131–140 of 221 posts
I think I've understood the most of the article but I missed the initial part. Why is there a probe in Chrome that uses DNS to query random 7-15 character long hostnames, only to get NXDOMAIN and burden the root nameservers? What does this probe achieve?
Some DNS providers (like ISPs) will hijack NXDOMAINs and redirect you to ads or stuff like that. Chrome wants to detect that.
Earlier quoted context omitted.
The OS resolves DNS names to IP addresses... Except an IP address isn't a security identifier of any kind, so there is no benefit to it not being spoofed. The relation to browser vendors is that DNSSEC allows DNS to verify/validate certificates for TLS connections, which can be used by web browsers (and other applications, but web browsers would be the main users).
Shouldn't it be up to my OS to do that validation though, not the browser? After all when I ssh to my.server.com I want the same guarentee as when I https to it.
If you ssh to a server your OS will resolve the IP, but your SSH client will request and attempt to verify the server key. Same with browsers and HTTP.
Earlier quoted context omitted.
It wouldn't usually help to use 8.8.8.8, but they probably could use their own authoritative servers instead of the root servers. Look up .dnstest.google.com or .dev or something. The problem with this is, of course, that a malicious resolver could detect this and NXDOMAIN those queries, while passing others through. I don't see what the incentive would be for ISPs to do that, but ISPs are weird.
> that a malicious resolver could detect this I assume the reason for changing from a 10 char random string to a 7-14 char random string was exactly because some ISP's were detecting it...
https://chromium.googlesource.com/experimental/chromium/src/...
Wait, so Chrome leaks the first word of my searches to my ISP? That doesn’t sound like something I want to happen
Wait, so Chrome leaks the first word of my searches to my ISP? That doesn’t sound like something I want to happen
Your local nameserver should be configured to not forward unqualified names upstream.
Earlier quoted context omitted.
Shouldn't it be up to my OS to do that validation though, not the browser? After all when I ssh to my.server.com I want the same guarentee as when I https to it.
That’s not how SSH or HTTP work. If you ssh to a server your OS will resolve the IP, but your SSH client will request and attempt to verify the server key. Same with browsers and HTTP.
While that might have been a better design, the reality is OS's only provide API's for unencrypted connections and each application builds their own encryption and authentication on top of that.
Earlier quoted context omitted.
> that a malicious resolver could detect this I assume the reason for changing from a 10 char random string to a 7-14 char random string was exactly because some ISP's were detecting it...
Unfortunately the commit message doesn't explain why the change was made: https://chromium.googlesource.com/experimental/chromium/src/...
I think the only downside is that you would leak some information about your system clock.
Couldn't the traffic be somewhat reduced by changing the time and order of operations? Currently, Chrome does the following: (1) on each network change, send three DNS requests with random hostnames. (1a) If at least two of the queries resolve to the same IP, store the IP as the "fake redirect address". (2) on a user search, query the first search term as DNS. (2a) If the query result is NXDOMAIN or matches the fake…
Maybe, at the risk of over-engineering, additionally cache the results for the last N networks persistently. Something like (gateway, DNS, localip) as key. I could see those three being identical on different networks though... And assuming the article is right and most ISPs globally do not mess with NXDOMAIN, this might not be necessary anymore with this proposal.
Earlier quoted context omitted.
Ctrl+K for Windows users looking for a shortcut key.
It also works on Firefox (and on Linux); if you use split address/search bar it focuses to the search bar instead as it used to be.