Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cname cloaking, a disguise of third-party trackers

medium.com

Post reply on HN
Print view View original

191–200 of 202 posts

Re: Cname cloaking, a disguise of third-party trackers

#191

Post by cheald »

linuxdude314 wrote: post #103
cheald wrote: post #12

Use a Pihole + your adblocker of choice - defense in depth. It's easy to set up, brainless to keep updated, and helps to protect all devices on your network, not just the things that can run uBlock. I've got mine running in a Docker container, which upstreams to a stubby container, which gets DNS-over-TLS, so I get adblocking and DNS query encryption out to Cloudflare for the whole network, and it's really not all th…

I don't think you understood the article. Pihole or any blocking DNS server based on blacklists won't help here (thats the point). By using random, frequently updating CNAME's it effectively defeats the mechanism Pihole uses. You could still block IP addresses of the advertisers, but often time's they don't do BGP, so they aren't going to have blocks under the same ASN you can simply block. It's a nuanced and challen…

It's surprising to me that dnsmasq doesn't provide the ability to override the returned names in the chain. I'd just assumed it did. Seems like it shouldn't be _that_ hard to solve, though. I've written my own bespoke DNS server before on top of miekg/dns - I might have to take a crack at my own pihole-like with CNAME interception. :)

Re: Cname cloaking, a disguise of third-party trackers

#192

Post by strenholme »

tambre wrote: post #156
skunkpocalypse wrote: post #137

Earlier quoted context omitted.

> block “rogue” (read: tracking) IPs. With IPv6 that's as impractical as blocking "rogue" FQDNs.

Why? Just block ranges.

Exactly. If I were to update this code, for IPv4 blocking, I would allow it to block /32 (single IP) and /24 networks. For IPv6 blocking, I would allow blocking a single IPv6 address, a /64 range, and (for extreme offenders) a /48 range.

One way to do this is to have multiple hash tables: One for single IPv4 addresses, one for IPv4 /24 ranges, one for single IPv6 addresses, one for /64 IPv6 ranges, and one for /48 IPv6 ranges. Note that while the hashes have (generally speaking) a “big O” of 1, we need to perform one additional operation per range size. IPv4 /32 and /24 blocking requires two lookups, and IPv6 /128, /64, and /48 blocking requires three lookups.

Re: Cname cloaking, a disguise of third-party trackers

#193

Post by _8j50 »

jefftk wrote: post #42

The easiest way for site-owners to delegate control has been to include third-party javascript. With new browser restrictions, we're starting to see companies switching to loading JS via CNAMEd subdomains, because that's nearly as easy. The next step is probably reverse proxies, though, where the third-party JS comes from the same server that gives you the rest of the site's JS. (Disclosure: I work in ads; speaking o…

I can see AD publishers offering CDN like services to help them get around blockage.

Only solution is criminalizing this behavior. In no other context is stalking a person against their will and consent permissible in a "free" society.

Re: Cname cloaking, a disguise of third-party trackers

#195

Post by crematoria »

bravoetch wrote: post #135
dmm wrote: post #118

Earlier quoted context omitted.

> (but somehow can't bring themselves to live without content that's ad supported)? Every day that becomes less and less of an option and presenting it as an option is disingenuous. Are you seriously suggesting that people live without search engines? I think it's valid to question the role of cars in our society even if the critic took a car to the meeting, for example.

False dichotomy. Other options might be paid search. Personal search engines. Peer to peer search. Or new business models. Yes, it's possible to imagine a world without Google et al screwing everyone out of their privacy.

Can you list any of these exciting alternatives? As a layman, I don't know of anything besides Google, Bing and DDG.

Re: Cname cloaking, a disguise of third-party trackers

#198

Post by tatersolid »

air7 wrote: post #153

How does this work with SSL certification? The 3rd party server needs to be in possession of a certificate for eir63gd.mywebsite.com

Let’s Encrypt makes this trivial and automatic if foobar.example.com has been CNAMEed to the tracking provider.

Re: Cname cloaking, a disguise of third-party trackers

#199

Post by jefftk »

jefftk wrote: post #174
aberforth123 wrote: post #168

Earlier quoted context omitted.

Nice write-up. What is your opinion on the following: Ads make people buy stuff they don't need. So if we would stop with ads everywhere, we can save the planet.

I don't think "ads make people buy stuff they don't need" is a large part of what's going on. One way to think about this would be, what would the world be like if we didn't allow advertising? Not just internet ads, but magazine ads, affiliate links, sponsored posts, product placement, everything. And assume that enforcement is perfect ;) Here's my speculation about how this would change people's purchasing: * Produc…

Expanded this into a post: https://www.jefftk.com/p/effect-of-advertising

Re: Cname cloaking, a disguise of third-party trackers

#200

Post by ignoramous »

poitrus wrote: post #84
ignoramous wrote: post #81

Earlier quoted context omitted.

Thanks Olivier. Re: nextdns-cli: I think you may have misunderstood my question. I was more curious abt how the backend worked: Do you run one unbound instance per nextdns-configuration? Re: DoH: I was pointing to the fact that XHR request to 1.1.1.1 (or any DoH provider that supports application/dns-json ) can now resolve domain names. In this case, there's no reliance on either browser's DoH resolver or resolver se…

Oh sorry. We have developed a custom DNS solution that sites in front of unbound. We only use unbound for standard recursion and caching, all custom configuration management is operated in this home made DNS proxy. For trackers to use DoH, they could certainly perform XHR requests to resolve a domain, but they won't be able to use it to perform a request from the browser. You may use " rel="nofollow">http:// instead…

Thanks a lot for taking time to respond. Really appreciate it.

I guess, XHR aside, mobile or desktop apps making DoH requests (to https://ipaddress) is something that can't be blocked by DNS based ad-blockers? A firewall might do the trick.

Post reply on HN