Chromium's Impact on Root DNS Traffic

Post by HALtheWise » Fri, Aug 21, 2020, 1:25 PM UTC

Semaphor wrote: post #51

elric wrote: post #26

I don't get this feature. And I really hate that it's present in pretty much every browser these days. If I want to type an URL, I'll use the address bar. If I want to search, I'll use the search bar. Different bars with different keyboard shortcuts and different purposes. Why do so many browsers merge these two? Screens are insanely wide these days, so screen real estate can't be the reason. Are we trying to trick u…

On FF it’s Ctrl+k for searching (by prepending `? `) and Ctrl+l for addresses (if it can be parsed as an address). I almost never just click into the bar, so that works fine for me.

Post by iso1631 » Fri, Aug 21, 2020, 1:43 PM UTC

londons_explore wrote: post #108

iso1631 wrote: post #104

Earlier quoted context omitted.

I don't understand why browser vendors should be involved My browser should ask my OS to resolve DNS It's my OS's responsibility to do that - maybe sending a request to a remote server, maybe running it's own resolved, maybe using DoT, DoH, DNSSec or not What business should it be of browser vendors?

The OS resolves DNS names to IP addresses... Except an IP address isn't a security identifier of any kind, so there is no benefit to it not being spoofed. The relation to browser vendors is that DNSSEC allows DNS to verify/validate certificates for TLS connections, which can be used by web browsers (and other applications, but web browsers would be the main users).

Post by ananonymoususer » Fri, Aug 21, 2020, 2:04 PM UTC

zootboy wrote: post #24

ananonymoususer wrote: post #18

Earlier quoted context omitted.

And for those who don't understand why this is a bad thing, I will present my own use case. I run pi-hole at home and frequently work from there for another company. That company has provided me with a laptop that uses Cisco's DNS "Umbrella", which is some sort of security feature: https://docs.umbrella.com/deployment-umbrella/docs/point-you... Because my company laptop doesn't pay attention to the DNS servers recomm…

> THIS IS ALWAYS A BAD IDEA because once any account is compromised, ALL OTHER ACCOUNTS with locally stored keys ARE ALSO COMPROMISED. This is not universally true. If you generate separate private keys for each server-client pair, compromising one private key will limit the damage to just the one server.

Post by shawnz » Fri, Aug 21, 2020, 2:14 PM UTC

ananonymoususer wrote: post #115

zootboy wrote: post #24

Earlier quoted context omitted.

> THIS IS ALWAYS A BAD IDEA because once any account is compromised, ALL OTHER ACCOUNTS with locally stored keys ARE ALSO COMPROMISED. This is not universally true. If you generate separate private keys for each server-client pair, compromising one private key will limit the damage to just the one server.

That is just not true. It may be the case if the key itself is compromised, but consider that you may have many different accounts scattered on different servers. Once one of them is compromised, the attacker now has access to every other account because they are all chained together.

Post by JeremyBanks » Fri, Aug 21, 2020, 2:17 PM UTC

rfoo wrote: post #110

bo1024 wrote: post #106

Earlier quoted context omitted.

This post contains a bunch of information about the question, but it doesn't seem to actually address the question. The question is: does Chromium send the first word I type to my ISP? The answer appears to be: yes.

> the first word No. The answer appears to be yes if you said "the only word", though.