Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thai Database Leaks 8.3B Internet Records

rainbowtabl.es

Post reply on HN
Print view View original

71–79 of 79 posts

Re: Thai Database Leaks 8.3B Internet Records

#71

Post by manquer »

o-__-o wrote: post #70
cbg0 wrote: post #55

Earlier quoted context omitted.

I don't know if Verizon is actively doing it, but since most providers that offer DoH have well-known IPs, like 8.8.8.8, 1.1.1.1, 9.9.9.9, they could easily just block traffic heading in that direction.

This follows along with what I read, at first it’s easy to block but it’s a losing proposition because anyone can stand up a doh server (which is also a network security nightmare)

Not sure what has changed security wise. Any one could also stand a DNS resolver. Many people use hosts file or used a local resolver for dev domains for example, security minded folks setup up resolvers on openWRT stack router for example or a use a piHole.

Blocking popular DNS providers is a common tactic deployed by ISPs. It is technically easy enough to bypass depending on your skill level and interest in doing so. Their strategy is make it difficult for majority of their users, who won't know or care, users doing all this will not make substantial impact on revenue generated from selling this data, or from showing adds etc so they don't make the effort.

DoT/DoH is not going to change this, Firefox's market share is not enough for that. I don't see Chrome or Safari implementing this functionality at all.

Re: Thai Database Leaks 8.3B Internet Records

#73

Post by mindslight »

baicunko wrote: post #5

This is something that the average user fails to understand. One thing is saying I don't care they check on what I visit but once you aggregate enough information, it can become something of a "Big Brother". With enough DNS data I can assure you I can see when you leave to work, get back, determine the moment when you leave for vacation and no one is home, etc.

I hope someone takes the opportunity to download the entire database and serve it up as a torrent, because it would make a great source for studying the pictures that can be painted with contemporary ISP surveillance.

Re: Thai Database Leaks 8.3B Internet Records

#74

Post by arminiusreturns »

cbg0 wrote: post #13
arminiusreturns wrote: post #12

Earlier quoted context omitted.

I thought quad9 was UK based?

Bottom of quad9.net says: HQ 1442 A Walnut Street Suite 501 Berkeley CA 94709

Aha, figured out I was confused because I read about their membership in the Global Cyber Alliance which includes members such as the London Police and the NYPD.

Bonus if you are interested: forum thread where Quad9's director of the board comments about DNS are surprisingly informational.

https://www.snbforums.com/threads/cloud9-dns.56918/

Re: Thai Database Leaks 8.3B Internet Records

#75

Post by swiley »

microcolonel wrote: post #37
swiley wrote: post #34

Earlier quoted context omitted.

Most malicious ISPs disable DoH (ex: Verizon) so it likely wouldn’t have solved this. If you want it solved find a protocol that can be used in the libc resolver and make it ubiquitous rather than goofing around with browser defaults.

How do they disable DoH? They block TLS over that port?

Mozilla provides instructions for network operators that want to block it.

Re: Thai Database Leaks 8.3B Internet Records

#76

Post by koheripbal »

nix23 wrote: post #31
cbg0 wrote: post #2

> To be clear: DoH and/or DoT would have stopped the gathering of DNS query data in this case. It's simple to set up, and it's just a smart thing to do for anyone concerned about their privacy. Actually, for most people that are not technically savvy this is definitely not an easy thing to set up, nor are they even aware that DoH/DoT exist. Unless this feature starts being turned on by default in routers and popular…

Well in Firefox you can turn it on: about:preferences#general >> Network Settings >> Settings...

Where is the setting in Chrome? It's not on by default in the latest version, and not available in the flags/settings...

Re: Thai Database Leaks 8.3B Internet Records

#77

Post by bouncycastle »

GordonS wrote: post #38
bouncycastle wrote: post #16

Earlier quoted context omitted.

I've been doing both and have to say Wireguard is much more performant and stable than an ssh tunnel. Besides, it shouldn't be too hard to set it up on a VPS.

As a counter point about reliability, I've been tunnelling my HTTP traffic (and DNS) through SSH (to get around corporate restrictions and monitoring) for 10 years or so - I don't think I've ever had any reliability issues.

I've had a lot of problems: latency, ssh tcp connections dropping packets and whole connection becoming unstable, manually configure proxy / browser each time & also sometimes you may forget to start the tunnel. You also need to start a new ssh connection for each port you want to forward, so you end up managing a bunch of ssh connections if you want to expose some services for example. Wireguard is more deeper down the layers and just works without jumping through hoops - none of the apps are aware of it and when it's on, it just stays on). Of course, when all you have is ssh to get around pesky restrictions, then I guess that will do fine too! ;-)

Re: Thai Database Leaks 8.3B Internet Records

#78

Post by GordonS »

bouncycastle wrote: post #77
GordonS wrote: post #38

Earlier quoted context omitted.

As a counter point about reliability, I've been tunnelling my HTTP traffic (and DNS) through SSH (to get around corporate restrictions and monitoring) for 10 years or so - I don't think I've ever had any reliability issues.

I've had a lot of problems: latency, ssh tcp connections dropping packets and whole connection becoming unstable, manually configure proxy / browser each time & also sometimes you may forget to start the tunnel. You also need to start a new ssh connection for each port you want to forward, so you end up managing a bunch of ssh connections if you want to expose some services for example. Wireguard is more deeper down…

A good point about switching proxies and apps that don't support SOCKS natively.

I guess I've been dealing with those issues for so long they don't bother me anymore!

Also, I use a great extension for Firefox, so I can switch to/from the proxy in 2 clicks, "Proxy Switcher and Manager".

Re: Thai Database Leaks 8.3B Internet Records

#79

Post by o-__-o »

manquer wrote: post #71
o-__-o wrote: post #70

Earlier quoted context omitted.

This follows along with what I read, at first it’s easy to block but it’s a losing proposition because anyone can stand up a doh server (which is also a network security nightmare)

Not sure what has changed security wise. Any one could also stand a DNS resolver. Many people use hosts file or used a local resolver for dev domains for example, security minded folks setup up resolvers on openWRT stack router for example or a use a piHole. Blocking popular DNS providers is a common tactic deployed by ISPs. It is technically easy enough to bypass depending on your skill level and interest in doing s…

Okay that’s great for my developers now what happens when they download some malicious script modified their doh queries to use their servers instead of my corporate wins?
Post reply on HN