Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My Chromecast Ultra would not start until I began answering 8.8.8.8

mailarchive.ietf.org

Post reply on HN
Print view View original

441–450 of 519 posts

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#441

Post by markstos »

kllrnohj wrote: post #405
pixl97 wrote: post #265

Earlier quoted context omitted.

The problem here is you are falling in the same trap as the Google engineers here. Why would ______ want to do _______ with their ______ device? You can make a locked down device that only does a very limited subset of functions, but you really should make that known to the user before hand. "This device requires access to $X servers to function". If you have secret requirements that go far beyond user expectations,…

Google isn't exactly secret about the fact that Chromecast connects to Google's data centers. Especially if you're using it to, say, watch YouTube, as Paul Vixie was. Chromecast connecting to Google is not a "secret requirements that go far beyond user expectations." Expecting a cloud-connected product to continue to work when you've randomly blacklisted IPs that belong to that company is, however, an unreasonable ex…

We expect that Chromecast connects to Google's servers when you are using Google services. By forcing you to use their DNS service, they can track every non-Google DNS query you make as well, which is all tied to your IP address. It is a form of surveillance of everything that you do on your Chromecast, for which there is no explicit consent.

https://security.stackexchange.com/questions/62273/can-dns-s...

It is similar in some ways to Facebook tracking users across the internet through Facebook "Like" and "Connect" buttons across the internet, even when the user's aren't on the Facebook site and did not opt-in to having their browsing tracked by Facebook outside of Facebook.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#442

Post by [deleted] »

scrollaway wrote: post #122
dang wrote: post #104

Earlier quoted context omitted.

We don't know what that ratio is, as we don't track it, and I'm skeptical that anyone does.

shrugs I wasn't referring specifically to HN, nor was I trying to suggest I know the exact ratio. What I know is it's extremely unlikely that this story is being upvoted because of that given that 1. A lot of people upvote on title alone (I'll die on that hill); 2. Not many people know who Paul Vixie is; 3. Those that do might not notice the name in the UI/email (I certainly didn't).

[deleted]

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#443

Post by Sylamore »

shawnz wrote: post #141
pdkl95 wrote: post #103

Earlier quoted context omitted.

The proper thing to do is to use the DNS settings the DHCP server provided and testing those settings by providing a server the device can lookup and connect to (with TLS). If the server proved it's authenticity, the DNS settings work. (some devices might cache this result, others might do this during startup) If an error occurs or a reasonably short timeout expires, the device can: if it has UI the user will see, it…

> don't make assumptions about the user's situation Using 8.8.8.8 is exactly the opposite of an assumption. It always works in any config, that's the point. EDIT: Besides, obviously, the OP's extremely unusual config, where he is effectively just blocking the service with his firewall. Why isn't he outraged about having to unblock all of YouTube's other IPs? What's special about 8.8.8.8?

8.8.8.8 isn't a youtube IP, it's Google's DNS service. Most networks hand out their own DNS and generally expect clients on their network to be using it. While most consumer home networks are very permissive not every network is and not respecting the dns server handed to a client by DHCP is broken behavior.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#444

Post by johncolanduoni »

calibas wrote: post #411
ehsankia wrote: post #348

Earlier quoted context omitted.

I agree with most your points, but trying to make a connection between "exploration of bringing Google services to China" and "supporting free and open Internet" feels like a huge stretch to me. Let's ignore the fact that every other tech company such as Microsoft and Apple are in China, and the fact that Google already does censor content in most other countries. Let's also ignore all the other things Google does fo…

You can't create tools for censorship in China and support a free and open Internet. Those things are completely opposed to each other. Pointing out the actions of other companies, the good things Google has done, or the fact that they censor content in most countries doesn't negate that fact. Those are just mediocre argumentative tactics to try and downplay a public relations disaster. We're not even dealing with th…

> You can't create tools for censorship in China and support a free and open Internet. Those things are completely opposed to each other.

I don't see why Google wouldn't actually prefer if China didn't have such draconian restrictions. At the very least it would reduce their regulatory compliance work in China drastically.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#445

Post by pishpash »

kllrnohj wrote: post #344
calibas wrote: post #170

This should bother people here more than it does. The last thing the Internet needs is even more dependence upon Google. They've made it quite clear through their actions that they're not supporters of a free and open Internet: https://theintercept.com/2018/09/14/google-china-prototype-l... If people don't push back against these kinds of things, Google will continue to abuse their power. There shouldn't be an army o…

> The last thing the Internet needs is even more dependence upon Google. This doesn't change that? It's a google streaming device that in order to function at all requires a connection to google's data centers. Why does it matter if that connection happens via 8.8.8.8 or some other IP resolved by a different DNS server? What is the actual, practical difference of that? It's still connecting to Google in order to prov…

You're missing the part where 8.8.8.8 is a Google service for which an open, internet service already exists. If whatever Google's data centers are providing (besides 8.8.8.8) for the device's features also already had open implementations, then yes, the same complaint could be levied.

By replacing parts of the internet that were open with non-open solutions, the intent and the consequence are clear.

But I will say that that bridge has been crossed long ago. 8.8.8.8 has been hardcoded in so many places today that it may as well be a fixture of the internet, like the search thing, like many other properties of Google that are maybe not monopolies but are 80% of one. There is no internet that does not depend on Google (except in certain Firewalled countries). It's already too late.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#446

Post by johncolanduoni »

RickS wrote: post #250
05 wrote: post #220

Earlier quoted context omitted.

The obvious reason is that any local browser config pages cannot be SSL protected because the device can not provide a valid certificate for 192.168.0.33 or chromecast.local Phone app can use a custom TLS CA to make sure the stick was produced by Google and is not a rogue neighbor phishing for your WiFi password..

Thank you for this answer. It makes a lot of sense. For my (and I expect most people's) threat model, google's prying eyes are a more credible concern than my neighbor's, and I wish they hadn't changed it, but it's nonetheless a defensible reason for making the change.

> For my (and I expect most people's) threat model, google's prying eyes are a more credible concern than my neighbor's, and I wish they hadn't changed it, but it's nonetheless a defensible reason for making the change.

Phishing by a random bad actor taking advantage of lack of TLS verification is far more likely than Google putting a sandbox escape in a phone app they distribute to steal information from you. I really hope most people's threat model doesn't match yours in this respect.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#447

Post by Sendotsh »

hannasanarion wrote: post #372
pixl97 wrote: post #265

Earlier quoted context omitted.

The problem here is you are falling in the same trap as the Google engineers here. Why would ______ want to do _______ with their ______ device? You can make a locked down device that only does a very limited subset of functions, but you really should make that known to the user before hand. "This device requires access to $X servers to function". If you have secret requirements that go far beyond user expectations,…

The fact that we got six years into the chromecast world before anybody complained is a pretty good indicator that, no, in fact, most people who want to watch youtube on their TVs don't configure their firewalls to block 8.8.8.8.

It has actually been a common issue for many years, including for myself, but the rest of us don't have the social clout for it to make it to HN front page.

These days you have no chance of getting any form of tech support or even issue acknowledgement unless you have a large follower count online.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#448

Post by rossjudson »

pishpash wrote: post #445
kllrnohj wrote: post #344

Earlier quoted context omitted.

> The last thing the Internet needs is even more dependence upon Google. This doesn't change that? It's a google streaming device that in order to function at all requires a connection to google's data centers. Why does it matter if that connection happens via 8.8.8.8 or some other IP resolved by a different DNS server? What is the actual, practical difference of that? It's still connecting to Google in order to prov…

You're missing the part where 8.8.8.8 is a Google service for which an open, internet service already exists. If whatever Google's data centers are providing (besides 8.8.8.8) for the device's features also already had open implementations, then yes, the same complaint could be levied. By replacing parts of the internet that were open with non-open solutions, the intent and the consequence are clear. But I will say t…

Why do multiple DNS implementations exist? Why do multiple entities run different implementations? Does every DNS contain the same information, and do they all respond the same way?

You might find Google's DNS privacy policy to be of interest: https://developers.google.com/speed/public-dns/privacy

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#449

Post by andreareina »

tialaramex wrote: post #35
megous wrote: post #22

Earlier quoted context omitted.

Yes, but how does it help hardcoding one IP address that ISPs can simply route to their own DNS server?

Today the ISP could, with a bunch of effort, re-route the traffic, though I haven't seen any evidence that any of them do that. So it helps materially because for today it works. Tomorrow these devices will do DPRIV, probably DNS over HTTPS, and so the ISP won't be different from any other man-in-the-middle, unable to meddle with the contents of protected traffic.

I've experienced ISPs trying to block sites by intercepting the DNS request and returning their own servers. DNS over HTTP solves that for now, but I'm concerned that they'll just switch to blocking by IP or SNI.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#450

Post by jil »

robotrout wrote: post #392
jil wrote: post #207

Earlier quoted context omitted.

Campuses also have this kind of security. I can't use a Chromecast or a Google Home on my college campus because my school's IT team blocks all DNS servers except their own.

I used to travel with a Chromecast so I could cast in my hotel room. I finally gave up, since it never worked in any hotel I stayed in.

I did the same thing and gave up too, but that's because every hotel TV used composite video.
Post reply on HN