Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI now recommends using an ad blocker when searching the web

standard.co.uk

Post reply on HN
Print view View original

401–410 of 445 posts

Re: The FBI now recommends using an ad blocker when searching the web

#401

Post by giobox »

dngray wrote: post #274
mmsc wrote: post #169

Earlier quoted context omitted.

DoH uses UDP, not TCP. Unless you're using HTTP3/QUIC, you can block port 443/UDP. And hey, maybe one day advertisements will be served directly via IP addresses, not domains:)

> DoH uses UDP, not TCP. Unless you're using HTTP3/QUIC, you can block port 443/UDP. There's actually two protocols DNS over QUIC https://datatracker.ietf.org/doc/rfc9250/ which has a specific port 853. This can be blocked. Then there is DNS over HTTP3 https://security.googleblog.com/2022/07/dns-over-http3-in-an...

While these are two common standards, you can easily implement DoH almost anyway you want if you are building a service or device. Its just replying to a request for a hostname record over HTTPS fundamentally - it can be as simple as an extra REST API you run. The number of "protocols" here is effectively limitless. I cant stress enough how simple it can be - check the specs you linked, the example HTTP request/response for the DNS over HTTP3 example is really basic - you could build your own in less than an hour if you really wanted and understand how traditional DNS works.

There is no such thing as right or wrong way to do DoH so long as the DNS messages are passing over HTTPS - the standards are largely to help make it easier to deploy and avoid common pitfalls of course (simpler to integrate to browsers and other software "for free" if the message response body format is standardised), but devices, apps and even javascript in the browser are free to solve this anyway they want, with whatever kind of message payload they can dream up.

DoH is just an HTTP request over SSL in most implementations, nothing more, with the record usually in the payload body in a JSON message or similar.

Re: The FBI now recommends using an ad blocker when searching the web

#402

Post by JohnFen »

LinuxBender wrote: post #389
JohnFen wrote: post #384

Earlier quoted context omitted.

You should consider filtering your HTTPS streams.

Funny you should mention that. I have a few Squid-SSL-Bump proxies that I use for a few devices. For several years I even used that to visit HN and to my surprise was rarely rate limited or blocked when accessing from a VPS. With Squid I can also make decisions on content types, file sizes and more. There are only a handful of sites it doesn't work with because they for whatever reason are still using public key pinn…

> This only works with devices that I can install my own CA key onto

Yes, that's why I don't use any commercial IoT devices. I have no actual control over them. Before I shed the few I did have, I kept them segregated on their own subnet so that at least their presence didn't have to impact anything else.

Re: The FBI now recommends using an ad blocker when searching the web

#403

Post by JohnFen »

josephcsible wrote: post #390
JohnFen wrote: post #385

Earlier quoted context omitted.

> It's only true when all of the computers on it are too. I was unclear. This is exactly the case I'm talking about. The network, and all of the devices on the network, are mine. > What? No it doesn't. It does. It makes it easier for bad actors -- mostly advertising networks -- to bypass my DNS filtering. They can do it all with their own code, encrypted through HTTPS to hide it, and never touch my DNS systems, nor b…

> It makes it easier for bad actors -- mostly advertising networks -- to bypass my DNS filtering. They can do it all with their own code, encrypted through HTTPS to hide it, and never touch my DNS systems, nor be affected by browser settings. If that makes DoH bad, then privacy is bad too since it makes it easier for terrorists and pedophiles to evade the law.

On my network, running my machines, these privacy mechanisms really are bad. Having them doesn't give me any privacy (the entire system is my private system to begin with -- who am I being private from?).

The only privacy they are affording is specifically to entities that I don't want operating on my machines to begin with, who are mostly interested in violating my privacy.

So this privacy mechanism, in this use case, really is bad because it reduces my privacy.

Re: The FBI now recommends using an ad blocker when searching the web

#404

Post by JohnFen »

yubiox wrote: post #391
JohnFen wrote: post #386

Earlier quoted context omitted.

Yes, I've installed my own cert to negotiate HTTPS connections, then proxy through software to check the contents being sent. Basically the same process that some companies use for similar purposes.

This response is just handwaving and avoids the question. Why even bother?

Oh? I thought I answered it. What are you really asking for here? A tutorial?

If that's what you want, you need to give me time to put it together. I set this up a number of years ago and don't remember the details off the top of my head.

here's what I do remember: I use a squid proxy and replace all of the HTTPS certs on my other machines with my own. When HTTPS is negotiated, it's with my proxy, not the end destination.

Then the proxy does its proxy thing and sets up a normal HTTPS connection with the destination.

In my proxy, I have a script that is looking for the HTTP lookup exchanges detailed in RFC8484 (https://www.rfc-editor.org/rfc/rfc8484). When it finds them, it drops them on the floor. Everything else just gets passed through.

Re: The FBI now recommends using an ad blocker when searching the web

#405

Post by CatWChainsaw »

markx2 wrote: post #16
westcort wrote: post #3

Any recommendations for a good ad blocker and other precautions to take?

https://nextdns.io and then UBlock Origin, uMatrix, Noscript at least.

gorhill isn't updating uMatrix anymore. That said, I still use it in addition to uBO because I find it very intuitive to use.

Re: The FBI now recommends using an ad blocker when searching the web

#406

Post by iggldiggl »

dngray wrote: post #280
madars wrote: post #71

Or, in other words, FBI now recommends using Android :-) It's baffling how much better uBlock Origin + Firefox experience on Android is compared to any iOS ad blocker I have tried. They kind-of work but let half of the ads through.

Just be mindful that Firefox/Android doesn't have process isolation. https://www.privacyguides.org/mobile-browsers/#android This is because the desktop browser uses the full "Gecko" renderer, but mobile uses "GeckoView", that doesn't have that implemented yet.

GeckoView is literally Gecko with an Android API wrapped around it, so that sentence doesn't really explain anything.

The actual thing is that simply each app embedding Gecko needs to be brought up to speed separately, and if Android is lagging behind, it just is, "GeckoView" or not. (Even before the invention of GeckoView, due to understaffing Android Firefox used to lag behind in terms of multi-process capability, so nothing new under the sun…)

Re: The FBI now recommends using an ad blocker when searching the web

#407

Post by drusepth »

alwayslikethis wrote: post #321
drusepth wrote: post #37

Does anyone have any adblockers they recommend that still show "safe" ads (e.g. non-malware) by default, without having to whitelist every site? I'd be open to the security benefits of an adblocker if I could still passively support all the sites I visit. Edit: changed "good" to "safe" for clarity

If you want to harm advertisers while possibly support the sites, you can use AdNauseum, which basically does what uBlock Origin does, but will randomly access a percentage of the ads blocked, to waste the advertiser's money.

I don't particularly want to harm advertisers; I'm just interested in the proposed security benefits from OP. This does seem like a realistic middleground though. Thanks for the suggestion.

Re: The FBI now recommends using an ad blocker when searching the web

#408

Post by kerkeslager »

Eisenstein wrote: post #270
kerkeslager wrote: post #247

Earlier quoted context omitted.

Brave is directly financed by advertisers.

So? It still blocks ads.

Sure, but do they also not collect any analytics for their ads? Will that last through a financial crisis if advertisers offer them more money? Will it last if they gain market dominance?

If their money comes from advertisers and not users, they serve advertisers and not users. Supporting them as a temporary solution just means if they succeed we have all the same problems when the same incentives come into play.

Re: The FBI now recommends using an ad blocker when searching the web

#409

Post by jonas-w »

prima-facie wrote: post #79
staringback wrote: post #53

Earlier quoted context omitted.

DNS adblocking isn't even remotely comparable to ublock origin

Can you please elaborate on this? thanks

For example you visit coolblog.org and it tries to load coolblog.org/ad.js

dns blocking would only see the domain coolblog.org, and doesn't see that it loads ad.js, so it won't block anything.

But e.g. uBlock, also sees that your browser tries to visit ad.js, if uBlock had ad.js in its blocklists it can block loading this script.

Re: The FBI now recommends using an ad blocker when searching the web

#410

Post by dredmorbius »

hilbert42 wrote: post #344
dredmorbius wrote: post #230

Earlier quoted context omitted.

AFAIU it's all F-Droid apps that are GPS-free. I rely on a small handful of others installed from the Aurora, Google Play is a requirement for some of those. I may be hallucinating that shim, though I'm pretty sure it actually exists...

"...I rely on a small handful of others installed from the Aurora, Google Play is a requirement for some of those." Later thought. I also occasionally install Play Store apps via Aurora Store and it's worth noting that some state that they require Google Play Services but in fact they do work without it (I normally have GPS/Google Play disabled or uninstalled). I've not bothered to research why but I presume it's the…

I'll look into that, thanks.
Post reply on HN