Gaming the system seems to be the secret to winning.
Gaming the system is as sustainable as winning at casino.
It's fun while it lasts.
I fought my ISP's bad behavior and won
21–30 of 115 posts
Re: I fought my ISP's bad behavior and won
#22Super shady stuff. I never rely on any ISP provided DNS servers. I'm glad you talked to the the etailers to let them know what was going on. These business practices do introduce latency, regardless of what he told you. Not to mention, they are highly unethical and dishonest.
A really shady ISP could intercept and redirect any outgoing port 53 traffic to their servers.
Re: I fought my ISP's bad behavior and won
#23Earlier quoted context omitted.
I think so too, though CDN's will mess with the results a bit. It would be nice if DNS had a way to sign/validate/somehow know the record you got was correct. Especially on the apex record as it can happen before ssl.
CDNs will indeed mess with the results, but it would still likely be possible to tell the difference between a legitimate result and a forged one, especially if you know something about the CDN structures used by major site. And the more people run it, the more likely you can detect anomalies, much like Perspectives does for SSL. SSL, incidentally, seems like a major help here: you could detect common DNS hijackings…
http://perspectives-project.org/
Perspectives is a new approach to helping computers communicate securely on the Internet. With Perspectives, public “network notary” servers regularly monitor the SSL certificates used by 100,000s+ websites to help your browser detect “man-in-the-middle” attacks without relying on certificate authorities.
Re: I fought my ISP's bad behavior and won
#24Super shady stuff. I never rely on any ISP provided DNS servers. I'm glad you talked to the the etailers to let them know what was going on. These business practices do introduce latency, regardless of what he told you. Not to mention, they are highly unethical and dishonest.
A really shady ISP could intercept and redirect any outgoing port 53 traffic to their servers.
If that were the case, I would immediately terminate any relationship with them and out them in public. While technically possible, you're now talking about a whole other form of dishonest behavior. Some would say criminal.
Re: I fought my ISP's bad behavior and won
#25Earlier quoted context omitted.
A really shady ISP could intercept and redirect any outgoing port 53 traffic to their servers.
If that were the case, I would immediately terminate any relationship with them and out them in public. While technically possible, you're now talking about a whole other form of dishonest behavior. Some would say criminal.
This has been done. I'm not sure how prevalent it is now.
Re: I fought my ISP's bad behavior and won
#26This also shows a weakness in DNS. There is currently no way to validate the DNS record you’re being served is what the person hosting the website intended. That's what DNSSEC is for, but it hasn't become pervasive enough yet to be able to depend on it.
Sadly DNSSEC kinda sucks. Here's some earlier discussion on HN, with a lot of links. (Namedrop: tptacek is against DNSSEC and talks about it in the link.)
https://news.ycombinator.com/item?id=5937004
TLDR: DNSSEC is kinda complex and hacko, doesn't protect you as much as you might think, and introduces a whole new PKI that you should probably trust even less than the current ones. But read the links above for the real story.
I'm using DNSCrypt right now, which (correct me if I'm wrong) protects against DNS interception by my ISP, and seems like a whole lot less trouble than DNSSEC.
Re: I fought my ISP's bad behavior and won
#27One a slightly related note, in Chrome extensions, it's possible to redirect DNS requests on a per-URL basis. This is how Media Hint works to allow non-US Netflix users access the US version of the site. I'm surprised we haven't seen similar behaviour from Chrome extensions. I'm sure it would be caught eventually, but this isn't exactly something that people tend to look for, so it would take a while for people to ca…
> I'm surprised we haven't seen similar behaviour from Chrome extensions
The "Window Resizer" Chrome extension got a silent update a few weeks ago. It rewrote all the links on Google search result pages to point to a proxy that added affiliate links where possible.
Re: I fought my ISP's bad behavior and won
#28This is why you should encrypt your DNS.
Do you have a link to a usable encrypted DNS solution? I searched but didn't find anything actively used, but a lot of proposals.
DNSCrypt http://www.opendns.com/technology/dnscrypt/
This works well for me. But I have found that this is the kind of thing where an expert can pop in and say "have you considered risk X with solution Y?" and leave me dumbfounded.
So use at your own risk.
Re: I fought my ISP's bad behavior and won
#29"I will continue to monitor periodically their DNS entries and compare them with other public DNS servers." This would make for a great watchdog site to provide visibility across different ISPs (and could also discourage other ISPs from pulling this crap).
I think so too, though CDN's will mess with the results a bit. It would be nice if DNS had a way to sign/validate/somehow know the record you got was correct. Especially on the apex record as it can happen before ssl.
Isn't that exactly what DNSSEC is? Unfortunately not all that many domains are using it today.
Re: I fought my ISP's bad behavior and won
#30This is why you should encrypt your DNS.
Do you have a link to a usable encrypted DNS solution? I searched but didn't find anything actively used, but a lot of proposals.
You can easily setup a VPN and use the DNS servers on the other side. Connecting to the VPN can be done via IP.