Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cname / DNS based third party tracking

arxiv.org

Post reply on HN
Print view View original

31–40 of 49 posts

Re: Cname / DNS based third party tracking

#31

Post by pas »

nuker wrote: post #29

HN becoming kind of underground FightClub, where people share how to fight back.

Is there a non-underground FightClub? :)

Also, fighting back against ... what exactly? Ads? The Big FAANG?

This is not the way. It's either beat them at their game (not likely), or building/supporting/using alternatives (eg. Signal, Mastodon, maybe substack? nebula? Librem/microG/LineageOS?), but ultimately it's politics. If "HN thinks" they are too powerful, then "HN has to" influence and persuade people in order to get laws, policies, regulations enacted that control/diminish this power. (Of course if such a grassroots movement gets powerful enough to influence legislation/policy probably at that point the market would respond too, eg. maybe Google would offer a no-track version of their services for cash, or serious competitors would emerge.)

The cynical take is of course a simple good luck, after all "HN" doesn't even have to fortitude to ditch Chrome.

(I hate ads with a passion, and use uBlock, but I don't care about tracking. Sites can and will implement it in their own backend anyway. GDPR/CCPA is the correct level to address the real problem which is handling of personal data [not IP address]. Now it's up to the market and consumer/user behavior to adjust. All these obnoxious consent forms are ripe for "disruption", yet it seems the economic/market value of not being tracked is so low, that it's hard to build a business on it. Though NextDNS is trying, but it's such a small niche, and basically solves nothing ... still, I wish them luck.

If the policy changes regarding "news" in UK/Germany/Australia were not due to bullheaded Murdoch/NewsCorp and regular old media/publishers lobbying, then that issue could be a starting point on which to build something better. But ultimately if every simple view has to be compensated, it has to be tracked.)

Re: Cname / DNS based third party tracking

#32

Post by nuker »

pas wrote: post #31
nuker wrote: post #29

HN becoming kind of underground FightClub, where people share how to fight back.

Is there a non-underground FightClub? :) Also, fighting back against ... what exactly? Ads? The Big FAANG? This is not the way. It's either beat them at their game (not likely), or building/supporting/using alternatives (eg. Signal, Mastodon, maybe substack? nebula? Librem/microG/LineageOS?), but ultimately it's politics. If "HN thinks" they are too powerful, then "HN has to" influence and persuade people in order to…

> fighting back against ... what exactly?

Personal data harvesting. Its like feeding frenzy right now.

> This is not the way. It's either beat them at their game (not likely), or building/supporting/using alternatives (eg. Signal, Mastodon, maybe substack? nebula? Librem/microG/LineageOS?), but ultimately it's politics.

This is the way lol. Beating them is the only way that actually works, right now. Politics will takes decades, and will lead nowhere, like stupid cookies consent popups. Networking and web tech is too complex to put it into laws anyway.

Lets build better personal defence tools, browsers, routers, blockers, distributed VPNs that are not as easy to outlaw as Tor exit nodes. For example - https://github.com/Eloston/ungoogled-chromium. Add ignoramous CNAME backdooring ways to uBlock-Origin. That kind of ways.

Re: Cname / DNS based third party tracking

#34

Post by nuker »

pas wrote: post #31
nuker wrote: post #29

HN becoming kind of underground FightClub, where people share how to fight back.

Is there a non-underground FightClub? :) Also, fighting back against ... what exactly? Ads? The Big FAANG? This is not the way. It's either beat them at their game (not likely), or building/supporting/using alternatives (eg. Signal, Mastodon, maybe substack? nebula? Librem/microG/LineageOS?), but ultimately it's politics. If "HN thinks" they are too powerful, then "HN has to" influence and persuade people in order to…

https://news.ycombinator.com/item?id=26302019 :))

Re: Cname / DNS based third party tracking

#35

Post by namibj »

nerdbeere wrote: post #33

OT: Is there a better and/or easier way to read scientific papers? Especially on mobile devices I find PDFs with two-column layouts really hard to read. I wish scientific publications would just be simple html.

MuPDF has decent two-column capable "next page" functionality by tapping on the right edge.

Re: Cname / DNS based third party tracking

#36

Post by Daho0n »

pas wrote: post #31
nuker wrote: post #29

HN becoming kind of underground FightClub, where people share how to fight back.

Is there a non-underground FightClub? :) Also, fighting back against ... what exactly? Ads? The Big FAANG? This is not the way. It's either beat them at their game (not likely), or building/supporting/using alternatives (eg. Signal, Mastodon, maybe substack? nebula? Librem/microG/LineageOS?), but ultimately it's politics. If "HN thinks" they are too powerful, then "HN has to" influence and persuade people in order to…

> [not IP address]

Are you saying an IP isn't / can't be personal data or am I misunderstanding the sentence?

Re: Cname / DNS based third party tracking

#37

Post by varyingcircles »

mikeiz404 wrote: post #20
dec0dedab0de wrote: post #3

I guess you could build a tool that blocks cnames that point to other domains. But then they could switch to A records, which I guess could be blocked with lists of the IPs of tracking parties. Or just by blocking all hosts besides the one being requested (which I personally prefer in all web design). Then again they could always just put a redirect/rewrite in their web server to a any third party they want, but atle…

Ya, blocking requests is a bandaid for preventing tracking. The only way to stop this permanently is to address the root cause. As far as I can tell that would be through permissioned browser api access. The UX might become a bit unwieldy though Google’s idea of limiting the number of bits of identifying info revealed might be a way around that. But then there is the issue of sites blocking access when more bits of i…

(Strict OT)

hm? So the Trick of Computerpeople is simple and knowingly to block requests to prevent abuse ?

That reminds me, of the arrogant young, wanting to compete boasting at 'social' -media, keeping -critics-(crossed) 'hater' away and small, while advertising (in self-interest) for so called 'social'-media to selfish gain their own position (on 'social'-media) ?!

Heading: 'Inclusion' -so 'This 'generate and isolate' might be an easier game to play for this users' ?

'Everytime everything must be positive, not ?'

Now that was realy OT...Sry! Won't sound too offensive.. P-:

Re: Cname / DNS based third party tracking

#38

Post by Terretta »

rndomsrmn wrote: post #23

Websites that use CNAME to forward their main domain to some tracking company, basically give their entire domain away, I don't see how that is a good secure way to track your users.. DNSCrypt-proxy (and even pihole these days I believe) are actually capable of blocking forwarded CNAME requests. Setting up such system for network wide adblocking is not complicated at all, see: https://github.com/notracking/hosts-bloc…

NextDNS.io (sort of pihole as a service) unwraps those too. From the linked PDF:

“Other tracking countermeasures operate as a DNS resolver, and return a bogus IP address, e.g. 127.0.0.1 when the domain name matches an entry from the blocklist. As this defense works at the DNS level, these can also consider all the intermediary resolutions to CNAME records, and return a bogus IP address if any of them resolve to a domain on the blocklist. Examples of DNS-based anti-tracking measures that adopted defenses against CNAME cloaking include NextDNS [42], AdGuard [4], and Pi-hole [50].”

It’s worth reading NextDNS’s discussion on how this is implemented, and the differences between their approach, AdGuard’s, and pihole’s:

https://medium.com/nextdns/nextdns-added-cname-uncloaking-su...

If you have NextDNS configured with the AdGuard base filter set, www.cultofmac.com is blocked for being CNAMED to www-cultofmac-com.ezoic.net which in turn is blocked by the AdGuard base filter. In this case, ezoic is an ad-optimizing content management system (CMS).

Here’s a wiki for setup for most routers, see Supported Platforms at the bottom:

Wiki: https://github.com/nextdns/nextdns/wiki

Splash page: https://nextdns.io/

Setup: https://my.nextdns.io/start

For iOS families, NextDNS now supports Apple Configuration Profiles to enforce Encrypted DNS at the policy level, no software to install or manual settings: https://apple.nextdns.io/

Re: Cname / DNS based third party tracking

#39

Post by bombcar »

Terretta wrote: post #38
rndomsrmn wrote: post #23

Websites that use CNAME to forward their main domain to some tracking company, basically give their entire domain away, I don't see how that is a good secure way to track your users.. DNSCrypt-proxy (and even pihole these days I believe) are actually capable of blocking forwarded CNAME requests. Setting up such system for network wide adblocking is not complicated at all, see: https://github.com/notracking/hosts-bloc…

NextDNS.io (sort of pihole as a service) unwraps those too. From the linked PDF: “Other tracking countermeasures operate as a DNS resolver, and return a bogus IP address, e.g. 127.0.0.1 when the domain name matches an entry from the blocklist. As this defense works at the DNS level, these can also consider all the intermediary resolutions to CNAME records, and return a bogus IP address if any of them resolve to a dom…

Too bad it doesn't support RouterOS from Mikrotik.

Re: Cname / DNS based third party tracking

#40

Post by sofixa »

ThePhysicist wrote: post #24

It's interesting that even analytics solutions which list respecting user privacy as their main USP (i.e. simpleanalytics.com, plausible.io) support this kind of concealement scheme. I find it at least questionable since a user that employs a specific extension to block tracking requests has clearly expressed an intent to not be tracked, so circumventing this block with some clever DNS scheme is very privacy-unfriend…

> It's interesting that even analytics solutions which list respecting user privacy as their main USP (i.e. simpleanalytics.com, plausible.io) support this kind of concealement scheme. I find it at least questionable since a user that employs a specific extension to block tracking requests has clearly expressed an intent to not be tracked

That's because you're confusing tracking, which is e.g. Google tracking your behaviour across different websites to decide what you like and what adds you might click, and website analytics, which is making statistics on what type of people ( location, language, browser, mobile/PC, from where) visit your website. Privacy concious analytics doesn't track it, it only aggregates who you are so that the website owner can make decisions ( the mobile version is useless because all users come from PCs, optimising for Safari isn't needed since no users use Apple devices, etc.). It's unfortunate for your average site owner that you lose that data from people not wanting to be tracked, because that's really not the same thing, they're just a drive-by casualty.

Post reply on HN