Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cname cloaking, a disguise of third-party trackers

medium.com

Post reply on HN
Print view View original

91–100 of 202 posts

Re: Cname cloaking, a disguise of third-party trackers

#91

Post by poitrus »

IAM2019 wrote: post #87

The article explains that trackers traditionally loaded some external JS which then phoned home and tracked users via third-party cookies. I would like to point out that it has never been the case for Google Analytics and possibly other trackers. The developers of a website are supposed to copy/paste the Google Analytics snippet directly into their own JS, such that GA has access to first-party cookies. And then GA p…

Javascript executed from site's own scripts does not give more or less rights to access first party cookies than Javascript executed from an externally loaded URL. Any Javascript executed on a page as the same access to all those.

Re: Cname cloaking, a disguise of third-party trackers

#92

Post by 9dl »

progval wrote: post #44
9dl wrote: post #4

Sooooo I suppose we are going back to the roots White lists in hosts file with ips and good sites

You can also use uMatrix or NoScript to disable all JS/XHR (or even CSS and images) from third-party domains by default; and whitelist those you need.

Hmm

How can I block cookies with uMatrix for sub domains like *.domain.com for any site?

PS: I assume that just temporary solution. Because nextsstep is just hosting some js from "analytics" on main domain and/or solutions like cloudflare for e-commerce / google news / etc.

And for filtering that bs we need deep filtering and api inside JS VM

Re: Cname cloaking, a disguise of third-party trackers

#93

Post by yegle »

syshum wrote: post #14
cheald wrote: post #12

Use a Pihole + your adblocker of choice - defense in depth. It's easy to set up, brainless to keep updated, and helps to protect all devices on your network, not just the things that can run uBlock. I've got mine running in a Docker container, which upstreams to a stubby container, which gets DNS-over-TLS, so I get adblocking and DNS query encryption out to Cloudflare for the whole network, and it's really not all th…

That will only work for so long, as more and more browsers are forcing DoH for "privacy" on users, making them bypass traditional DNS in-favor of DNS over HTTPS to a provider selected by the Browser removing user control Mozilla for example is going to force everyone to use CloudFlare as a Resolver

Then run your own DoH server, the same way you run your own pihole.

Shameless plug: https://GitHub.com/yegle/your-dns

Re: Cname cloaking, a disguise of third-party trackers

#95

Post by zahllos »

syshum wrote: post #14
cheald wrote: post #12

Use a Pihole + your adblocker of choice - defense in depth. It's easy to set up, brainless to keep updated, and helps to protect all devices on your network, not just the things that can run uBlock. I've got mine running in a Docker container, which upstreams to a stubby container, which gets DNS-over-TLS, so I get adblocking and DNS query encryption out to Cloudflare for the whole network, and it's really not all th…

That will only work for so long, as more and more browsers are forcing DoH for "privacy" on users, making them bypass traditional DNS in-favor of DNS over HTTPS to a provider selected by the Browser removing user control Mozilla for example is going to force everyone to use CloudFlare as a Resolver

While I agree that Mozilla's by default decision is wrong, this is not actually true of other browsers. Chrome will check your existing DNS provider to see if they support DoH and if they do, query that way. If not DNS proceeds as normal. Microsoft are adding the ability to use DoH in windows, but they won't change your DNS settings, so you'll need to configure it. So other than Firefox there's no "use DoH by default" anywhere.

Firefox's choice isn't the best but you can disable it. Set network.trr.mode to 5 in about: config, which means disabled and deliberately configured as such. Then Firefox won't ever try to use DoH.

As others have pointed out, you can also use other resolvers than cloudflare's, through network.trr options.

Re: Cname cloaking, a disguise of third-party trackers

#96

Post by strenholme »

The way to counter this is to know the IP a given CNAME resolves to, and to block “rogue” (read: tracking) IPs.

As an open-source DNS implementer, I know this has already been done, since my DNS server (MaraDNS’s Deadwood recursive resolver) has the ability to refuse to resolve DNS names with bad IPs via ip_blacklist.

The reason I implemented this is to block NXDOMAIN redirects (when using an ISP’s DNS server and mistyping a domain name, instead of getting “nothing there”, it goes to an ad-filled “search” page provided by the ISP), but the implementation scales and it should work for blocking a large number of rogue CNAME redirects like this one.

I’m sure others have implemented something similar out there (I will let someone who knows the pihole ad-blocking DNS server, not to mention NextDNS, better than me tell us how they do this), and I’m sure Firefox, if they do not do so already, will allow ad/privacy blockers to know the IP of a given name to allow blocking at the browser level.

Re: Cname cloaking, a disguise of third-party trackers

#97

Post by 9dl »

fwxwi wrote: post #23
9dl wrote: post #4

Sooooo I suppose we are going back to the roots White lists in hosts file with ips and good sites

You can't block an IP address with a hosts file; you can't even use wildcards in them. You will need a firewall rule.

>You will need a firewall rule.

Yes

Or DNS

Re: Cname cloaking, a disguise of third-party trackers

#98

Post by dessant »

jefftk wrote: post #86
noman-land wrote: post #82

Earlier quoted context omitted.

"It is difficult to get a man to understand something, when his salary depends on his not understanding it."

I do the work I do because it allows me to donate: https://www.jefftk.com/donations I would not do this work if I thought it was harmful, and if I decided it was harmful there are many jobs I could take instead. I'm open to being convinced that my work is net negative! I've quit Google before: https://www.jefftk.com/p/leaving-google-joining-wave

You're contributing to tech that erodes people's privacy, even when they actively fight against it. Don't delude yourself with net positives. The harm your employer causes still affects people, regadless of the useful things you may work on at Google, or the donations you give.

Re: Cname cloaking, a disguise of third-party trackers

#100

Post by SquareWheel »

dessant wrote: post #98
jefftk wrote: post #86

Earlier quoted context omitted.

I do the work I do because it allows me to donate: https://www.jefftk.com/donations I would not do this work if I thought it was harmful, and if I decided it was harmful there are many jobs I could take instead. I'm open to being convinced that my work is net negative! I've quit Google before: https://www.jefftk.com/p/leaving-google-joining-wave

You're contributing to tech that erodes people's privacy, even when they actively fight against it. Don't delude yourself with net positives. The harm your employer causes still affects people, regadless of the useful things you may work on at Google, or the donations you give.

Not everyone shares your moral sentiments. I find your view elitist and unfair towards jefftk, who has been extremely open and amiable.
Post reply on HN