Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: NextDNS Adds "Bypass Age Verification"

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 208 posts

Re: Show HN: NextDNS Adds "Bypass Age Verification"

#131

Post by aaronmdjones »

okasaki wrote: post #126
cluckindan wrote: post #104

Earlier quoted context omitted.

Sure they can. When your browser resolves a host, they replace the actual IP with the IP of a proxy that is configured to forward traffic according to the Host HTTP header.

You would have to install a certificate for that to work.

No you wouldn't.

The current situation:

- You ask Foo DNS Provider for the IP address of pornhub.com

- Foo DNS Provider responds with the real IP address

- You connect to that address, send a TLS ClientHello containing a Server Name Indication extension of "pornhub.com"

What could happen:

- You ask Foo DNS Provider for the IP address of pornhub.com

- Foo DNS Provider responds with one of their own IP addresses

- You connect to that address, send a TLS ClientHello containing a Server Name Indication extension of "pornhub.com"

- Foo DNS Provider now knows that you intend to connect there, so it connects there for you and relays your ClientHello to it

- Foo DNS Provider then just acts as a dumb relay, passing everything back and forth with no modifications

- The certificate verifies fine because the traffic was not modified and it was presented by the party who controls the corresponding private key

- The website thinks you are connecting from Foo DNS Provider, not your real address

The only thing that would break this is ECH (Encrypted ClientHello), currently supported only by CloudFlare and Google Chrome (and its derivatives) as far as I know. This security feature is provisioned with ... DNS records! So Foo DNS Provider can simply indicate that the records required for ECH do not exist, and your web browser wouldn't encrypt the ClientHello. It's already tampering with the responses to address lookups anyway, so DNSSEC wouldn't be an issue -- you simply would not expect to be able to validate anything.

Re: Show HN: NextDNS Adds "Bypass Age Verification"

#132

Post by lillecarl »

phatfish wrote: post #129
sksrbWgbfK wrote: post #125

Earlier quoted context omitted.

Absence of parenting is a bigger threat than privacy. I accidentally agree with you, even if you're wrong.

Parents don't follow their child 24/7. Society has a responsibility too. There is also the possibility of minors not knowing what they are clicking or kids with shitty parents destroying your hard work. Another non-parent with an irrelevant opinion.

Sounds like offloading bad parenting onto others, you're supposed to communicate with your kids about safety, there are solutions to restrict their devices to make the impulse control barrier higher.

If your kid goes out of their way to use a third party device without age restriction you can't stop them if they're determined either way, and no matter how right you think you are it still doesn't warrant destroying privacy for EVERYONE.

Re: Show HN: NextDNS Adds "Bypass Age Verification"

#133

Post by easymodex »

phatfish wrote: post #129
sksrbWgbfK wrote: post #125

Earlier quoted context omitted.

Absence of parenting is a bigger threat than privacy. I accidentally agree with you, even if you're wrong.

Parents don't follow their child 24/7. Society has a responsibility too. There is also the possibility of minors not knowing what they are clicking or kids with shitty parents destroying your hard work. Another non-parent with an irrelevant opinion.

Well I'm a parent and I disagree with you and agree with the other comments, what now?

Re: Show HN: NextDNS Adds "Bypass Age Verification"

#134

Post by jalk »

agos wrote: post #122
huhkerrf wrote: post #113

Earlier quoted context omitted.

I'm really surprised to see this pop up considering how the NextDNS team seems to have disappeared otherwise. Out of date offerings like you mentioned, coupled with 0 customer support when things break (and things break a lot). New features like this are fine only if the base service works. I can guess that this feature also is going to break soon, and I don't have high hopes for it getting fixed. I moved over to Con…

I went to see ControlD's website to see if it was any good but the chat thingy was trying to convince me by saying "protect your connection like the Coliseum protected Rome, try ControlD's free DNS", which I guess is a way of trying something funny since I'm connecting from Italy, but it does not inspire much confidence in their protection abilities

So it protects your connection by putting up a spectacle? (assuming it meant Colosseum)

Re: Show HN: NextDNS Adds "Bypass Age Verification"

#135

Post by pbhjpbhj »

Spivak wrote: post #51
petcat wrote: post #36

Earlier quoted context omitted.

> More and more sites (especially adult ones) are now forcing users to upload IDs or selfies to continue. > they might just get enough attention from voters to motivate a change Unfortunately, guaranteeing anonymous internet porno is a terrible political beachhead to motivate "voters" to do anything.

You don't have to sell it like that. The bill that needs to be passed is default presumption that all websites on the internet not explicitly marked as such and who voluntarily accept a higher legal burden and standard of moderation may contain content not suitable for children. And that is up to parents to control their child's internet access to limit their usage to only these sites. Because I don't actually care a…

You're asking for them to set up a system that won't be effective.

>And that is up to parents to control their child's internet access to limit their usage to only these sites.

This is an entirely unreasonable expectation on parents. I control web access at home, but I can't control it at school, or at their friend's houses. Nor do I have time, nor do I have access, to exert control over all the systems they come in contact with (even without their own device).

>it's all the other "not suitable for kids" content

Like what? Explicit violence?

Re: Show HN: NextDNS Adds "Bypass Age Verification"

#136

Post by tecleandor »

agos wrote: post #122
huhkerrf wrote: post #113

Earlier quoted context omitted.

I'm really surprised to see this pop up considering how the NextDNS team seems to have disappeared otherwise. Out of date offerings like you mentioned, coupled with 0 customer support when things break (and things break a lot). New features like this are fine only if the base service works. I can guess that this feature also is going to break soon, and I don't have high hopes for it getting fixed. I moved over to Con…

I went to see ControlD's website to see if it was any good but the chat thingy was trying to convince me by saying "protect your connection like the Coliseum protected Rome, try ControlD's free DNS", which I guess is a way of trying something funny since I'm connecting from Italy, but it does not inspire much confidence in their protection abilities

Mine (Spain) said "control your DNS like a flamenco singer" and it doesn't make sense at all. ¯\_(ツ)_/¯

Re: Show HN: NextDNS Adds "Bypass Age Verification"

#137

Post by 1dom »

huhkerrf wrote: post #113
pogue wrote: post #76

Hey @nextdns team. I'm a long time customer of NextDNS. I've been using your service for a few years now, but it seems a large amount of your primarily offered services & blocklist offerings are SEVERLY out of date. I detailed that here on Reddit: https://www.reddit.com/r/nextdns/s/IX2mUogHPK Your input on this thread would be greatly appreciated, as the community wants NextDNS to be the best service it can be. I do…

I'm really surprised to see this pop up considering how the NextDNS team seems to have disappeared otherwise. Out of date offerings like you mentioned, coupled with 0 customer support when things break (and things break a lot). New features like this are fine only if the base service works. I can guess that this feature also is going to break soon, and I don't have high hopes for it getting fixed. I moved over to Con…

Same here, I left NextDNS because I didn't trust it anymore. I started using it personally in homelab and just found it to be randomly a bit sluggish at times. Saw other similar reports. Tried to get support and failed. I saw it trying to sell itself as business capable DNS, and considered if it would fit in at work. Then I got an e-mail giving 7 days for me to disable and move all my logs out of the EU region. I was working at a large fintech firm at the time, and if a vendor had given us 1 week to rearchitect and figure out a new logging solution for DNS, we would have dropped them immediately due to the massive compliance issues they would have created.

The messaging around the change was very much "FYI we're deleting everything in 7 days in that region whether you're good or not, feel free to do what you want", e.g. creating problems with no interest in helping with solutions to those problems. This would all be fine for a free-tier service, but I was a paying customer. Even as a paying customer though, I paid virtually nothing.

Overall, NextDNS felt like it had the worst possible combination startup, passion project and beer money project features: I paid for it for a couple of years and got fed up because the amount talk about it gave the impression to me there was a fair and growing customer base but NextDNS were missing either the capability or focus to grow the service at the time. I'm conscious they'll be reading this - it was 2 years ago this happened, so maybe things have changed.

Re: Show HN: NextDNS Adds "Bypass Age Verification"

#138

Post by calgoo »

buyucu wrote: post #21
perihelions wrote: post #8

As a remark, not a criticism, such a deliberate promotion is probably illegal in the UK market, > "But Ofcom says platforms required to introduce "highly effective" methods to check user age must not host, share or permit content that encourages use of VPNs to get around age checks. The government has also told the BBC it would be illegal for platforms to do so." https://www.bbc.com/news/articles/cn72ydj70g5o

For people who don't live in the UK, why should they care about UK law?

Because the tech that is being implemented for the UK will now be available for any other country on request. Its one thing to try to force the companies to implement the solutions, its another to get your country added to the config of said implementation.

Re: Show HN: NextDNS Adds "Bypass Age Verification"

#139

Post by bluehatbrit »

tecleandor wrote: post #136
agos wrote: post #122

Earlier quoted context omitted.

I went to see ControlD's website to see if it was any good but the chat thingy was trying to convince me by saying "protect your connection like the Coliseum protected Rome, try ControlD's free DNS", which I guess is a way of trying something funny since I'm connecting from Italy, but it does not inspire much confidence in their protection abilities

Mine (Spain) said "control your DNS like a flamenco singer" and it doesn't make sense at all. ¯\_(ツ)_/¯

From the UK you get "Explore your rules like a London detective" which barely makes sense, and is an immediately makes me think it will be useless.

Re: Show HN: NextDNS Adds "Bypass Age Verification"

#140

Post by graemep »

atonse wrote: post #73

I use NextDNS to BLOCK porn sites, etc from my kids’ devices. I hope you aren’t changing your ethos as a company, although I don’t know, maybe your customers are changing and causing you to pivot. Because I don’t want any chance of this stuff affecting the blocks we use for minors, etc.

I doubt it will. It fits with what I hope is their ethos, which is to allow customers to decide what they want blocked for themselves and their households.
Post reply on HN