Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cname cloaking, a disguise of third-party trackers

medium.com

Post reply on HN
Print view View original

21–30 of 202 posts

Re: Cname cloaking, a disguise of third-party trackers

#21

Post by ve55 »

z3t4 wrote: post #13

There are many banks to choose from. Put your money elsewhere. Then explain to the bank why you did.

Every bank I've used has had a pretty absurd amount of trackers that I've blocked, often 5-10+ third party javascript domains. I don't know of any that don't have any, but I'm sure some small ones exist somewhere.

There doesn't appear to be a huge market for services that do little/no tracking, as users are all unaware of the tracking that services do to begin with, so they would not even notice the difference.

Re: Cname cloaking, a disguise of third-party trackers

#24

Post by freeone3000 »

snailmailman wrote: post #17
syshum wrote: post #14

Earlier quoted context omitted.

That will only work for so long, as more and more browsers are forcing DoH for "privacy" on users, making them bypass traditional DNS in-favor of DNS over HTTPS to a provider selected by the Browser removing user control Mozilla for example is going to force everyone to use CloudFlare as a Resolver

You can change your DoH resolver, so you could setup a raspberry pi as a DoH server theoretically, and still keep the benefits of a PiHole. Mozilla is making CloudFlare the default but they aren't forcing it, you can use another server.

You can change it on web browsers, for now, but not on IoT devices.

Re: Cname cloaking, a disguise of third-party trackers

#25

Post by uponcoffee »

syshum wrote: post #14
cheald wrote: post #12

Use a Pihole + your adblocker of choice - defense in depth. It's easy to set up, brainless to keep updated, and helps to protect all devices on your network, not just the things that can run uBlock. I've got mine running in a Docker container, which upstreams to a stubby container, which gets DNS-over-TLS, so I get adblocking and DNS query encryption out to Cloudflare for the whole network, and it's really not all th…

That will only work for so long, as more and more browsers are forcing DoH for "privacy" on users, making them bypass traditional DNS in-favor of DNS over HTTPS to a provider selected by the Browser removing user control Mozilla for example is going to force everyone to use CloudFlare as a Resolver

That's usually easy to opt out of and if bootstrapping fails (e.g. Outbound dns query for DoH provider fails//direct connection by IP is blocked) it falls back to the network/OS defined resolvers.

Even still filtering based on SNI will work for a long time yet. Yes, ESNI is on track to becoming to a standard but support for legacy devices/browsers means it to will rely on network tests for support - so it can also be disabled.

Re: Cname cloaking, a disguise of third-party trackers

#26

Post by perspective1 »

koolba wrote: post #19
syshum wrote: post #14

Earlier quoted context omitted.

That will only work for so long, as more and more browsers are forcing DoH for "privacy" on users, making them bypass traditional DNS in-favor of DNS over HTTPS to a provider selected by the Browser removing user control Mozilla for example is going to force everyone to use CloudFlare as a Resolver

Physical devices already do this: https://mailarchive.ietf.org/arch/msg/dnsop/WCVv57IizUSjNb2R... At least a browser might have a user setting to disable it.

Just use iptables on your firewall/router to reroute all traffic on port 53 to your DNS server.

Re: Cname cloaking, a disguise of third-party trackers

#27

Post by koolba »

perspective1 wrote: post #26
koolba wrote: post #19

Earlier quoted context omitted.

Physical devices already do this: https://mailarchive.ietf.org/arch/msg/dnsop/WCVv57IizUSjNb2R... At least a browser might have a user setting to disable it.

Just use iptables on your firewall/router to reroute all traffic on port 53 to your DNS server.

I can assure you that the general population has no idea what half the nouns in that sentence mean, let alone how to do any of that.

Re: Cname cloaking, a disguise of third-party trackers

#28

Post by bscphil »

syshum wrote: post #14
cheald wrote: post #12

Use a Pihole + your adblocker of choice - defense in depth. It's easy to set up, brainless to keep updated, and helps to protect all devices on your network, not just the things that can run uBlock. I've got mine running in a Docker container, which upstreams to a stubby container, which gets DNS-over-TLS, so I get adblocking and DNS query encryption out to Cloudflare for the whole network, and it's really not all th…

That will only work for so long, as more and more browsers are forcing DoH for "privacy" on users, making them bypass traditional DNS in-favor of DNS over HTTPS to a provider selected by the Browser removing user control Mozilla for example is going to force everyone to use CloudFlare as a Resolver

> Mozilla for example is going to force everyone to use CloudFlare as a Resolver

Do you have any evidence that they're going to force anyone to do that?

Re: Cname cloaking, a disguise of third-party trackers

#29

Post by amluto »

ve55 wrote: post #21
z3t4 wrote: post #13

There are many banks to choose from. Put your money elsewhere. Then explain to the bank why you did.

Every bank I've used has had a pretty absurd amount of trackers that I've blocked, often 5-10+ third party javascript domains. I don't know of any that don't have any, but I'm sure some small ones exist somewhere. There doesn't appear to be a huge market for services that do little/no tracking, as users are all unaware of the tracking that services do to begin with, so they would not even notice the difference.

Contact the regulators, perhaps? To me, allowing untrustworthy third-party scripts on a bank website sounds like a huge security risk.

Re: Cname cloaking, a disguise of third-party trackers

#30

Post by [deleted] »

perspective1 wrote: post #26
koolba wrote: post #19

Earlier quoted context omitted.

Physical devices already do this: https://mailarchive.ietf.org/arch/msg/dnsop/WCVv57IizUSjNb2R... At least a browser might have a user setting to disable it.

Just use iptables on your firewall/router to reroute all traffic on port 53 to your DNS server.

[deleted]
Post reply on HN