Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cname cloaking, a disguise of third-party trackers

medium.com

Post reply on HN
Print view View original

31–40 of 202 posts

Re: Cname cloaking, a disguise of third-party trackers

#31

Post by hombre_fatal »

wnevets wrote: post #6

At some point why shouldn't the (US) government step in?

Then we'll just get more pointless legislation that led to the cookie banner and ads/trackers will be trivially cloaked/proxied to the point where any publisher has full deniability.

We'll look back at the good old days when ads were mostly just banner ads.

Idea: Start paying for content and support the sites that offer this option. The entire concept of adblocking lives on borrowed time: hoping your content creators are making enough money off the suckers that don't use adblockers.

It's hard for me to envision legislation that wouldn't just be a clusterfuck as the government encroaches further onto our internet.

Re: Cname cloaking, a disguise of third-party trackers

#33

Post by bscphil »

koolba wrote: post #19
syshum wrote: post #14

Earlier quoted context omitted.

That will only work for so long, as more and more browsers are forcing DoH for "privacy" on users, making them bypass traditional DNS in-favor of DNS over HTTPS to a provider selected by the Browser removing user control Mozilla for example is going to force everyone to use CloudFlare as a Resolver

Physical devices already do this: https://mailarchive.ietf.org/arch/msg/dnsop/WCVv57IizUSjNb2R... At least a browser might have a user setting to disable it.

This isn't the same thing. That's just a hard-wired DNS server, which can be easily forced to use your own servers at the firewall. GP is talking about DNS over HTTPS, which can't be fixed in this way.

Re: Cname cloaking, a disguise of third-party trackers

#34

Post by dgoldstein0 »

stefan_ wrote: post #9
9dl wrote: post #5

Earlier quoted context omitted.

>Security implications of CNAME Cloaking >While this is considered bad practice for a website to set cookies as accessible to all subdomains (i.e., *.website.com), many do this. >In that case, those cookies are automatically sent to the cloaked third-party tracker.

So website.com decided to sellout and now the cookies you send to website.com that betrayed your trust are also sent to it's chosen third-party tracker? That is a distinction without difference. The security implication is storing any data with website.com!

Yes, but www.website.com cookies won't be sent. But you'll have to crack open devtools to figure out which one each website is doing.

Re: Cname cloaking, a disguise of third-party trackers

#35

Post by sneak »

stefan_ wrote: post #2

So block content, as always? That's not possible for NextDNS, which I guess is their concern, but then DNS blocking was always going to be a very very blunt instrument.

the NextDNS people are really smart; I just submitted a request for the ability to blacklist replies (for any hostname) that match a given IP/mask or originating AS number. This would solve the problem, especially if it is supported in blocking lists.

Re: Cname cloaking, a disguise of third-party trackers

#36

Post by perspective1 »

koolba wrote: post #27
perspective1 wrote: post #26

Earlier quoted context omitted.

Just use iptables on your firewall/router to reroute all traffic on port 53 to your DNS server.

I can assure you that the general population has no idea what half the nouns in that sentence mean, let alone how to do any of that.

> I can assure you that the general population has no idea what half the nouns in that sentence mean, let alone how to do any of that.

Keep in mind you're on HN-- we tend to be a more technical population :). If you're interested I found this on StackOverflow via Google: https://unix.stackexchange.com/questions/144482/iptables-to-...

You'll have to Google how to set up iptables/telnet or ssh on your router yourself, assuming it supports it.

Re: Cname cloaking, a disguise of third-party trackers

#38

Post by ve55 »

amluto wrote: post #29
ve55 wrote: post #21

Earlier quoted context omitted.

Every bank I've used has had a pretty absurd amount of trackers that I've blocked, often 5-10+ third party javascript domains. I don't know of any that don't have any, but I'm sure some small ones exist somewhere. There doesn't appear to be a huge market for services that do little/no tracking, as users are all unaware of the tracking that services do to begin with, so they would not even notice the difference.

Contact the regulators, perhaps? To me, allowing untrustworthy third-party scripts on a bank website sounds like a huge security risk.

As a US citizen I don't see much that can be done. Although I don't trust the third-party scripts, the bank obviously does, given they're all large analytics platforms.

Re: Cname cloaking, a disguise of third-party trackers

#39

Post by leeoniya »

amluto wrote: post #29
ve55 wrote: post #21

Earlier quoted context omitted.

Every bank I've used has had a pretty absurd amount of trackers that I've blocked, often 5-10+ third party javascript domains. I don't know of any that don't have any, but I'm sure some small ones exist somewhere. There doesn't appear to be a huge market for services that do little/no tracking, as users are all unaware of the tracking that services do to begin with, so they would not even notice the difference.

Contact the regulators, perhaps? To me, allowing untrustworthy third-party scripts on a bank website sounds like a huge security risk.

im sure it's buried in their volume-long bulshit ToS as "business partners"

Re: Cname cloaking, a disguise of third-party trackers

#40

Post by TheKIngofBelAir »

gingerlime wrote: post #10

Adguard is also starting to tackle this[0]. Found on [1] (not affiliated with any of those in any way, I'm just a user of Adguard home) [0] https://adguard.com/en/blog/disguised-trackers.html [1] https://www.reddit.com/r/pfBlockerNG/comments/e0bsto/defence...

Add this[1] host list for first-party trackers for those who don't want to use these dns solutions or/and they use a Chromium based browser.

[1] https://git.frogeye.fr/geoffrey/eulaurarien

With third-party trackers: https://hostfiles.frogeye.fr/firstparty-trackers-hosts.txt

First-party trackers only: https://hostfiles.frogeye.fr/firstparty-only-trackers-hosts....

Post reply on HN