DNS Cookies – Identify Related Network Flows • Hacker News Board

Re: DNS Cookies – Identify Related Network Flows

#21

Post by feanaro » Wed, Jun 19, 2019, 10:06 AM UTC

DanielDent wrote: post #18

feanaro wrote: post #17

Earlier quoted context omitted.

> It seems both more straightforward and more effective to build recursion paths that you can trust aren't doing any intentional or unintentional caching. I agree, but as you say, that will take quite some work and time to happen and will be costly. I was thinking of this as a possible temporary mitigation which would retain some benefits of caching. If it was made adaptive[1], it would also have the nice side-effect…

It would be difficult to differentiate between responses that vary due to load balancing and responses that vary due to active fingerprinting. Even when a site only has a single physical location, load balancing might be done in part by having DNS randomly return one of many valid IP addresses. E.g. this is a behaviour supported by Amazon's Route53. Larger sites frequently use a combination of anycast and DNS based r…

Yes, but variation due to such load balancing would surely be limited in entropy in practical non-tracking scenarios?

Approaching from the other end, it points towards anycast itself (and similar techniques) being incompatible with hard tracking resistance.

I'm glad to see that Firefox containers already mitigate this by using a separate DNS cache for each container.

Re: DNS Cookies – Identify Related Network Flows

#22

Post by phicoh » Wed, Jun 19, 2019, 11:34 AM UTC

In general, publicly visible DNS cookies are set by a DNS recursive resolver. Typically, multiple IP addresses share one recursive resolver. So it seems to me that a DNS cookie has strictly less information than an IP address.

Re: DNS Cookies – Identify Related Network Flows

#23

Post by SimeVidas » Wed, Jun 19, 2019, 1:00 PM UTC

alex_anglin wrote: post #4

SimeVidas wrote: post #3

ELI5 description?

Like HTTP cookies, but that users don't have control over since they're managed by network infrastructure.

I’m sorry, I really don’t know much about DNS. I still have many questions: Who sets it? How is it transmitted? Who can access it?

Re: DNS Cookies – Identify Related Network Flows

#24

Post by codezero » Wed, Jun 19, 2019, 4:27 PM UTC

DanielDent wrote: post #9

It's fun when you check the front page of HN and see your work :).

I'm bummed it didn't stay there longer, not just for my own karma :)

Re: DNS Cookies – Identify Related Network Flows

#25

Post by sairamkunala » Wed, Jun 19, 2019, 5:07 PM UTC

If this fingerprinting stays across say HTTP Proxies (or VPN/Tor network) and a regular network, this may be a way to track users especially for ad networks.

Re: DNS Cookies – Identify Related Network Flows

#26

Post by 3xblah » Wed, Jun 19, 2019, 8:01 PM UTC

DanielDent wrote: post #15

3xblah wrote: post #13

Earlier quoted context omitted.

Do not use third party recursive DNS services, such as Google or OpenDNS. If running own DNS recursor, turn off EDNS; only send traditional 512 byte DNS packets. Use DNS software that does not support EDNS, such as djbdns.

Third party DNS servers are helpful in one sense - you can share your state with other users. Turning off EDNS with your own recursor won't really make much difference. Limiting the maximum cache length will help, but will also eliminate much of the benefit of having a local recursor. The other issue with running your own recursor is nasty networks will transparently proxy DNS and you can end up using a cache you don…

Sharing a cache with other users introduces its own set of problems, e.g., cache poisoning. The problems that arise from shared DNS caches gave rise to "solutions" that in turn introduced further problems.

For transparent proxying, i.e., hotel internet, I use a local forwarder and a remote recursor listening on a non-standard port and it has worked flawlessly.

I prefer to serve static address info via authoritative DNS or /etc/hosts. I have other methods of getting DNS data besides querying caches. I have no need for DNS caches. Most websites I visit do not change addresses frequently. I also like to know when they change, if they ever do.

I have not experienced any problems with DNSCurve.