Earlier quoted context omitted.
Ctrl+K for Windows users looking for a shortcut key.
That works on multiple platforms! I'm able to do that on Arch.
[deleted]
Chromium's Impact on Root DNS Traffic
101–110 of 221 posts
Re: Chromium's Impact on Root DNS Traffic
#102Wait, so Chrome leaks the first word of my searches to my ISP? That doesn’t sound like something I want to happen
Not exactly. Chrome doesn't know if you're trying to enter a domain name, hence URL, or are trying to enter a search term. The Omnibar supports both. So Chrome tries to resolve the string you entered and if it gets back an NXDOMAIN it can assume that it's a search term.
The problem is that some ISPs have configured their DNS resolvers to lie and not return NXDOMAIN. Instead redirecting you to some website for marketing purposes. The Chromium workaround is to try and detect if it is using a lying DNS resolver by issuing queries that it knows SHOULD return an NXDOMAIN.
If this concerns you run your own resolver, enable DNSSEC validation, and enable aggressive NSEC caching(RFC 8198).
Re: Chromium's Impact on Root DNS Traffic
#103Earlier quoted context omitted.
There was a point where, at least in the US, this was standard behaviour for virtually every single major ISP and mobile provider. Several used to hijack all port 53 traffic to disallow you from using anything but their resolver.
And for those who don't understand why this is a bad thing, I will present my own use case. I run pi-hole at home and frequently work from there for another company. That company has provided me with a laptop that uses Cisco's DNS "Umbrella", which is some sort of security feature: https://docs.umbrella.com/deployment-umbrella/docs/point-you... Because my company laptop doesn't pay attention to the DNS servers recomm…
> should instead be using RSA keys for ssh.
No, you should be using ed25519 keys
> THIS IS ALWAYS A BAD IDEA because once any account is compromised, ALL OTHER ACCOUNTS with locally stored keys ARE ALSO COMPROMISED.
Not if you use passphrases on the key, generally together with an ssh agent, which is the best practice
Re: Chromium's Impact on Root DNS Traffic
#104Earlier quoted context omitted.
This comment, and another one mentioning DNSSEC has been downvoted. Please explain why you hate DNSSEC instead of downvoting things you disagree with.
Browser vendors seem to have shelved all work on DNSSEC for reasons they haven't publically stated. It had such promises to be able to reduce trust in CA's by pinning HTTPS certificates to DNS responses, so was exactly what browsers would have wanted, yet still all work stopped around 2015 or so. To me, it's as if DNSSEC has some critical and unfixable security vulnerability, and people who make these decisions decid…
I don't understand why browser vendors should be involved
My browser should ask my OS to resolve DNS
It's my OS's responsibility to do that - maybe sending a request to a remote server, maybe running it's own resolved, maybe using DoT, DoH, DNSSec or not
What business should it be of browser vendors?
Re: Chromium's Impact on Root DNS Traffic
#105Earlier quoted context omitted.
Browser vendors seem to have shelved all work on DNSSEC for reasons they haven't publically stated. It had such promises to be able to reduce trust in CA's by pinning HTTPS certificates to DNS responses, so was exactly what browsers would have wanted, yet still all work stopped around 2015 or so. To me, it's as if DNSSEC has some critical and unfixable security vulnerability, and people who make these decisions decid…
That blog post is five years old, and most of the things it lists are now moot.
True, but dnssec is still going nowhere...
The future seems to be HTTPS with domain-validated certificates over insecure DNS, or even dnssec but doing the http challenge over an insecure network.
Great for state actors to inject malware into any site...
Re: Chromium's Impact on Root DNS Traffic
#106Wait, so Chrome leaks the first word of my searches to my ISP? That doesn’t sound like something I want to happen
Not exactly. Chrome doesn't know if you're trying to enter a domain name, hence URL, or are trying to enter a search term. The Omnibar supports both. So Chrome tries to resolve the string you entered and if it gets back an NXDOMAIN it can assume that it's a search term. The problem is that some ISPs have configured their DNS resolvers to lie and not return NXDOMAIN. Instead redirecting you to some website for marketi…
This post contains a bunch of information about the question, but it doesn't seem to actually address the question.
The question is: does Chromium send the first word I type to my ISP?
The answer appears to be: yes.
Re: Chromium's Impact on Root DNS Traffic
#107Earlier quoted context omitted.
Not exactly. Chrome doesn't know if you're trying to enter a domain name, hence URL, or are trying to enter a search term. The Omnibar supports both. So Chrome tries to resolve the string you entered and if it gets back an NXDOMAIN it can assume that it's a search term. The problem is that some ISPs have configured their DNS resolvers to lie and not return NXDOMAIN. Instead redirecting you to some website for marketi…
This post contains a bunch of information about the question, but it doesn't seem to actually address the question. The question is: does Chromium send the first word I type to my ISP? The answer appears to be: yes.
I justed tested this myself via logging the DNS queries, and yes, this is true.
Re: Chromium's Impact on Root DNS Traffic
#108Earlier quoted context omitted.
Browser vendors seem to have shelved all work on DNSSEC for reasons they haven't publically stated. It had such promises to be able to reduce trust in CA's by pinning HTTPS certificates to DNS responses, so was exactly what browsers would have wanted, yet still all work stopped around 2015 or so. To me, it's as if DNSSEC has some critical and unfixable security vulnerability, and people who make these decisions decid…
I don't understand why browser vendors should be involved My browser should ask my OS to resolve DNS It's my OS's responsibility to do that - maybe sending a request to a remote server, maybe running it's own resolved, maybe using DoT, DoH, DNSSec or not What business should it be of browser vendors?
The OS resolves DNS names to IP addresses... Except an IP address isn't a security identifier of any kind, so there is no benefit to it not being spoofed.
The relation to browser vendors is that DNSSEC allows DNS to verify/validate certificates for TLS connections, which can be used by web browsers (and other applications, but web browsers would be the main users).
Re: Chromium's Impact on Root DNS Traffic
#109Verisign has nobody but themselves to blame, for "inventing" this with its SiteFinder fiasco in 2003.
oh wow, I remember that and how it broke so many scripts and processes. It's what some of these crappy ISP DNS servers do, except for the entire .com/.net TLDs around the planet.
Re: Chromium's Impact on Root DNS Traffic
#110Earlier quoted context omitted.
Not exactly. Chrome doesn't know if you're trying to enter a domain name, hence URL, or are trying to enter a search term. The Omnibar supports both. So Chrome tries to resolve the string you entered and if it gets back an NXDOMAIN it can assume that it's a search term. The problem is that some ISPs have configured their DNS resolvers to lie and not return NXDOMAIN. Instead redirecting you to some website for marketi…
This post contains a bunch of information about the question, but it doesn't seem to actually address the question. The question is: does Chromium send the first word I type to my ISP? The answer appears to be: yes.
> the first word
No.
The answer appears to be yes if you said "the only word", though.