I wonder if it commercially would not make sense to build the opposite thing: a VPN that requires age verification that sites may whitelist. While it may seem nonsensical in the first place, because any VPN probably would allow this, however, it might put pressure on the sites to add a privacy friendly alternative. Not completely sure if creating an ' adult only' anonymous internet would be feasible. Thinking about it it would probably also create some dystopian dynamics if any more anonymous form of age verification would actually work. So I wonder if it make sense to simply join the chorus of all that hope it will fail big time. Probably the worst case would be if Google stepped in and offered something similar effective like Google play attestation.
Show HN: NextDNS Adds "Bypass Age Verification"
181–190 of 208 posts
Re: Show HN: NextDNS Adds "Bypass Age Verification"
#182Easily one of the best $20 I spend a year. Makes iOS so much more usable and I really love supporting the vision of the developers from NextDNS
Yep its my top IT reccomendation to everyone I know
Re: Show HN: NextDNS Adds "Bypass Age Verification"
#183Earlier quoted context omitted.
ID verification is done by 3rd parties. Nobody wants to hold a photo of your ID because it's a compliance nightmare. You aren't uploading your ID to some porn site, you are uploading it to some real-person verification company.
Not what I'm saying. At any time before the legit handoff, there can be a decoy which users would be blissfully unaware of, shimmed in. How many times do domains change again during the singup process of whatever service you're using (page to page)? Thats a huge security issue, as it messes with what users expect, and they dont take notice one bit. At the very least its an opportunity to confuse users not to realize…
You are making a vague argument.
Do you think it's inherently so unsafe to use your ID in an online context that it is never a net benefit? Yes/No
If you think it is unsafe, what alternative do you propose? If you don't have one, or your idea requires some kind of massive simultaneous buy in by all stakeholders and jurisdictions, give up, your opinion is irrelevant.
Re: Show HN: NextDNS Adds "Bypass Age Verification"
#184This sounds like a company using DNS to direct _other_ peoples' web traffic through _their_ proxies. Cloudflare started this way. That's why signing up for Cloudlfare requires using _Cloudflare's_ DNS servers The so-called "DNS trick", which is defintely not a trick, is to redirect traffic though a proxy server. Whoever operates the proxy, e.g. Cloudflare, NextDNS, etc., has control over the HTTPS traffic and _could_…
Generally, CDNs, e.g., Akamai, etc., are authoritative DNS providers that direct HTTP traffic to selected reverse proxies
When a customer gives a third party recursive DNS provider, e.g., NextDNS, etc., permission to "block" certain domains then the third party may act as an authoritative nameserver. Queries with RD==1 for A RRs of "blocked" domains not already cached do not need to be forwarded to an authoritative nameserver chosen or operated by the domain owner. The third party can answer these queries with whatever address it chooses, e.g., 0.0.0.0, rewrite the answers, etc.
Whether any third party DNS provider is abusing this permission^1 is not the point of this comment. The point is that delegating DNS to a third party makes it possible^2
1. This could be difficult to discover
2. For example, I have seen DNS caches that return A records for certain domains that do not match the A records returned by the domain's authoritative nameservers; sometimes the responses even falsely claim they are authoritative answers. Academic papers have been published about countries that implement censorship via DNS. Even in the US, it's common for third party DNS providers such as hotels and certain ISPs, including cellular providers, to intercept DNS traffic and direct it to their own caches, rewrite answers, etc. This includes nonrecursive queries to a domain's authoritative nameservers
Re: Show HN: NextDNS Adds "Bypass Age Verification"
#185It may not be effective in the long term, but I think it's very much worth doing. The privacy nightmare of uploading government docs is appalling and should be resisted by all who can, so I think you're doing great work. If it provokes regulators to push harder, they might just get enough attention from voters to motivate a change. That would be my hope anyway
It's a great idea to get rid of, I'm shocked a company is this brave to do this. It's not in the interest of any adult to upload their ID so the government can track their web browsing. I didn't want to expose my kid to porn when they were 5, somehow it wasn't a problem because the avg browser use was guided by me, but also the browser blocked porn. When they were a bit older, a teenager, I also lightly guided their…
The solution to spam is that everyone replies to the spam and engages up to the point that human labor is required, thus making it financially impractictable
The solution to this problem is not to provide YOUR ID but to provide AN ID, again and again, once per day. Again - cannot scale if a manual check is done by a human somewhere, flipside if it's fully automated now it's game-able
Re: Show HN: NextDNS Adds "Bypass Age Verification"
#186Do not promote or use NextDNS, it's essentially abandoned. You will not get any support from the developer when something breaks, and it will break. I tried for a year to contact him before abandoning it. Just check the help forums.
I've used nextDNS for years but the past few weeks its been breaking websites left, right and centre so I gave up on it entirely. Everything feels much snappier since I dropped them for a different option too
It would appear that you are not familiar with its proper use. You can identify which rule is causing the issue by reviewing the log, and then add it to your allowlist.
Re: Show HN: NextDNS Adds "Bypass Age Verification"
#187Sorry to get on to a related topic, since the NextDNS team may be looking at these comments. Is there any plan at all to revive the iOS app (last updated in 2020) so that the toggle in the app actually works? I don’t like installing a NextDNS profile because it doesn’t offer the flexibility to turn it off or on as needed. The app used to work pre-2020, but doesn’t now. On my iPhone, at any given date and time, it’s j…
I‘m also using the iOS App and I think you need to wait a bit after using the toggle because the DNS requests might be cached by the Browser
Parent might also be getting bit by Apple's iCloud Private Relay and/or the "Hide IP Address" feature of Safari.
Re: Show HN: NextDNS Adds "Bypass Age Verification"
#188This sounds like a company using DNS to direct _other_ peoples' web traffic through _their_ proxies. Cloudflare started this way. That's why signing up for Cloudlfare requires using _Cloudflare's_ DNS servers The so-called "DNS trick", which is defintely not a trick, is to redirect traffic though a proxy server. Whoever operates the proxy, e.g. Cloudflare, NextDNS, etc., has control over the HTTPS traffic and _could_…
No, I don't think they are proxying traffic. They are giving the website operators a spoofed EDNS Client Subnet which tricks them into thinking the traffic is coming from a different geolocation.
Re: Show HN: NextDNS Adds "Bypass Age Verification"
#189Earlier quoted context omitted.
It likely overrides DNS resolution to CDN/POPs in countries which don't require age checking, or routes the traffic through TCP proxies so your traffic appears to come from a different country without these laws. This will increase the latency of all traffic to that site though.
> It likely overrides DNS resolution to CDN/POPs in countries which don't require age checking, I don't understand what this means: 1. It resolves DNS requests - got it. 2. The resolution sends back an address to a CDN - okay, not sure that I got it 3. The resolved address is in a country which doesn't require age checking - Totally don't get it: how will this help?
They're (ab)using the EDNS Client Subnet feature:
Re: Show HN: NextDNS Adds "Bypass Age Verification"
#190Earlier quoted context omitted.
You would have to install a certificate for that to work.
No you wouldn't. The current situation: - You ask Foo DNS Provider for the IP address of pornhub.com - Foo DNS Provider responds with the real IP address - You connect to that address, send a TLS ClientHello containing a Server Name Indication extension of "pornhub.com" What could happen: - You ask Foo DNS Provider for the IP address of pornhub.com - Foo DNS Provider responds with one of their own IP addresses - You…
This is wrong. It shows a fundamental misunderstanding of how certificate authorities (CAs) work.
A certificate has to be signed by a trusted CA (one your browser already trusts).
A DNS provider could mint a self-signed cert for pornhub.com, but your browser would reject it immediately.
Even if they tried to trick a real CA, Certificate Transparency (CT) would expose the bogus certificate:
https://en.wikipedia.org/wiki/Certificate_Transparency
Instead, NextDNS is very likely abusing the EDNS Client Subnet feature to provide website operators with a spoofed client location. Much more simple and less nefarious.