-run. The system itself needs to be resilient, not just depend on the kindness of the upstream gods. Mozilla and Cloudflare negotiated a special privacy policy for Firefox DoH requests [1] that limits what Cloudflare can do with the data – in particular, most information must be deleted after 24 hours. There is no technical measu…

Oh, they promised not to be evil, did they? That link isn't very reassuring. Who are parties to the contract? Who can enforce it? What does it cost to breach?

The parties to the contract are presumably Cloudflare and Mozilla, since that page keeps mentioning their "agreement with Firefox" and "agreement with Mozilla". Therefore Mozilla can enforce it. As for costs to breach, that would be determined by a judge or jury based on damages suffered by Mozilla. Depends to some extent on the actual text of the contract, which hasn't been published.

That's the main mechanism for enforcement, but there are a few additional ways it could theoretically be enforced:

- The FTC and state attorneys general can sue companies for violations of their own privacy policies, as "unfair and deceptive acts and practices". For example, they sued Cambridge Analytica recently. [1]

- The California attorney general in particular would also be able to sue under the California Consumer Privacy Act once it goes into force.

- As for ways for individual consumer to sue... well, it's more difficult, but possible. For instance, a class action suit against Facebook on a grab bag of claims, also related to Cambridge Analytica, recently survived a motion to dismiss. Among other things, the judge held that users could sue for breach of contract if Facebook violated its privacy policy. [2]

[1] https://www.ftc.gov/news-events/media-resources/protecting-c...

[2] https://www.cand.uscourts.gov/filelibrary/3755/Order-re-Moti...

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#442

Post by vbezhenar » Thu, Oct 03, 2019, 9:13 AM UTC

NateEag wrote: post #408

vbezhenar wrote: post #365

Earlier quoted context omitted.

That's why more people should use it. You can't take a closer look at everyone.

Theoretically, maybe. Self-interest rears its head, though. If you don't have anything to hide, running Tor is extra work you don't gain any benefit from. Arguably you just subsidize those who use the tools for evil. I have yet to be convinced that full anonymity is actually a societal good. As a pragmatic defense against corrupt governmental agencies, it is probably useful. I'm not so sure it's a net gain for societ…

There are many legitimate uses of Tor. Like opposition in oppressed regimes. But criminals probably make the most out of it. The thing is, it might be the most convenient tool nowadays for selling drugs, etc, but if you'll remove it, criminals will find other ways to connect. Some will be caught, but most won't. And good people might lose a valueable tool to defend themselves.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#443

Post by zupa-hu » Thu, Oct 03, 2019, 10:25 AM UTC

myrandomcomment wrote: post #416

dragonwriter wrote: post #384

Earlier quoted context omitted.

> You sure that will be their biggest concern if you drop dead? That it's not their biggest concern doesn't mean that it won't be a concern, nor did it mean that it's not something he can avoid becoming a concern.

Correct. We have life insurance. We have a trust. All the normal stuff you do. What I am looking at is what are the things that I do / maintain for the family and how will that be handled if something happens? Having an overly complex technical setup is one of the areas on that list. My death would of course have the normal emotional impact it would have for any family. I am trying to make sure that everything else a…

Sorry to hear.

Look, I did not want to insult, sorry if it came across like that. I just wanted to point out that _in this specific instance_ you may exaggerate the cost of switching from your weird techy stuff to a commodity solution.

That doesn't say anything about your general principle - which is totally reasonable.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#444

Post by NateEag » Thu, Oct 03, 2019, 11:18 AM UTC

vbezhenar wrote: post #442

NateEag wrote: post #408

Earlier quoted context omitted.

Theoretically, maybe. Self-interest rears its head, though. If you don't have anything to hide, running Tor is extra work you don't gain any benefit from. Arguably you just subsidize those who use the tools for evil. I have yet to be convinced that full anonymity is actually a societal good. As a pragmatic defense against corrupt governmental agencies, it is probably useful. I'm not so sure it's a net gain for societ…

There are many legitimate uses of Tor. Like opposition in oppressed regimes. But criminals probably make the most out of it. The thing is, it might be the most convenient tool nowadays for selling drugs, etc, but if you'll remove it, criminals will find other ways to connect. Some will be caught, but most won't. And good people might lose a valueable tool to defend themselves.

That's certainly a good argument.

I'm not trying to say Tor is all bad, just explain why I don't use it and why I'm not sure it's an unmitigated good.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#445

Post by t0mas88 » Thu, Oct 03, 2019, 1:20 PM UTC

swebs wrote: post #356

Fnoord wrote: post #312

Earlier quoted context omitted.

As a European it baffles me that this is normal in the USA. Why is this even legal? This should be PII.

Who says it's not also happening in Europe?

GDPR and the tradition of not allowing why wire tapping / traffic mirroring without telling the subject (unless you are the government and have a warrant).

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#446

Post by tptacek » Thu, Oct 03, 2019, 7:40 PM UTC

eikenberry wrote: post #439

tptacek wrote: post #423

Earlier quoted context omitted.

How does DNSSEC at the roots actually protect you from an attacker manipulating DNS? They'll simply target the records from the authority server for the name you're querying --- in fact, that's what they're targeting already --- which are almost certainly not signed. Isn't "trusting the roots with DNSSEC" just security theater?

It doesn't make it impossible, but it makes it a lot harder ($$$). Checking at least the root DNSSEC prevents them from setting up a simple proxy to their own DNS resolver. They instead have to inspect each UDP and TCP packets, determine which are DNS related, if they are for root, or any other server that has DNSSEC implemented, you pass them through.. you can proxy what's left. One of those smells a lot more expens…

You're not answering my question. I think maybe I didn't communicate this well enough: attackers already target the unsigned domain records; the ordinary M.O. of a DNS attacker isn't to intercept the root servers. How can you make it "a lot harder" for those attackers by layering more "security" on the root servers themselves?

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#447

Post by ParadigmaShift » Thu, Oct 03, 2019, 8:07 PM UTC

antisemiotic wrote: post #354

mirimir wrote: post #297

Earlier quoted context omitted.

I have considered those issues. I don't use hardware that I've purchased using my meatspace identity. The machines mainly come from yard sales and swap meets. Typically nowhere near where I've lived. And all purchased with cash. So I'm pretty confident that they're not backdoored. I have purchased SSDs from stores, but also for cash. I'm relatively confident that Debian hasn't been backdoored. Windows perhaps, but I…

Do you also browse the web through a daemon that emails you pages, Stallman-style?

I do, and it all goes over nested VPNs/Tor, but my solution is different than the one mirimir uses.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#448

Post by eikenberry » Thu, Oct 03, 2019, 8:43 PM UTC

tptacek wrote: post #446

eikenberry wrote: post #439

Earlier quoted context omitted.

It doesn't make it impossible, but it makes it a lot harder ($$$). Checking at least the root DNSSEC prevents them from setting up a simple proxy to their own DNS resolver. They instead have to inspect each UDP and TCP packets, determine which are DNS related, if they are for root, or any other server that has DNSSEC implemented, you pass them through.. you can proxy what's left. One of those smells a lot more expens…

You're not answering my question. I think maybe I didn't communicate this well enough: attackers already target the unsigned domain records ; the ordinary M.O. of a DNS attacker isn't to intercept the root servers. How can you make it "a lot harder" for those attackers by layering more "security" on the root servers themselves?

> How does DNSSEC at the roots actually protect you from an attacker manipulating DNS?

Assuming that is the question you mean... it works by not allowing the attackers to take the easy course of hijacking all DNS queries and answering how they like. Instead they have to inspect each packet and only hijack those they can, which is a lot harder to do. So it is raising the bar in hope of raising it high enough that it isn't worth it ($$ wise) anymore to them. Part of this is that most people don't do this.. so the economics are not the cost of packet inspection for all their customers, but for a small fraction.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#449

Post by mark-r » Thu, Oct 03, 2019, 10:28 PM UTC

caconym_ wrote: post #388

Fnoord wrote: post #312

Earlier quoted context omitted.

As a European it baffles me that this is normal in the USA. Why is this even legal? This should be PII.

Because our government is not really interested in protecting its citizens from abuse at the hands of corporations. edit: you can see this clearly in the way they pay lip service to "breaking up big tech" (whether or not that's a good idea, this comment is not a statement of opinion on that subject) because it's politically sexy on both sides, while all these other, arguably more egregious abuses of consumer data are…

If the government showed an interest in abuse at the hands of corporations, it might start getting embarrassing questions about abuse at the hands of 3 letter agencies.

Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS

#450

Post by tptacek » Fri, Oct 04, 2019, 3:04 PM UTC

eikenberry wrote: post #448

tptacek wrote: post #446

Earlier quoted context omitted.

You're not answering my question. I think maybe I didn't communicate this well enough: attackers already target the unsigned domain records ; the ordinary M.O. of a DNS attacker isn't to intercept the root servers. How can you make it "a lot harder" for those attackers by layering more "security" on the root servers themselves?

> How does DNSSEC at the roots actually protect you from an attacker manipulating DNS? Assuming that is the question you mean... it works by not allowing the attackers to take the easy course of hijacking all DNS queries and answering how they like. Instead they have to inspect each packet and only hijack those they can, which is a lot harder to do. So it is raising the bar in hope of raising it high enough that it i…

You're not following me. What you're saying is the "easy course" is neither easy nor the normal way DNS hijacking occurs. DNS hijacking typically starts with a target domain.