Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cname cloaking, a disguise of third-party trackers

medium.com

Post reply on HN
Print view View original

11–20 of 202 posts

Re: Cname cloaking, a disguise of third-party trackers

#11

Post by muppetman »

iforgotpassword wrote: post #8
stefan_ wrote: post #2

So block content, as always? That's not possible for NextDNS, which I guess is their concern, but then DNS blocking was always going to be a very very blunt instrument.

At home I'm using it in addition to ad blocking in the browser, for apps and other things that might slip through. Currently it's just dnsmasq with a huge blacklist, and I guess it doesn't support checking the whole CNAME chain against that list, which would be really cool.

It doesn't need to have every cname in it. The cname resolves to the actual "bad" domain, which should be in your list already. That's why DNS blocking can still combat this method easily, while it's much harder at the browser level. uBlock Origin for Firefox beta has a "run all non-local domains back through and check for cname redirection" feature, which can also block the cname trick, but it will increase DNS latency because it has to check each external domain again for the "true" domain.

Re: Cname cloaking, a disguise of third-party trackers

#12

Post by cheald »

Use a Pihole + your adblocker of choice - defense in depth. It's easy to set up, brainless to keep updated, and helps to protect all devices on your network, not just the things that can run uBlock. I've got mine running in a Docker container, which upstreams to a stubby container, which gets DNS-over-TLS, so I get adblocking and DNS query encryption out to Cloudflare for the whole network, and it's really not all that hard to set up. (Edit: Here's the bash script I used. docker-compose would probably be better, but whatever. https://gist.github.com/cheald/23da384908404b0757eadda74124a...)

If you're unwilling to do that, just set your DNS servers to the Adguard servers (https://adguard.com/en/adguard-dns/overview.html) and you get most of the same benefit, though obviously without the control that the Pihole offers you. On Android devices, you can go to Settings - > Wifi & Internet - > Private DNS and set "Private DNS provider hostname" to dns.adguard.com (or your own exposed Pihole server, if you're so inclined) and get the same benefit when you're on LTE.

Re: Cname cloaking, a disguise of third-party trackers

#14

Post by syshum »

cheald wrote: post #12

Use a Pihole + your adblocker of choice - defense in depth. It's easy to set up, brainless to keep updated, and helps to protect all devices on your network, not just the things that can run uBlock. I've got mine running in a Docker container, which upstreams to a stubby container, which gets DNS-over-TLS, so I get adblocking and DNS query encryption out to Cloudflare for the whole network, and it's really not all th…

That will only work for so long, as more and more browsers are forcing DoH for "privacy" on users, making them bypass traditional DNS in-favor of DNS over HTTPS to a provider selected by the Browser removing user control

Mozilla for example is going to force everyone to use CloudFlare as a Resolver

Re: Cname cloaking, a disguise of third-party trackers

#17

Post by snailmailman »

syshum wrote: post #14
cheald wrote: post #12

Use a Pihole + your adblocker of choice - defense in depth. It's easy to set up, brainless to keep updated, and helps to protect all devices on your network, not just the things that can run uBlock. I've got mine running in a Docker container, which upstreams to a stubby container, which gets DNS-over-TLS, so I get adblocking and DNS query encryption out to Cloudflare for the whole network, and it's really not all th…

That will only work for so long, as more and more browsers are forcing DoH for "privacy" on users, making them bypass traditional DNS in-favor of DNS over HTTPS to a provider selected by the Browser removing user control Mozilla for example is going to force everyone to use CloudFlare as a Resolver

You can change your DoH resolver, so you could setup a raspberry pi as a DoH server theoretically, and still keep the benefits of a PiHole. Mozilla is making CloudFlare the default but they aren't forcing it, you can use another server.

Re: Cname cloaking, a disguise of third-party trackers

#18

Post by kerpele »

homero wrote: post #16
kerpele wrote: post #15

I can’t believe Ars Technica would do this. Do they not realize who their audience is?

That also means most of their audience blocks ads. What are they to do?

if their audience blocks ads this isn’t going to help, it’ll only make people mad. I know I’m upset.

Re: Cname cloaking, a disguise of third-party trackers

#19

Post by koolba »

syshum wrote: post #14
cheald wrote: post #12

Use a Pihole + your adblocker of choice - defense in depth. It's easy to set up, brainless to keep updated, and helps to protect all devices on your network, not just the things that can run uBlock. I've got mine running in a Docker container, which upstreams to a stubby container, which gets DNS-over-TLS, so I get adblocking and DNS query encryption out to Cloudflare for the whole network, and it's really not all th…

That will only work for so long, as more and more browsers are forcing DoH for "privacy" on users, making them bypass traditional DNS in-favor of DNS over HTTPS to a provider selected by the Browser removing user control Mozilla for example is going to force everyone to use CloudFlare as a Resolver

Physical devices already do this: https://mailarchive.ietf.org/arch/msg/dnsop/WCVv57IizUSjNb2R...

At least a browser might have a user setting to disable it.

Post reply on HN