Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

72% of smart TVs and 46% of game consoles hardcode DNS settings

labzilla.io

Post reply on HN
Print view View original

641–650 of 673 posts

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#641

Post by fulafel »

protomyth wrote: post #341
jon-wood wrote: post #10

I’m responsible for a bunch of IoT hardware, and every firmware spec I write includes a note on not using the DNS servers provided via DHCP. While sure there are companies explicitly doing this to avoid filtering, at least in my case it’s because a significant proportion of DHCP servers are configured to send DNS to your ISP, and ISP provided DNS is almost universally terrible. They’ll ignore TTLs, rewrite NXDOMAIN r…

I’m responsible for a bunch of IoT hardware, and every firmware spec I write includes a note on not using the DNS servers provided via DHCP. And that along with DoH is contributing to making my life a pain in the butt. How exactly do you folks who avoid our DHCP's DNS expect us to comply with legal filtering requirements? Also, what happens when your hard coded DNS servers are shutdown?

What kind of legal requirements are these, which country?

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#642

Post by Abishek_Muthian »

jeanofthedead wrote: post #639
Abishek_Muthian wrote: post #321

Earlier quoted context omitted.

Thanks for that, I have a standing need gap for 'Make TV dumb again' [1]. [1] https://needgap.com/problems/64-make-tv-dumb-again-privacy-c...

I was able to do this with my TCL/Roku TV a few months back. My curiosity got the best of me with the announcement of their latest OS, so I upgraded to see what the new features were like. Now I am stuck in the ecosystem, as the downgrade feature is completely disabled (even from a USB stick, with no internet connection, after a factory reset). Luckily, I use a Pihole as my DNS on my router, but still. Super annoying…

That's a valid point, dumb TVs need to be kept dumb by not updating/upgrading the OS although this results in conundrum of not patching existing vulnerabilities in favour of not introducing new vulnerabilities? Vulnerabilities of dumb TVs could still be exploited by plugging in USB devices/SD card or even STB like Roku.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#643

Post by theamk »

dec0dedab0de wrote: post #518
dralley wrote: post #489

Earlier quoted context omitted.

> The DNS-over-HTTPS model favors those who run the servers (because they get exclusive access to monetizable end user name resolution data) Hold up. You are claiming that the fact that DoH prevents DNS requests from being visible in cleartext network traffic is a bad thing ? ...what? In a world where the choice is between one party (the DNS provider) having access to my DNS requests and everyone on the network inclu…

Hold up. You are claiming that the fact that DoH prevents DNS requests from being visible in cleartext network traffic is a bad thing? It is when its my network. If they cared about people sniffing they would use DNSSEC, but still use the network DNS server. DNS over HTTPS is just a way for shady companies to hide what they're doing.

Uh, DNSSEC is only signatures, it has no encryption.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#644

Post by tptacek »

manigandham wrote: post #638
tptacek wrote: post #637

Earlier quoted context omitted.

DNSSEC is not encrypted. Moreover, between end systems and DNS servers --- the scenario we're discussing on this thread --- it isn't even authenticated.

Sure, DNSSEC provides authentication and integrity rather than encrypted traffic, which makes spoofing or rewriting the responses hard. Why do you say it's not authenticated? If they're using the newer standards then that's what it provides. If they're not then there's no issue with network filtering as usual.

Again: the article discusses an environment where machines on a home network are refusing to use the DNS servers the network is configured to use. DNSSEC authenticates requests between servers. But between DNS clients ("stub resolvers") and servers ("full recursers"), there is no authentication, just a single bit in the header that says "trust me, I authenticated this data".

It doesn't matter if you're using your ISP's servers, 8.8.8.8, 1.1.1.1, or a custom server you set up on Digital Ocean somewhere: an on-path attacker can forge DNSSEC responses to you. It's a ridiculous situation.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#645

Post by willis936 »

beisner wrote: post #422
willis936 wrote: post #181

Earlier quoted context omitted.

The future is uncertain. Google has a history of canceling services and gives no signs of changing their behavior. Even if they made public acknowledgments hand waving “oh it’s these services not those other ones”, why would I fee any better? Google needs to spend a lot of time building trust. They don’t have it.

Any service they have Enterprise contracts for they are extremely unlikely to shut down.

Is there any assurance? Why would anyone trust FAANGs?

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#646

Post by verisimilidude »

ant6n wrote: post #498
verisimilidude wrote: post #288

Earlier quoted context omitted.

I imagine most people capable of rooting a TV would already have better alternatives at hand: an Apple TV, an Nvidia Shield, a PlayStation, etc. There’s not much daily incentive to tinker.

All of these still require a Display.

Personal example. I already have an nVidia Shield. It works out of the box, it's nice, and it already does everything I want. Even if I jailbroke my TV's smartness, then said TV's smartness probably still wouldn't work as well as the Shield. And if the Shield ever messes with me, I can just replace it with a Roku or AppleTV or Chromecast or whatever.

There's just no strong motivation to try to root my TV. I don't like my smart TV but I don't need to, because the smart parts can be "replaced" by any number of external devices. My point is that I suspect many would-be TV hackers are in the same happy situation.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#647

Post by protomyth »

Zak wrote: post #640
protomyth wrote: post #521

Earlier quoted context omitted.

Its not a law problem. Its an expectation that technology isn't as random or stupid that it cannot keep a headstart kid from going to PornHub because some tech folks don't trust their ISP.

I think the classic "the network treats censorship as damage and routes around it" applies here. Designing a device to connect to something over the internet even if the network it's connected to behaves strangely isn't random or stupid; it's just in conflict with your goals. Incidentally, last time I ran into a network with legally mandated filtering, I checked whether a google image search for "tits" worked. It did…

"behaves strangely isn't random or stupid"

Nope, it behaves fine. The owner of the network is serving under age kids. Push too far and its white lists only and block all other IP and I'm sure we'll get deep packet inspection forced on us. Some folks have serious problems with Google Images Search, but you can actually deal with that.

I would also say anyone hard coding DNS into a device is just absolutely unprofessional. Its basically a red flag that any filtering the owner of the network doesn't matter to them.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#648

Post by jaimex2 »

Angostura wrote: post #135
jaimex2 wrote: post #48

Honestly there is no scenario where your TV should have Internet access. Setup Kodi and you're done.

Great. I've set up Kodi on my Mac. Of course, there's no way to get the content from my machine in the office, to the actual TV that I can see. So that doesn't really solve any problems. Unless you mean buy a separate box, put Kodi on it and attach that to the TV

Yup.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#649

Post by jaimex2 »

sildur wrote: post #70
jaimex2 wrote: post #48

Honestly there is no scenario where your TV should have Internet access. Setup Kodi and you're done.

What about Netflix? Can I have Netflix in Kodi (in a raspberry)? Honesty asking.

Yep, hardware matters though. You need one that can work with the DRM.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#650

Post by Zak »

protomyth wrote: post #647
Zak wrote: post #640

Earlier quoted context omitted.

I think the classic "the network treats censorship as damage and routes around it" applies here. Designing a device to connect to something over the internet even if the network it's connected to behaves strangely isn't random or stupid; it's just in conflict with your goals. Incidentally, last time I ran into a network with legally mandated filtering, I checked whether a google image search for "tits" worked. It did…

"behaves strangely isn't random or stupid" Nope, it behaves fine. The owner of the network is serving under age kids. Push too far and its white lists only and block all other IP and I'm sure we'll get deep packet inspection forced on us. Some folks have serious problems with Google Images Search, but you can actually deal with that. I would also say anyone hard coding DNS into a device is just absolutely unprofessio…

From the perspective of the device maker, a network causing a DNS lookup to return something other than an accurate result is behaving strangely. That may keep a device from working, so the device maker guards against it. A quick scroll through this thread reveals good reasons for device makers to do this, mostly ISPs behaving badly.

I'm generally inclined to think an "always use this manually-configured DNS" option is desirable in that situation. Of course, many devices may have a financial incentive (ads) to actively resist the network owner's attempts at filtering.

Filtering is inherently adversarial, and I expect a reasonably sophisticated user on your network could find a way to access some proscribed content. I also expect the users of concern on your network are under five years old and that most of them lack advanced knowledge of networking. Is there an established standard for what qualifies as a reliable-enough filter?

Post reply on HN