Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I fought my ISP's bad behavior and won

erichelgeson.github.io

Post reply on HN
Print view View original

91–100 of 115 posts

Re: I fought my ISP's bad behavior and won

#91

Post by aendruk »

mhurron wrote: post #65
aendruk wrote: post #64

Earlier quoted context omitted.

My ISP [1] actually does this. They offer an opt-out of NXDOMAIN hijacking, but silently proxy all port 53 traffic regardless. This experience has taught me simply to distrust the DNS protocol in its current form and use DNSCrypt in all situations. [1]: Shaw Communications, chosen by the landlord. [2]: http://dnscrypt.org/

Are you using Shaw's DNS servers? I don't remember dealing with NXDOMAIN issues when I had Shaw, but I have run my own DNS servers for a long time now. It's been 7 years or so since I used Shaw.

It doesn't matter what DNS servers I specify; Shaw intercepts all DNS requests. I can even make up a nonexistent DNS server as long as it's internet-routable, and will get a valid response from Shaw. This works, for example:

  dig @www.facebook.com news.ycombinator.com

Re: I fought my ISP's bad behavior and won

#92

Post by mike-cardwell »

aendruk wrote: post #64
helfire wrote: post #22

Earlier quoted context omitted.

A really shady ISP could intercept and redirect any outgoing port 53 traffic to their servers.

My ISP [1] actually does this. They offer an opt-out of NXDOMAIN hijacking, but silently proxy all port 53 traffic regardless. This experience has taught me simply to distrust the DNS protocol in its current form and use DNSCrypt in all situations. [1]: Shaw Communications, chosen by the landlord. [2]: http://dnscrypt.org/

DNSCrypt is useless. Yeah, they can't see that you did a DNS A record lookup for www.example.com, but they can still see your subsequent TCP connection to the IP you received in your encrypted DNS response, and see the HTTP Host header that your browser sends. Even if it's a HTTPS connection, modern browsers leak the hostname then too, due to SNI.

Signing DNS responses has much more value than encrypting them.

If you set up DNSCrypt with OpenDNS, you're not improving the situation. You're just adding an additional third party that can see what you're doing.

Re: I fought my ISP's bad behavior and won

#93

Post by mike-cardwell »

IvyMike wrote: post #26
lambda wrote: post #11

This also shows a weakness in DNS. There is currently no way to validate the DNS record you’re being served is what the person hosting the website intended. That's what DNSSEC is for, but it hasn't become pervasive enough yet to be able to depend on it.

Sadly DNSSEC kinda sucks. Here's some earlier discussion on HN, with a lot of links. (Namedrop: tptacek is against DNSSEC and talks about it in the link.) https://news.ycombinator.com/item?id=5937004 TLDR: DNSSEC is kinda complex and hacko, doesn't protect you as much as you might think, and introduces a whole new PKI that you should probably trust even less than the current ones. But read the links above for the rea…

"protects against DNS interception by my ISP"

Your ISP can still see the IP address of every web server that you connect to, and can still see the "Host" header that your browser sends in HTTP requests, and also in HTTPS requests (due to SNI) if you're using a reasonably modern OS/Browser combo.

All you've done is add an additional third party that can view and log what you're doing.

Re: I fought my ISP's bad behavior and won

#94

Post by zquestz »

jlgaddis wrote: post #78
zquestz wrote: post #68

Eric, I am very sorry to see this happen to you. Unfortunately more and more companies are using our data for marketing purposes. All is not lost though. There are several ways you can protect yourself from these practices. The first thing I would do is get a router capable of using dnscrypt-proxy ( http://www.opendns.com/technol... . Then you can be confident that your DNS traffic is not being modified by your ISP.…

> It does require that you have trust in a 3rd party DNS provider like OpenDNS ... The same OpenDNS that hijacks NXDOMAIN responses?

I only said OpenDNS was one of the options. There are many DNSCrypt enabled servers not run by OpenDNS. Seems anytime someone event mentions OpenDNS the same arguments get brought back up. If you don't like OpenDNS, then use DNSCrypt with another server. Simple solution.

Re: I fought my ISP's bad behavior and won

#95

Post by emilv »

goldenkey wrote: post #42
neil_s wrote: post #36

Interestingly, you might have benefitted more from keeping quiet about this. While the original retailers are losing money through this, you aren't really affected negatively by them doing it. In fact, with this additional revenue source, they might be able to support thinner margins on their broadband charges, saving you some money. You did the morally correct thing, but perhaps at a potential personal cost.

The affiliates are getting hurt hugely though. Affiliate profits are supposed to be for helping the purchase - through marketing efficiency. The ISP is doing none of that, they are simply mafiosoing affiliate dollars through hijack. Amazon would not like this, the ISP gives exactly 0% efficiency boost to the e-commerce process, they're just a gypsie snake.

Why did you have to end an otherwise good answer with a racist slur?

Re: I fought my ISP's bad behavior and won

#96

Post by helfire »

natch wrote: post #58

I'd like to try out this curl command. I'm not using macports, though. Like many people, I've switched to brew since some time. Is there a quick way to see if my curl install is compiled with 'ares' whatever that is?

Also looks like MacOS 10.9 has ares by default.

Re: I fought my ISP's bad behavior and won

#97

Post by gwu78 »

aendruk wrote: post #91
mhurron wrote: post #65

Earlier quoted context omitted.

Are you using Shaw's DNS servers? I don't remember dealing with NXDOMAIN issues when I had Shaw, but I have run my own DNS servers for a long time now. It's been 7 years or so since I used Shaw.

It doesn't matter what DNS servers I specify; Shaw intercepts all DNS requests. I can even make up a nonexistent DNS server as long as it's internet-routable, and will get a valid response from Shaw. This works, for example: dig @www.facebook.com news.ycombinator.com

All that means is that you're using their recursive DNS servers. They can configure these any way they choose. Stop using third party recursive DNS servers and you will not have problems with unwanted advertising and NXDOMAIN hijacking.

Run your own recurive DNS server (e.g. dnscache) on 127.0.0.1.

Alternatively, query authoritative servers directly. Use a port other than 53 if you really think your ISP is trying to filter your outgoing queries; I sincerely doubt they would bother.

192.5.6.30 is an authoritative .com server. Memorize that number.

dig +norecurse -b0.0.0.0#5353 news.ycombinator.com @192.5.6.30

The names on the right of the "NS" rows are the authoritative servers for ycombinator.com. (Cloudflare. No comment.)

192.5.6.30 has the IP addresses for those. You'll find them in the "ADDITIONAL SECTION". Let's say it lists 1.2.3.4 as an IP address.

dig +norecurse -b0.0.0.0#5353 news.ycombinator.com @1.2.3.4

And you should receive the IP address for news.ycombinator.com, or at least your next clue where to look (if the DNS admin has chosen to play games with CNAME).

This method can be automated.

Your ISP is not "intercept[ing] all DNS requests". You are sending your requests to your ISP's recursive DNS servers (why?), and those servers are feeding you whatever information the ISP chooses. Go figure, they are sending you bogus info to inject advertising. Solution: Stop sending your requests to your ISP's recursive DNS servers (or any third party recursive DNS servers). Send your requests to your own recursive DNS server running on 127.0.0.1, or send nonrecursive requests to authoritative DNS servers only.

Re: I fought my ISP's bad behavior and won

#98

Post by ars_technician »

mike-cardwell wrote: post #93
IvyMike wrote: post #26

Earlier quoted context omitted.

Sadly DNSSEC kinda sucks. Here's some earlier discussion on HN, with a lot of links. (Namedrop: tptacek is against DNSSEC and talks about it in the link.) https://news.ycombinator.com/item?id=5937004 TLDR: DNSSEC is kinda complex and hacko, doesn't protect you as much as you might think, and introduces a whole new PKI that you should probably trust even less than the current ones. But read the links above for the rea…

"protects against DNS interception by my ISP" Your ISP can still see the IP address of every web server that you connect to, and can still see the "Host" header that your browser sends in HTTP requests, and also in HTTPS requests (due to SNI) if you're using a reasonably modern OS/Browser combo. All you've done is add an additional third party that can view and log what you're doing.

>All you've done is add an additional third party that can view and log what you're doing.

You forgot the part where it's protecting against trashy ISPs like the one in this article.

Re: I fought my ISP's bad behavior and won

#99

Post by ars_technician »

mike-cardwell wrote: post #92
aendruk wrote: post #64

Earlier quoted context omitted.

My ISP [1] actually does this. They offer an opt-out of NXDOMAIN hijacking, but silently proxy all port 53 traffic regardless. This experience has taught me simply to distrust the DNS protocol in its current form and use DNSCrypt in all situations. [1]: Shaw Communications, chosen by the landlord. [2]: http://dnscrypt.org/

DNSCrypt is useless. Yeah, they can't see that you did a DNS A record lookup for www.example.com, but they can still see your subsequent TCP connection to the IP you received in your encrypted DNS response, and see the HTTP Host header that your browser sends. Even if it's a HTTPS connection, modern browsers leak the hostname then too, due to SNI. Signing DNS responses has much more value than encrypting them. If you…

Why do you keep posting this? It's irrelevant because the idea isn't to hide what site you're visiting, it's to prevent the ISP from modifying the DNS responses. Signing DNS responses would be helpful if that was actually enforced anywhere.

DNSCrypt is a perfectly fine solution for this threat model.

Re: I fought my ISP's bad behavior and won

#100

Post by ars_technician »

gwu78 wrote: post #97
aendruk wrote: post #91

Earlier quoted context omitted.

It doesn't matter what DNS servers I specify; Shaw intercepts all DNS requests. I can even make up a nonexistent DNS server as long as it's internet-routable, and will get a valid response from Shaw. This works, for example: dig @www.facebook.com news.ycombinator.com

All that means is that you're using their recursive DNS servers. They can configure these any way they choose. Stop using third party recursive DNS servers and you will not have problems with unwanted advertising and NXDOMAIN hijacking. Run your own recurive DNS server (e.g. dnscache) on 127.0.0.1. Alternatively, query authoritative servers directly. Use a port other than 53 if you really think your ISP is trying to…

Did you even read his comment?

"dig @www.facebook.com news.ycombinator.com" does not use the ISP's DNS servers at all. It sends a DNS query to Facebook for Google, which should normally fail. His ISP hijacks the request and provides a response. In this scenario, the advice in your comment is pointless because they will hijack requests whether they are directly to authoritative servers or if they are to recursive servers.

Post reply on HN