3 ms·

So the author is a security expert who recommends two companies that are notorious for their security flaws (Norton, Cisco), two companies that track your DNS q

by flox25 8y ago

So the author is a security expert who recommends two companies that are notorious for their security flaws (Norton, Cisco), two companies that track your DNS queries for profiling (Google, Cloudflare) and IBM... Yeah, this sounds totally legit...

throwaway9d0291 8y ago
> two companies that track your DNS queries for profiling (Google, Cloudflare) Can you elaborate? Neither Google nor CloudFlare seem to collect information for profiling. Google: https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy CloudFlare: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/privacy-policy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
- flox25 8y ago
  What? How do you come to that conclusion? Google actually tells you what it is collecting, if you cannot see how, say, city of origin, cannot be used to target you with specific search result, then I really cannot explain it to you. Cloudflare does not store any information, but they are pretty frank about passing it on to APNIC for "research" as part of the deal where APNIC lend the 1.0.0.1 and 1.1.1.1 address to them. This is pretty well established and actually openly communicated by both entities, so should be easy to DDG. You are of course free to believe that this data is totally anonymized and not used for profiling / targeting at all, but imo that is pretty naive.
  - zackbloom 8y ago
    I work at Cloudflare. APNIC absolutely does not get individual DNS query logs. Their primary interest is in studying the other junk traffic which ends up hitting 1.1.1.1. For the record, we don't build any sort of profile of DNS queryiers, map them back to any existing profile we have, or even keep the data you would need to have to do that.
    - flox25 8y ago
      Well, for me to believe that there still is such a thing as a free lunch, you'll have to be better than that. If the data sent to APNIC is so safe and non-personal, why not make it transparent? Instead, when contacting APNIC about it, you get a typical one liner stating that > ... the access to the primary data feed will be strictly limited to the researchers in APNIC Labs, and we will naturally abide by APNIC's non-disclosure policies. Clearly, someone thinks there is something to hide. Maybe not Cloudflare, but then it's someone else.
      - judge2020 8y ago
        > why not make it transparent? I'm not with CF or APNIC, but it's likely due to issues with sensitive data. Say a web service is hitting `http://internal.example.com:5220` http://internal.example.com:5220` with basic authentication, or there's a misconfigured jira trying to access `internal.example.com:3306`, but the DNS admins have retired `internal.example.com` and decided to make it return `1.1.1.1` for some reason. Showing all traffic that hits the service would expose a little too much sensitive information.
        flox25 8y ago
        I have worked in a lot of companies and never have I seen anyone treat a DNS name as security relevant information. If you rely on DNS names not to be known as a measure of privacy and/or security, you clearly are doing it wrong. As a matter of fact, DNS names supposed to be known, it's their one and only purpose. In addition, if "internal.example.com" is not already resolvable publicly (which would mean that it's known) CF could not guarantee the privacy of that query anyways because their DNS is not part of the root zone, which means they need to forward it to someplace beyond their control, meaning they leak it no matter what.

by flox25 8y ago

throwaway9d0291 8y ago

> two companies that track your DNS queries for profiling (Google, Cloudflare) Can you elaborate? Neither Google nor CloudFlare seem to collect information for profiling. Google: https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy CloudFlare: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/privacy-policy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

flox25 8y ago
What? How do you come to that conclusion? Google actually tells you what it is collecting, if you cannot see how, say, city of origin, cannot be used to target you with specific search result, then I really cannot explain it to you. Cloudflare does not store any information, but they are pretty frank about passing it on to APNIC for "research" as part of the deal where APNIC lend the 1.0.0.1 and 1.1.1.1 address to them. This is pretty well established and actually openly communicated by both entities, so should be easy to DDG. You are of course free to believe that this data is totally anonymized and not used for profiling / targeting at all, but imo that is pretty naive.
- zackbloom 8y ago
  I work at Cloudflare. APNIC absolutely does not get individual DNS query logs. Their primary interest is in studying the other junk traffic which ends up hitting 1.1.1.1. For the record, we don't build any sort of profile of DNS queryiers, map them back to any existing profile we have, or even keep the data you would need to have to do that.
  - flox25 8y ago
    Well, for me to believe that there still is such a thing as a free lunch, you'll have to be better than that. If the data sent to APNIC is so safe and non-personal, why not make it transparent? Instead, when contacting APNIC about it, you get a typical one liner stating that > ... the access to the primary data feed will be strictly limited to the researchers in APNIC Labs, and we will naturally abide by APNIC's non-disclosure policies. Clearly, someone thinks there is something to hide. Maybe not Cloudflare, but then it's someone else.
    - judge2020 8y ago
      > why not make it transparent? I'm not with CF or APNIC, but it's likely due to issues with sensitive data. Say a web service is hitting `http://internal.example.com:5220` http://internal.example.com:5220` with basic authentication, or there's a misconfigured jira trying to access `internal.example.com:3306`, but the DNS admins have retired `internal.example.com` and decided to make it return `1.1.1.1` for some reason. Showing all traffic that hits the service would expose a little too much sensitive information.
      - flox25 8y ago
        I have worked in a lot of companies and never have I seen anyone treat a DNS name as security relevant information. If you rely on DNS names not to be known as a measure of privacy and/or security, you clearly are doing it wrong. As a matter of fact, DNS names supposed to be known, it's their one and only purpose. In addition, if "internal.example.com" is not already resolvable publicly (which would mean that it's known) CF could not guarantee the privacy of that query anyways because their DNS is not part of the root zone, which means they need to forward it to someplace beyond their control, meaning they leak it no matter what.