Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thai Database Leaks 8.3B Internet Records

rainbowtabl.es

Post reply on HN
Print view View original

11–20 of 79 posts

Re: Thai Database Leaks 8.3B Internet Records

#11

Post by cbg0 »

shp0ngle wrote: post #10
cbg0 wrote: post #2

> To be clear: DoH and/or DoT would have stopped the gathering of DNS query data in this case. It's simple to set up, and it's just a smart thing to do for anyone concerned about their privacy. Actually, for most people that are not technically savvy this is definitely not an easy thing to set up, nor are they even aware that DoH/DoT exist. Unless this feature starts being turned on by default in routers and popular…

DoH just moves the logging from Thai telecom and moves it to Cloudflare (or, whoever you set up as your DoH server, but most likely Cloudflare), no? I trust CF much more than my ISP, but it makes the potential leak much worse... edit: On the other hand, DoH makes DNS requests independent of ISP, which is nice. ISPs are often monopoly by nature.

Cloudflare has a privacy policy https://developers.cloudflare.com/1.1.1.1/privacy/public-dns...

Obviously, for Thai users this is a reasonable option, but I would understand why American users would not want to use Cloudflare, Google or even Quad9, as these are all US-based.

Re: Thai Database Leaks 8.3B Internet Records

#12

Post by arminiusreturns »

cbg0 wrote: post #11
shp0ngle wrote: post #10

Earlier quoted context omitted.

DoH just moves the logging from Thai telecom and moves it to Cloudflare (or, whoever you set up as your DoH server, but most likely Cloudflare), no? I trust CF much more than my ISP, but it makes the potential leak much worse... edit: On the other hand, DoH makes DNS requests independent of ISP, which is nice. ISPs are often monopoly by nature.

Cloudflare has a privacy policy https://developers.cloudflare.com/1.1.1.1/privacy/public-dns... Obviously, for Thai users this is a reasonable option, but I would understand why American users would not want to use Cloudflare, Google or even Quad9, as these are all US-based.

I thought quad9 was UK based?

Re: Thai Database Leaks 8.3B Internet Records

#13

Post by cbg0 »

arminiusreturns wrote: post #12
cbg0 wrote: post #11

Earlier quoted context omitted.

Cloudflare has a privacy policy https://developers.cloudflare.com/1.1.1.1/privacy/public-dns... Obviously, for Thai users this is a reasonable option, but I would understand why American users would not want to use Cloudflare, Google or even Quad9, as these are all US-based.

I thought quad9 was UK based?

Bottom of quad9.net says:

HQ

1442 A Walnut Street

Suite 501

Berkeley CA 94709

Re: Thai Database Leaks 8.3B Internet Records

#14

Post by cbg0 »

encom wrote: post #9
blitmap wrote: post #4

Earlier quoted context omitted.

I recently set up a dns-over-https (doh) proxy on my router to forward dns requests to 5 resolvers, that also use dnssec. I wish Firefox would expose the option from about:config in its user-friendly Preferences page so it will respect the "system default" (the advertised dns server). I am - for no legitimate reasons - avoiding Cloudflare as a resolver. As far as I know Firefox uses Cloudflare.

Have you been able to find a trustworthy public DoT resolver? I really want to use uncensoreddns.org, but availability has been a little flaky in the past. I'm not sure about Quad9. Google and CloudFlare are obviously out of the question. What else is there?

> Have you been able to find a trustworthy public DoT resolver?

It really depends what you view as being "trustworthy". Outside of the US good enough? Or do you want non 5/9/14-Eyes? (https://en.wikipedia.org/wiki/UKUSA_Agreement#9_Eyes,_14_Eye...)

Re: Thai Database Leaks 8.3B Internet Records

#15

Post by nurettin »

lisk1 wrote: post #7

Solution for this is to tunnel the traffic through encrypted connection to servers in countries that respect persons privacy(if that is true nowadays). The easiest way is to use WireGuard, easy to set up uses only one port and have clients for many devices.

If you trust your vps dns, easiest way would be autossh -D and set your browser's socks5 proxy to localhost: and tell it to use remote dns when resolving domains. This requires no wireguard setup, no certificate generation or anything.

Re: Thai Database Leaks 8.3B Internet Records

#16

Post by bouncycastle »

nurettin wrote: post #15
lisk1 wrote: post #7

Solution for this is to tunnel the traffic through encrypted connection to servers in countries that respect persons privacy(if that is true nowadays). The easiest way is to use WireGuard, easy to set up uses only one port and have clients for many devices.

If you trust your vps dns, easiest way would be autossh -D and set your browser's socks5 proxy to localhost: and tell it to use remote dns when resolving domains. This requires no wireguard setup, no certificate generation or anything.

I've been doing both and have to say Wireguard is much more performant and stable than an ssh tunnel. Besides, it shouldn't be too hard to set it up on a VPS.

Re: Thai Database Leaks 8.3B Internet Records

#17

Post by jgaa »

lisk1 wrote: post #7

Solution for this is to tunnel the traffic through encrypted connection to servers in countries that respect persons privacy(if that is true nowadays). The easiest way is to use WireGuard, easy to set up uses only one port and have clients for many devices.

> ... countries that respect persons privacy

May be a long time ago, in a galaxy far away, such a thing once existed. It's a sweet thought though.

Re: Thai Database Leaks 8.3B Internet Records

#18

Post by peteretep »

lisk1 wrote: post #7

Solution for this is to tunnel the traffic through encrypted connection to servers in countries that respect persons privacy(if that is true nowadays). The easiest way is to use WireGuard, easy to set up uses only one port and have clients for many devices.

Thailand has some new and strong privacy laws:

https://www.insideprivacy.com/data-privacy/thailand-passes-p...

Re: Thai Database Leaks 8.3B Internet Records

#19

Post by sirn »

baicunko wrote: post #5

This is something that the average user fails to understand. One thing is saying I don't care they check on what I visit but once you aggregate enough information, it can become something of a "Big Brother". With enough DNS data I can assure you I can see when you leave to work, get back, determine the moment when you leave for vacation and no one is home, etc.

(Disclosure: I'm Thai)

Especially in Thailand, where free speech is almost non-existent.

Few months ago there were Twitter user who goes by the name "Anonymous" ("นิรนาม" in Thai) who have been arrested for spreading fake news and being a threat to the country. The Twitter user mainly tweets about topics subjected to lèse-majesté law. He never leave any traces, which leaves question on how officials managed to track him down if Twitter claims they didn't received any requests from our government.

My small group of friend came up with one scenario where official sent a honeypot URL via Twitter DM, then trace him via DNS query logs. This is assuming the scenario where he don't click on random links and using a browser that performs DNS prefetching of sorts. Everyone thought it was unlikely at the time, partly because nobody thought ISP would actually logging all DNS queries.

Apparently, all of us were wrong, at least on the latter.

Post reply on HN