8 ms·

GCHQ planning UK-wide DNS ‘firewall’

68 points by peterkelly 10y ago

WillKirkby 10y ago
"We’re exploring a flagship project on scaling up DNS filtering: what better way of providing automated defences at scale than by the major private providers effectively blocking their customers from coming into contact with known malware and bad addresses?" Because this definitely isn't a step towards state censorship, no siree!
- verytrivial 10y ago
  "bad addresses" -- What better way to avoid crimethink. We must implement this double plus speedwise.
- strictnein 10y ago
  Nope, not at all. Russia went a similar route, but did a "think of the children!" angle, among other things. For those interested, The Red Web does a good job covering this (and many other topics). - https://www.theguardian.com/books/2015/sep/02/the-red-web-review-andrei-soldatov-irina-borogan-review-russias-attack-internet-freedoms https://www.theguardian.com/books/2015/sep/02/the-red-web-re...
- throwawayReply 10y ago
  Step towards? This is state-wide censorship. But isn't the truth that it is already implemented in UK ISP's DNS offerings anyway, and that this is just extending the filter so you can't bypass it by changing to a different DNS server? This should be a textbook case on how to achieve censorship. Start by having it "optional", but not an option a user opts into explicitly, just implicitly in a way they don't understand (by "choosing" their ISP). Then when 99% of people are already covered, roll it out in a compulsory way across everywhere because "This won't affect most people, just a small number of people". No debate needed.
  - pixl97 10y ago
    > and that this is just extending the filter so you can't bypass it by changing to a different DNS server? No, many people will just use VPNs Then the government will find a need to ban VPNs for the safety of its citizens.
- sp332 10y ago
  Blocking DNS is not that effective. https://twitter.com/mockupgoodsco/status/585082122211303424 https://twitter.com/mockupgoodsco/status/585082122211303424
  - dijit 10y ago
    it does if you force all DNS traffic to GCHQ's servers. Britain has shown repeatedly that it can force ISPs into doing what it wants.
mariusz79 10y ago
I think it is safe to say that by 2020 the Internet as we know it today will not exists. All we will have is a bunch of walled gardens, under full surveillance from both the government and corporations. And most people will not even notice or care.
- rm_-rf_slash 10y ago
  There's too much money or power otherwise. Perhaps the discussion to have is not about the degrees of surveillance or walled gardens, but public access to mass surveillance records collected by government agencies. If everyone had access to everything, it would be a check on the absolute power of powerful institutions to corrupt them absolutely. I'm not evangelizing the idea, I just think it's something worth debating and I don't see enough of it yet.
- astrodust 10y ago
  I think it's safe to say you're exaggerating, and while there will be local pockets of utter confusion (North Korea, some US ISPs) on the whole it will be fine. That's not to say we don't need to fight for rights, to keep this sort of thing from happening, but that I have confidence that we can and will fight these things successfully. Australia, as one example, has tried on many occasions to put up very restrictive firewalls and has mostly failed. https://en.wikipedia.org/wiki/Internet_censorship_in_Australia https://en.wikipedia.org/wiki/Internet_censorship_in_Austral... Stay vigilant, stay informed, and you can control the future.
  - mariusz79 10y ago
    I don't think I'm exaggerating. When you read this article, and read what corporations are doing, and politicians are advocating, it's easy to see where this is going. In addition to that you have ICANN stewardship transfer, which might make it easier for other countries to influence how the Internet works. We also have growing number of hacks/leaks that will be used to push the "need for firewalls" and "warnings" from experts that "someone" if probing our defences. It all does not make me hopeful that we can keep the internet free.
mtmail 10y ago
Some the UK web blocking initiatives already reach 99% coverage https://en.wikipedia.org/wiki/Web_blocking_in_the_United_Kingdom https://en.wikipedia.org/wiki/Web_blocking_in_the_United_Kin...
ymse 10y ago
For privacy concerned netizens, especially UK based ones, I highly recommend checking out DNSCrypt[0]. It securely tunnels all your DNS requests to an endpoint of your choice. I've used it for about two years and it's very reliable, even on a laptop. I do recommend using it in conjunction with a caching DNS recursor such as Unbound[1] to save bandwidth. It also works great on OpenWRT if you have that luxury. For UK residents, please also consider changing to an ISP that cares about your online rights. I only know this one: http://aaisp.net.uk http://aaisp.net.uk 0: https://dnscrypt.org https://dnscrypt.org 1: https://unbound.net https://unbound.net
- anexprogrammer 10y ago
  There's also http://zen.co.uk http://zen.co.uk Only know of those two free of shaping, blocking and bad support beloved of all the other UK ISPs. Their blog is consistently anti surveillance.
- teh_klev 10y ago
  +1 for A&A. I've used them for years. The owner's blog is also worth a read: http://www.revk.uk/ http://www.revk.uk/
- CommanderData 10y ago
  This could easily become illegal for circumventing state censorship. It might already be in places like China (if DNS tunneling helps stop censorship at all)
- mike-cardwell 10y ago
  Not happy with only your ISP and government knowing where you're going online? Install DNSCrypt and add some more third parties to the mix. [edit] From DNSCrypt's own front page: Please note that DNSCrypt is not a replacement for a VPN, as it only authenticates DNS traffic, and doesn't prevent "DNS leaks", or third-party DNS resolvers from logging your activity. The TLS protocol, as used in HTTPS and HTTP2, also leaks leaks websites host names in plain text, rendering DNSCrypt useless as a way to hide this information.
  - 10y ago
dirtbox 10y ago
Weren't GCHQ caught illegally spying on pretty much everyone at a similar level to the NSA? Trustworthy guys to put in charge of something like this.
- gc419hq 10y ago
  Sometimes you just need to give in on these little things to get on with your life. For example, my friends complain about spam, but ever since I switched my email to 419.ng, it has been a thing of the past for me. I'm sure letting a malicious government institution fully merge its traffic and monitoring into your traffic will simplify your life too. –--- 419.ng freemail, exceptional service for fr33! Dear sir or madam the crown prince of Contantanople is having trouble transferring his considerable fortune.. Cpoc@419.ng
zimbatm 10y ago
How would a legitimate plan look like? I think it's part of the state's mandate to provide security to the citizens, offline and online. Unfortunately I haven't really seen alternative plans that don't give the state more power at the same time. It doesn't matter the "real" reasons behind this kind of decision, unless people are presented with a sane alternative.
- Zigurd 10y ago
  "Don't censor" is a valid alternative. Just don't.
CommanderData 10y ago
This means they'll be able to collect statistics information only to be stored onto your household web history list. This is just another attempt at mass data collection. It's not like it wasn't being done before by intercepting DNS requests but this way its legal. This also paves the way to ISP 's requiring to conform and building an infrastructure to associate an subscriber id to a given DNS request.
talideon 10y ago
"We have always been at war with Eastasia."
tptacek 10y ago
Tell me again why it's a good idea to put all our TLS keys in the DNS?
- dane-pgp 10y ago
  Because we can avoid registering a .co.uk domain, but we can't stop a foreign government forcing a Certificate Authority to issue a certificate for our domain. If the US government were to force the root zone key holders into issuing a false update for the .is top level domain, for example, that should rightly be treated as an act of war, and be detected before it could be used. Such an expensive attack could only be used once, and would achieve nothing. Do you have a different threat model in mind?
  - tptacek 10y ago
    I've answered this totally bogus argument so many times, I'm going to take a different tack this time and put you on the spot. Tell me: what's the TLD you'd choose for your new site if protection from governments was your goal? We already know: it's not .IO, which is is controlled by GCHQ. Which one is it? Are we all getting .IS names in your bright DNSSEC future?
    - dane-pgp 10y ago
      I trust the Icelandic government more than the least trustworthy of all the CAs trusted by my browser (plus the least trustworthy of all the governments that have power over any of the CAs trusted by my browser). Alternatively I could (in theory) set up my own generic TLD, like Apple has done. Here is their DNSSEC practice statement: https://www.apple.com/legal/intellectual-property/tld/dps/ https://www.apple.com/legal/intellectual-property/tld/dps/ It's still not clear why you think that being able to choose your trust path is strictly worse than being at the mercy of all CAs in the world.
      - tptacek 10y ago
        But if your site is hosted under a .COM, .ORG, .NET, .US, .CO.UK, .ORG.UK, or .IO name, or, for that matter, under a generic TLD managed by any company domiciled in the US, UK, Canada, or Australia, your feeling is: it's just fine that the NSA gets to swap in its own TLS keys for your own whenever it wants. Do you have another TLD besides .IS you might "trust more than the least trustworthy CA in your browser"? Could you name it?
forgottenpass 10y ago
"what better way of providing automated defences at scale than by the major private providers effectively blocking their customers from coming into contact with known malware and bad addresses?" By designing a system for distributing filter rulesets to the endpoints. Works fairly well for in-browser malware blocking and adblocking. And if users can retrieve rulesets from configurable sources, it allows them to tune how aggressive their filtering is, and avoids turning every rule into a potential national censorship row. By comparison, making ISPs do DNS filtering is of middling effectiveness and screams of "just give me all the control and trust me to sort it all out."

68 points by peterkelly 10y ago

"We’re exploring a flagship project on scaling up DNS filtering: what better way of providing automated defences at scale than by the major private providers effectively blocking their customers from coming into contact with known malware and bad addresses?" Because this definitely isn't a step towards state censorship, no siree!

verytrivial 10y ago
"bad addresses" -- What better way to avoid crimethink. We must implement this double plus speedwise.
strictnein 10y ago
Nope, not at all. Russia went a similar route, but did a "think of the children!" angle, among other things. For those interested, The Red Web does a good job covering this (and many other topics). - https://www.theguardian.com/books/2015/sep/02/the-red-web-review-andrei-soldatov-irina-borogan-review-russias-attack-internet-freedoms https://www.theguardian.com/books/2015/sep/02/the-red-web-re...
throwawayReply 10y ago
Step towards? This is state-wide censorship. But isn't the truth that it is already implemented in UK ISP's DNS offerings anyway, and that this is just extending the filter so you can't bypass it by changing to a different DNS server? This should be a textbook case on how to achieve censorship. Start by having it "optional", but not an option a user opts into explicitly, just implicitly in a way they don't understand (by "choosing" their ISP). Then when 99% of people are already covered, roll it out in a compulsory way across everywhere because "This won't affect most people, just a small number of people". No debate needed.
- pixl97 10y ago
  > and that this is just extending the filter so you can't bypass it by changing to a different DNS server? No, many people will just use VPNs Then the government will find a need to ban VPNs for the safety of its citizens.
sp332 10y ago
Blocking DNS is not that effective. https://twitter.com/mockupgoodsco/status/585082122211303424 https://twitter.com/mockupgoodsco/status/585082122211303424
- dijit 10y ago
  it does if you force all DNS traffic to GCHQ's servers. Britain has shown repeatedly that it can force ISPs into doing what it wants.

mariusz79 10y ago

I think it is safe to say that by 2020 the Internet as we know it today will not exists. All we will have is a bunch of walled gardens, under full surveillance from both the government and corporations. And most people will not even notice or care.

rm_-rf_slash 10y ago
There's too much money or power otherwise. Perhaps the discussion to have is not about the degrees of surveillance or walled gardens, but public access to mass surveillance records collected by government agencies. If everyone had access to everything, it would be a check on the absolute power of powerful institutions to corrupt them absolutely. I'm not evangelizing the idea, I just think it's something worth debating and I don't see enough of it yet.
astrodust 10y ago
I think it's safe to say you're exaggerating, and while there will be local pockets of utter confusion (North Korea, some US ISPs) on the whole it will be fine. That's not to say we don't need to fight for rights, to keep this sort of thing from happening, but that I have confidence that we can and will fight these things successfully. Australia, as one example, has tried on many occasions to put up very restrictive firewalls and has mostly failed. https://en.wikipedia.org/wiki/Internet_censorship_in_Australia https://en.wikipedia.org/wiki/Internet_censorship_in_Austral... Stay vigilant, stay informed, and you can control the future.
- mariusz79 10y ago
  I don't think I'm exaggerating. When you read this article, and read what corporations are doing, and politicians are advocating, it's easy to see where this is going. In addition to that you have ICANN stewardship transfer, which might make it easier for other countries to influence how the Internet works. We also have growing number of hacks/leaks that will be used to push the "need for firewalls" and "warnings" from experts that "someone" if probing our defences. It all does not make me hopeful that we can keep the internet free.

mtmail 10y ago

Some the UK web blocking initiatives already reach 99% coverage https://en.wikipedia.org/wiki/Web_blocking_in_the_United_Kingdom https://en.wikipedia.org/wiki/Web_blocking_in_the_United_Kin...

ymse 10y ago

For privacy concerned netizens, especially UK based ones, I highly recommend checking out DNSCrypt[0]. It securely tunnels all your DNS requests to an endpoint of your choice. I've used it for about two years and it's very reliable, even on a laptop. I do recommend using it in conjunction with a caching DNS recursor such as Unbound[1] to save bandwidth. It also works great on OpenWRT if you have that luxury. For UK residents, please also consider changing to an ISP that cares about your online rights. I only know this one: http://aaisp.net.uk http://aaisp.net.uk 0: https://dnscrypt.org https://dnscrypt.org 1: https://unbound.net https://unbound.net

anexprogrammer 10y ago
There's also http://zen.co.uk http://zen.co.uk Only know of those two free of shaping, blocking and bad support beloved of all the other UK ISPs. Their blog is consistently anti surveillance.
teh_klev 10y ago
+1 for A&A. I've used them for years. The owner's blog is also worth a read: http://www.revk.uk/ http://www.revk.uk/
CommanderData 10y ago
This could easily become illegal for circumventing state censorship. It might already be in places like China (if DNS tunneling helps stop censorship at all)
mike-cardwell 10y ago
Not happy with only your ISP and government knowing where you're going online? Install DNSCrypt and add some more third parties to the mix. [edit] From DNSCrypt's own front page: Please note that DNSCrypt is not a replacement for a VPN, as it only authenticates DNS traffic, and doesn't prevent "DNS leaks", or third-party DNS resolvers from logging your activity. The TLS protocol, as used in HTTPS and HTTP2, also leaks leaks websites host names in plain text, rendering DNSCrypt useless as a way to hide this information.
- 10y ago

dirtbox 10y ago

Weren't GCHQ caught illegally spying on pretty much everyone at a similar level to the NSA? Trustworthy guys to put in charge of something like this.

gc419hq 10y ago
Sometimes you just need to give in on these little things to get on with your life. For example, my friends complain about spam, but ever since I switched my email to 419.ng, it has been a thing of the past for me. I'm sure letting a malicious government institution fully merge its traffic and monitoring into your traffic will simplify your life too. –--- 419.ng freemail, exceptional service for fr33! Dear sir or madam the crown prince of Contantanople is having trouble transferring his considerable fortune.. Cpoc@419.ng

zimbatm 10y ago

How would a legitimate plan look like? I think it's part of the state's mandate to provide security to the citizens, offline and online. Unfortunately I haven't really seen alternative plans that don't give the state more power at the same time. It doesn't matter the "real" reasons behind this kind of decision, unless people are presented with a sane alternative.

Zigurd 10y ago
"Don't censor" is a valid alternative. Just don't.

CommanderData 10y ago

This means they'll be able to collect statistics information only to be stored onto your household web history list. This is just another attempt at mass data collection. It's not like it wasn't being done before by intercepting DNS requests but this way its legal. This also paves the way to ISP 's requiring to conform and building an infrastructure to associate an subscriber id to a given DNS request.

talideon 10y ago

"We have always been at war with Eastasia."

tptacek 10y ago

Tell me again why it's a good idea to put all our TLS keys in the DNS?

dane-pgp 10y ago
Because we can avoid registering a .co.uk domain, but we can't stop a foreign government forcing a Certificate Authority to issue a certificate for our domain. If the US government were to force the root zone key holders into issuing a false update for the .is top level domain, for example, that should rightly be treated as an act of war, and be detected before it could be used. Such an expensive attack could only be used once, and would achieve nothing. Do you have a different threat model in mind?
- tptacek 10y ago
  I've answered this totally bogus argument so many times, I'm going to take a different tack this time and put you on the spot. Tell me: what's the TLD you'd choose for your new site if protection from governments was your goal? We already know: it's not .IO, which is is controlled by GCHQ. Which one is it? Are we all getting .IS names in your bright DNSSEC future?
  - dane-pgp 10y ago
    I trust the Icelandic government more than the least trustworthy of all the CAs trusted by my browser (plus the least trustworthy of all the governments that have power over any of the CAs trusted by my browser). Alternatively I could (in theory) set up my own generic TLD, like Apple has done. Here is their DNSSEC practice statement: https://www.apple.com/legal/intellectual-property/tld/dps/ https://www.apple.com/legal/intellectual-property/tld/dps/ It's still not clear why you think that being able to choose your trust path is strictly worse than being at the mercy of all CAs in the world.
    - tptacek 10y ago
      But if your site is hosted under a .COM, .ORG, .NET, .US, .CO.UK, .ORG.UK, or .IO name, or, for that matter, under a generic TLD managed by any company domiciled in the US, UK, Canada, or Australia, your feeling is: it's just fine that the NSA gets to swap in its own TLS keys for your own whenever it wants. Do you have another TLD besides .IS you might "trust more than the least trustworthy CA in your browser"? Could you name it?

forgottenpass 10y ago

"what better way of providing automated defences at scale than by the major private providers effectively blocking their customers from coming into contact with known malware and bad addresses?" By designing a system for distributing filter rulesets to the endpoints. Works fairly well for in-browser malware blocking and adblocking. And if users can retrieve rulesets from configurable sources, it allows them to tune how aggressive their filtering is, and avoids turning every rule into a potential national censorship row. By comparison, making ISPs do DNS filtering is of middling effectiveness and screams of "just give me all the control and trust me to sort it all out."