9 ms·

UK ISP group names Mozilla 'Internet Villain' for supporting 'DNS-over-HTTPS'

156 points by katzeilla 7y ago

Macha 7y ago
> In the UK, ISPs are legally forced to block certain types of websites, such as those hosting copyright-infringing or trademarked content. Some ISPs also block other sites at their discretion, such as those that show extremist content, adult images, and child pornography. These latter blocks are voluntary and are not the same across the UK, but most ISPs usually tend to block child abuse content. It does give the lie to the "for the children" argument when blocking copyright infringement is mandatory and banning child porn is optional.
- noir_lord 7y ago
  It's hard at this point to feel any more anger about the way my government behaves. We crossed the Rubicon for so many reasons.
- morelikeborelax 7y ago
  What you quoted simplifies and thus obsfucates the situation in the UK. Child pornogrpahy is obviously illegal, but nearly all of it is actively filtered via the IWF lists. Legal forcing comes from court orders, of which there have been many of in regard to piracy and many other issues. Don't need court orders to regularly bring down child porn because there are already plenty of active attempts and stuff in place from IWF, ISPs, Police forces etc. https://en.m.wikipedia.org/wiki/Web_blocking_in_the_United_Kingdom https://en.m.wikipedia.org/wiki/Web_blocking_in_the_United_K...
  - tialaramex 7y ago
    What the courts said went like this: _If_ you have a mechanism that you've put together to block some content (in this case the IWF to block child porn porn) then you must also use this mechanism to block stuff the court wants blocked, in this case everything Hollywood has arbitrarily decided it might be a copyright infringement. But if you don't have a mechanism to block stuff (which A&A does not because why would you want to spend money on that nonsense?) then obviously the court shouldn't order you to go around making Hollywood's life easier and you can ignore it.
    - DanBC 7y ago
      No, this is nonsense. The IWF blocks are completely separate (and use a different mechanism) to the court ordered piracy blocks. The court ordered piracy blocks only apply to the "big 6" ISPs. A&A doesn't have to comply because they're an insignificant ISP with very few customers.
      - rndgermandude 7y ago
        Not non-sense. https://www.techdirt.com/articles/20100427/1437179198.shtml https://www.techdirt.com/articles/20100427/1437179198.shtml
      - tialaramex 7y ago
        A different _legal_ mechanism these days, but the only affordable and effective technical countermeasure is DNS blocking, which is why this whole anti-DPRIVE thing happened. Cleanfeed as originally designed is irrelevant in 2019. It worked by doing transparent HTTP proxying on port 80 and then comparing URLs to a blacklist of hashes. But in 2019 the site can just upgrade you to HTTPS and then you vanish off the radar in Cleanfeed. What's left is yet more DNS blocking. You might think wait, surely they could do IP blocking? Well, no. Fast flux combined with the address exhaustion means if you do this you'll either underblock so badly you might as well not bother trying, or you'll overblock and get yourselves a reputation as the ISP whose Internet doesn't work. SNI lets your opponents do this to you as much as they want even though very few of their customers are doing anything you actually want to block. So the other working (but far too expensive) option is "Deep packet inspection" or "Transparent TLS proxies" where you'll watch the ClientHello and drop clients asking for forbidden names in SNI before the connection is encrypted. The UK government's White Paper in 2018 showed no appetite for this extra cost, but even if they go there that's exactly what eSNI fixes - so they'd spend all that money and by the time they ship anything probably it doesn't work anyway.
  - rndgermandude 7y ago
    >but nearly all of it is actively filtered via the IWF lists. You wish. Those lists can only filter specific sites. Not the myriad of child porn that is shared privately. So those list based blocks might in fact protect some users who inadvertently clicked on the wrong link, not knowing where it would lead. But people actually seeking out this content do not care. It still would be effective to just inform providers and domain registrars[0]. I'm involved in running a small, non-commercial website that offers instant chat rooms without the need to sign up first. At some point the kiddly diddlers found out about it, and used it as basically a bootstrap tool for their activities. We had to play cat and mouse with them for a while, but have improved our system where most such things get automatically detected now or at least marked as suspicious, and the rest is handled by humans. So I am in the unfortunate position to know a thing or two about how these people operate, or at least those who abused our service. After they initially find each other, either to "trade" one on one or have a group thing going, they use services such a mega.nz[1] and other file hosters with ever new download URLs, or switch over to messenger services such as kik[2], tox[3] and discord[4] in particular, and use email (in particular protonmail these days) as a backup to finding each other again should their other accounts be taken down. TOR also plays a minor role, of course, but TOR's importance is usually overstated in public discussions about child porn, at least as far as I have seen, and we've rarely encountered people sharing hidden services; it's mostly about using TOR as an anonymizing, free "VPN"[5]. The amount of content (aka child abuse media) they share is tremendous. Them sharing 10s of GBs with a few mega links in one go was common. [0] We had this discussion in Germany ten years back, when the government proposed such filter lists that the ISPs should then enforce. There was a big opposition to that, as people thought the content should be actually removed and perpetrators prosecuted instead of just "hiding" it, and also establishing such a system would make all kinds of other groups eager to get courts to block other content with it, such as alleged piracy sites. Oh, and of course the lack of accountability and transparency was a big issue too. Turns out most providers will cooperate in taking down content, and the rest can be "made" to cooperate. The German group AK Zensur (NGO) ran an experiment back in 2009, and contacted providers based on leaked government child porn filter lists (mostly from Scandinavian countries). Most providers responded within 12 hours, removing illegal content, but more often than not they did not actually find child porn whatsoever (which the AK Zensur then verified). Most providers further said they had not been contacted previously (good job, law enforcement). https://ak-zensur.de/2009/05/loeschen-funktioniert.html https://ak-zensur.de/2009/05/loeschen-funktioniert.html (German) [1] mega.nz's model of plausible deniability means they also cannot identify content because they never see the content unencrypted (not even a hash of the unencrypted content). So they can only take down individual URLS and accounts, but cannot take down exact copies of the same file uploaded to other accounts. This, combined with the ease of making new accounts, each of which gets 50GB storage at first, and the feature to "unshare" (invalidate share links; allows people to share content for sometimes just a few seconds, so other people can import it into their own accounts and download later), makes mega very popular not just with content pirates, but also with people sharing child porn. [2] Easy to use, and easy to use group chats. [3] Harder to set up, but it claims to allow quasi anonymous decentralized communication incl file sharing if you put it behind a VPN or TOR. We've encountered "how to setup tox" inforgraphics in the past. [4] Discord used to be a bit wild west, being a new service which hadn't figured out a lot of things yet (kinda like us at the beginning), and probably underestimated the problem (also kinda like us in the beginning). They also made it pretty hard to actually report abuse (something like, "actually join the server, switch to developer mode, toggle some obscure other preference, copy the internal channel ID and write us an email containing that information"). Tho it seems they are doing a lot, lot better recently in banning "servers" involved in child porn. [5] Which put us in the unfortunate position to proactively ban TOR users from chatting (they can still read). 99% of TOR traffic was either outright malicious stuff like child porn, or spam. Sorry to the remaining less than 1% who played nice.
- needtobeanon 7y ago
  Blocking child porn is not optional in the UK. There is a mandatory block list which all ISPs are required to use, maintained by a private organization - the Orwellian named "Internet Watch Foundation", which is kept secret and is not disclosed for the stated reason that giving details would tell paedophiles where to look. They were responsible for the classification of the German band Scorpions album cover on Wikipedia being classed as child porn and resulting in blocking the Wikipedia page in the UK until that was sorted out. (Dec 7 2008)
  - dingaling 7y ago
    That is not correct. The majority of big UK ISPs subscribe to the IWF lists but that's a self-regulatory choice. Many smaller ISPs don't and some even advertise that as an advantage.
  - stordoff 7y ago
    A&A: > We don't provide a filtering service to restrict or limit access to anything on the Internet. When you take services from us you are opting out of any filtering services. The Internet has a lot of good and useful things, but it also has a lot of unpleasant and offensive things. Don't blame us for what you find on the Internet.[...] > We do not have, in our network, any equipment installed to filter access to any part of the public Internet for our customers as a whole. We aim to give 12 months notice if we ever add any such filtering. https://www.aa.net.uk/legal/full-terms-services/ https://www.aa.net.uk/legal/full-terms-services/ In the past, they've spoken out more explicitly against the IWF: > Not using IWF watch list > The system deployed now is not effective. It blocks web sites that have been reported, and that is all. It causes side effects (see recent wikipedia incident). It does not block ftp access, email, secure web sites, usenet, irc, peer to peer file sharing, or any tunnelled IP to proxies outside the UK, or indeed any number or simple ways around it. The system does not even try to.[...] > We feel sure anyone wanting access to child porn will have no trouble using the 95% of ISPs that use the IWF and there is no reason for them to come to us specially.[...] > At the end of the day, we are no more of a policeman than a power company powering a counterfeit printing press. We provide a utility - we shift IP packets. Using us for anything illegal is a matter for the police to deal with and the criminals concerned, and not for those companies that provide power, water, gas, or internet that happen to allow those activities. https://web.archive.org/web/20130430120759/https://www.aa.net.uk/news-censorship.html https://web.archive.org/web/20130430120759/https://www.aa.ne...
jimbob45 7y ago
I'm a bit of an internet novice so excuse me if this is dumb but won't the ISP still know which IP I've connected to? Just because I haven't conveniently looked it up in their giant DNS dictionary doesn't mean they can't just follow the traffic, right?
- Ericson2314 7y ago
  No HTTPs is encrypted. Edit oops I thought OP said what they communicate not what IP.
  - tremon 7y ago
    But how does that tie in with SNI? The specs say that the client sends the intended hostname as part of the TLS handshake, can the ISP sniff the hostname from that handshake? [edit] as per wikipedia, https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication: The desired hostname is not encrypted, so an eavesdropper can see which site is being requested. This helps security companies provide a filtering feature and governments implement censorship. [..] As of mid 2018, an upgrade called Encrypted SNI (ESNI) is being rolled out in an "experimental phase" to address this risk of domain eavesdropping. On March 1, 2019, Daniel Stenberg stated that Mozilla Firefox supports ESNI.
    - arccy 7y ago
      Which is why encrypted SNI is in development
      - _o-O-o_ 7y ago
        Test for eSNI here: https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/
    - rocqua 7y ago
      You can sniff SNI which will still reveal hostnames. In certain cases though, you can use 'domain fronting'. That is using a different Host in the HTTPS header than is included in SNI. If that other hostname is served by the same ip address and certificate, then that server might just forward your HTTPS message to the host requested in the HTTPS header.
tremon 7y ago
So they nominated Firefox for implementing DNS over HTTP but not Chrome? Does anyone know their rationale for that?
- ggg2 7y ago
  less lawyers on retainer to establish a precedent? you are talking about dirty politicians, who are standing against something initially designed to twart oppressive regimes such as China's great firewall... any dirty trick in book is fair game to them.
- m0xte 7y ago
  Signed up to post this. This is because Google are a member of ISPA: https://www.ispa.org.uk/members/?letter=G%2CH%2CI https://www.ispa.org.uk/members/?letter=G%2CH%2CI The other nominees for Internet Villain were Donald Trump and EU article 13. But they chose Mozilla. Clearly ISPA has an agenda and cannot be trusted.
Ericson2314 7y ago
If the UK disapproves I'll be sure to use it! Only gotcha is screw this per-application stuff, will want the whole computer doing it. But that shouldn't be too hard to rig up on Linux. https://tools.ietf.org/html/draft-huitema-quic-dnsoquic-05 https://tools.ietf.org/html/draft-huitema-quic-dnsoquic-05 oooo. https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy does a few good protocols.
- ggg2 7y ago
  so true. the fact that browsers have dns resolvers is weird. to me only the kernel could do it, and it would limit outgoing port 53 by default to every other process. if I want to set configuration on my hosts file I damn sure want everything to follow it, not have to worry about thousands of applications that might or might not use it.
  - krferriter 7y ago
    On Linux (and probably macos, windows), the kernel doesn't do DNS name resolution. The kernel provides the network stack which does IP, and also TCP and UDP. On Linux you need a tool that can do DNS operations, like NetworkManager, dhcpcd, dhclient, systemd-resolved. You could use selinux to restrict port access.
swiley 7y ago
I personally would have been a lot more comfortable with a different DNS protocol if 1) the companies pushing them didn’t limit it to just their product (and instead added it to the C runtime resolver) 2) didn’t limit it to their servers (that’s honestly pretty concerning)
- zrm 7y ago
  This is really the issue. DoH is a little ugly/slow, but the security improvement over vanilla DNS is real. There are superior alternatives like DNSCurve but DoH > plaintext DNS even if DNSCurve > DoH. The problem is implementing it in the application instead of the operating system. The owner of the device should be able to choose their DNS server in one place (including one that blocks or redirects domains the user actually wants to) and not have to keep after a dozen separate applications all with their own settings that ignore the user's globally stated preferences. Mozilla could do everyone a favor and produce a free independent DoH implementation for each platform they support that allows it to be used by the OS resolver in every application and have its configuration set all in one place. Extra points for supporting DNSCurve as well.
  - flarex 7y ago
    There are instructions on how to route all operating system DNS requests through DoH here: https://developers.cloudflare.com/1.1.1.1/dns-over-https/cloudflared-proxy/ https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo.... One advantage that DoH has over DNSCurve is that it is much harder to detect or block due to it being encapsulated as https traffic.
    - zrm 7y ago
      > There are instructions on how to route all operating system DNS requests through DoH here Then the next step is to get operating systems to ship it by default and support DoH as a DHCP option: https://tools.ietf.org/html/draft-peterson-doh-dhcp-00 https://tools.ietf.org/html/draft-peterson-doh-dhcp-00 > One advantage that DoH has over DNSCurve is that it is much harder to detect or block due to it being encapsulated as https traffic. If you're using a network subject to active adversarial man in the middle attacks like that then you probably want to be sending all your traffic through some kind of encrypted tunnel rather than only DNS.
curt15 7y ago
I can see why the gov't would have something to say about DoH, but even though the article specifically asks "why do ISPs hate it?", it doesn't actually answer why ISPs themselves would have a hat in the ring. Surely they cannot be blamed if DoH prevents them from sniffing users' traffic?
- rocqua 7y ago
  Maybe they fear this will mean they need to do blocking outside the DNS level? I'd certainly be sweating as an ISP if I need to start doing SNI inspection to block certain domains. That takes some decent packet inspection infrastructure.
- kevin_thibedeau 7y ago
  ISPs can make money selling behavioral data to aggregators. Domain names are more valuable for this than bare IPs.
- NikkiA 7y ago
  I don't know if it's the reason, but... Most UK ISPs run advertising portals on DNS-not-found redirects, DoH would remove those redirects.
  - jen20 7y ago
    This is almost certainly the reason. The first thing I do on any internet connection in the UK is change the DNS out for one that isn't broken...
llao 7y ago
DoH -> DNS over HTTP.
- cadence- 7y ago
  DNS over HTTPS.
dreamcompiler 7y ago
"The Net interprets censorship as damage and routes around it." -John Gilmore
- TeMPOraL 7y ago
  Obligatory reminder that this was said about packet routing, not about application-layer protocols.
rwmj 7y ago
A&A (a UK ISP) today donated £2940 to the Mozilla foundation. It's the amount that ISPA membership would have cost them if they were members which of course they are not: https://twitter.com/aaisp/status/1146803916853645314 https://twitter.com/aaisp/status/1146803916853645314
- bogle 7y ago
  That's worth knowing. Also, as a long-term subscriber to A&A for home/business I can recommend them as being very good as an ISP, too.
  - dpwm 7y ago
    Having switched to a&a at work recently, they seem to be operating several levels above the more mainstream business DSL providers we've used. Their control panel is incredibly functional – containing detailed logs of pretty much everything. They also provide a lot of more technical line control options that you'd otherwise have to phone up and convince somebody to get changed. We haven't had the pleasure of needing to phone them up yet, but from what I've read about them they're a technically very capable team.
    - azalemeth 7y ago
      I've subscribed my mother to their FFTC service, upgrading her from ADSL. She lives in the middle of nowhere, and BT have historically cocked up an awful lot with the wiring. Their team know a hell of a lot more about networking than I do, _and_ know who in BT to get on to in order to make sure that the wires get reconnected the right way around (which they weren't!). I really can't recommend them enough. Sure, it's expensive, but a) I like the feeling that I'm contributing to things I agree with, and b) the people who work there deserve to earn a decent wage. Insofar as broadband has a "first class" product, they offer it.
- m0xte 7y ago
  Straight to the point. Excellent work from A&A. I am currently with Zen and as they are a member of ISPA I'm going to terminate my account and move to A&A next month.
nullwasamistake 7y ago
DNS is the last cleartext channel for ISP's to monitor browsing. This isn't about "porn" at all. Even with HTTPS ISP's have long been able to snoop DNS to find all the sites you visit. This data is extremely valuable for marketing since the ISP also knows who you are and where you live. And using DNS bypasses tracker blocking. This is all about ISP's getting mad that their advertising revanue is being cut off. And possibly a lot of pressure from governments to keep "metadata" like DNS requests in the clear
lifeisstillgood 7y ago
I applaud the IWF's intentions - I agree with ending child abuse - and am personally quiet happy with effective if draconian measures the problem there is the effective not the draconian We know some evil people record these vile acts, but we don't think that banning video cameras will solve the problem - so my gut feeling is that banning abuse images online is less about stopping the crime and more about not being reminded it exists. So I wonder what the effective solutions to child abuse are? Something to do with nosey neighbours willing to pry? With school teachers being amazingly sensitive? something to do with spending huge amounts on foster care and social services - something to do with simply getting to know and talk with your neighbours? or something else? Was childline ever effective? I don't know - but it's a huge problem with amazing ROI - and well worth spending at least as much as we do on pointless record my browser history projects.
- DuskStar 7y ago
  > We know some evil people record these vile acts, but we don't think that banning video cameras will solve the problem - so my gut feeling is that banning abuse images online is less about stopping the crime and more about not being reminded it exists. I'm personally always amazed that people seem to think the problem is the recording and not the abuse.
  - yeaaaaaaaaaah 7y ago
    Banning images is a technical problem. Stopping abuse is a social problem.
    - penagwin 7y ago
      "Stopping abuse" isn't actionable - e.g. You can't say today I'm going to "stop abuse"(Unless you're an abuser). Banning images is an actionable measure - with the goal of stopping abuse. Not saying it's a good one.
  - TeMPOraL 7y ago
    It's both. Legally, child sexual abuse is considered so vile a practice that it's addressed on both supply side and demand side. Criminalizing possession and handling of such recordings is an attempt at reducing demand. It's not a complete solution, but no real world is really solved by a single thing. Banning video cameras obviously isn't happening, because they're too useful for other things. But if, hypothetically, a company sold cameras magically limited to only recording children, and such cameras would become popular among child pornographers, then you could expect calls for a legal ban on the grounds that denying a few companies the ability to fleece people through market segmentation doesn't outweigh making life more difficult for the child pornographers.
davesmith1983 7y ago
This is pretty standard in the UK under the current political climate. The Conservative Government about 2 years ago was hell bent (and probably still is) on getting rid of "strong encryption" and wants backdoors in pretty much everything. Both major political parties are pretty censorious and many of the smaller parties aren't much better.
- microcolonel 7y ago
  > many of the smaller parties aren't much better There is certainly one which is much better; and maybe it's a total coincidence, but they seem to be the punching bag of the major parties. ;- )
  - gmac 7y ago
    Which?
    - dijit 7y ago
      Liberal Democrat’s. They’ve been thrown under the bus for entering a coalition government and choosing to support alternative voting over scrapping tuition fees. Since they were a minority player they didn’t have much choice in fighting that ultimatum, but I understand why people feel scorned. Even if the conservatives are doing many, many more heinous things daily. As a nice conincidence the “NoToAV” campaign (lit. “No alternative vote”) was undertaken by the same people who drove the leaveEU campaign, they used remarkably similar tactics too. “AV will cost £250m, that should fund our army!” And such. https://images.app.goo.gl/Z4GP93UTWMgaVmLQ6 https://images.app.goo.gl/Z4GP93UTWMgaVmLQ6 I mention it because it was funded by the same conservative doners. So the Lib Dem’s lost both ways.
      - davesmith1983 7y ago
        The Liberal Democrats are still actively fighting against the historic Leave vote which means they cannot be trusted as they don't respect the people's will. They also support the current Hate Speech laws and want to expand them. They are essentially (like all laws against speech) essentially legitimising the idea of thought crime. Sorry but Liberal Democrats are part of the problem and I count them as part of the major parties.
ilovecaching 7y ago
DoH is plugging a security hole. ISPs and other entities were using that security hole to implement features for their users. The correct response is for them to use a different method of implementing their features that does not compromise user security. Their whole argument against DoH is ridiculous.
TeMPOraL 7y ago
I'm split here. Obviously this nomination only speaks well of Mozilla, but regarding DoH itself, isn't it a... problematic technology when it comes to user freedom? With DoH, how is Pi-hole going to work? Not sure if I like browsers working around the OS on this one; this should really be a user-configurable OS-level service.
- chillydawg 7y ago
  Your pi can be set up as a DoH server, of course!
  - TeMPOraL 7y ago
    From what I read however, it can't be set to work OOTB for everyone on my network; I'd have to go on every machine and every Internet-connected application to try and change it, hoping all the applications would let me (if I read correctly, Chrome won't?).
    - bradknowles 7y ago
      See https://developers.cloudflare.com/1.1.1.1/dns-over-https/cloudflared-proxy/ https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo... and https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/ and https://openwrt.org/docs/guide-user/services/dns/doh_dnsmasq_https-dns-proxy https://openwrt.org/docs/guide-user/services/dns/doh_dnsmasq...
tinus_hn 7y ago
Oh no, suddenly ISPs are relegated back to their role as common carriers of data!
fryry 7y ago
I believe ISP level blocking in the UK can already be easily bypassed simply by not using your ISPs DNS servers.
- jnwatson 7y ago
  Yeah, I’m surprised that anybody thinks that DNS blocking is sufficient for anything save ad blocking.
antpls 7y ago
Is there any good local DNS proxy server that transforms classic DNS to DNS-over-HTTPS, for applications that don't implement it natively (such as Desktop Chromium) ?
- pmoriarty 7y ago
  dnscrypt-proxy[1], though you'll have to use something like iptables to redirect all DNS traffic to it [1] - https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy

156 points by katzeilla 7y ago

> In the UK, ISPs are legally forced to block certain types of websites, such as those hosting copyright-infringing or trademarked content. Some ISPs also block other sites at their discretion, such as those that show extremist content, adult images, and child pornography. These latter blocks are voluntary and are not the same across the UK, but most ISPs usually tend to block child abuse content. It does give the lie to the "for the children" argument when blocking copyright infringement is mandatory and banning child porn is optional.

noir_lord 7y ago
It's hard at this point to feel any more anger about the way my government behaves. We crossed the Rubicon for so many reasons.
morelikeborelax 7y ago
What you quoted simplifies and thus obsfucates the situation in the UK. Child pornogrpahy is obviously illegal, but nearly all of it is actively filtered via the IWF lists. Legal forcing comes from court orders, of which there have been many of in regard to piracy and many other issues. Don't need court orders to regularly bring down child porn because there are already plenty of active attempts and stuff in place from IWF, ISPs, Police forces etc. https://en.m.wikipedia.org/wiki/Web_blocking_in_the_United_Kingdom https://en.m.wikipedia.org/wiki/Web_blocking_in_the_United_K...
- tialaramex 7y ago
  What the courts said went like this: _If_ you have a mechanism that you've put together to block some content (in this case the IWF to block child porn porn) then you must also use this mechanism to block stuff the court wants blocked, in this case everything Hollywood has arbitrarily decided it might be a copyright infringement. But if you don't have a mechanism to block stuff (which A&A does not because why would you want to spend money on that nonsense?) then obviously the court shouldn't order you to go around making Hollywood's life easier and you can ignore it.
  - DanBC 7y ago
    No, this is nonsense. The IWF blocks are completely separate (and use a different mechanism) to the court ordered piracy blocks. The court ordered piracy blocks only apply to the "big 6" ISPs. A&A doesn't have to comply because they're an insignificant ISP with very few customers.
    - rndgermandude 7y ago
      Not non-sense. https://www.techdirt.com/articles/20100427/1437179198.shtml https://www.techdirt.com/articles/20100427/1437179198.shtml
    - tialaramex 7y ago
      A different _legal_ mechanism these days, but the only affordable and effective technical countermeasure is DNS blocking, which is why this whole anti-DPRIVE thing happened. Cleanfeed as originally designed is irrelevant in 2019. It worked by doing transparent HTTP proxying on port 80 and then comparing URLs to a blacklist of hashes. But in 2019 the site can just upgrade you to HTTPS and then you vanish off the radar in Cleanfeed. What's left is yet more DNS blocking. You might think wait, surely they could do IP blocking? Well, no. Fast flux combined with the address exhaustion means if you do this you'll either underblock so badly you might as well not bother trying, or you'll overblock and get yourselves a reputation as the ISP whose Internet doesn't work. SNI lets your opponents do this to you as much as they want even though very few of their customers are doing anything you actually want to block. So the other working (but far too expensive) option is "Deep packet inspection" or "Transparent TLS proxies" where you'll watch the ClientHello and drop clients asking for forbidden names in SNI before the connection is encrypted. The UK government's White Paper in 2018 showed no appetite for this extra cost, but even if they go there that's exactly what eSNI fixes - so they'd spend all that money and by the time they ship anything probably it doesn't work anyway.
- rndgermandude 7y ago
  >but nearly all of it is actively filtered via the IWF lists. You wish. Those lists can only filter specific sites. Not the myriad of child porn that is shared privately. So those list based blocks might in fact protect some users who inadvertently clicked on the wrong link, not knowing where it would lead. But people actually seeking out this content do not care. It still would be effective to just inform providers and domain registrars[0]. I'm involved in running a small, non-commercial website that offers instant chat rooms without the need to sign up first. At some point the kiddly diddlers found out about it, and used it as basically a bootstrap tool for their activities. We had to play cat and mouse with them for a while, but have improved our system where most such things get automatically detected now or at least marked as suspicious, and the rest is handled by humans. So I am in the unfortunate position to know a thing or two about how these people operate, or at least those who abused our service. After they initially find each other, either to "trade" one on one or have a group thing going, they use services such a mega.nz[1] and other file hosters with ever new download URLs, or switch over to messenger services such as kik[2], tox[3] and discord[4] in particular, and use email (in particular protonmail these days) as a backup to finding each other again should their other accounts be taken down. TOR also plays a minor role, of course, but TOR's importance is usually overstated in public discussions about child porn, at least as far as I have seen, and we've rarely encountered people sharing hidden services; it's mostly about using TOR as an anonymizing, free "VPN"[5]. The amount of content (aka child abuse media) they share is tremendous. Them sharing 10s of GBs with a few mega links in one go was common. [0] We had this discussion in Germany ten years back, when the government proposed such filter lists that the ISPs should then enforce. There was a big opposition to that, as people thought the content should be actually removed and perpetrators prosecuted instead of just "hiding" it, and also establishing such a system would make all kinds of other groups eager to get courts to block other content with it, such as alleged piracy sites. Oh, and of course the lack of accountability and transparency was a big issue too. Turns out most providers will cooperate in taking down content, and the rest can be "made" to cooperate. The German group AK Zensur (NGO) ran an experiment back in 2009, and contacted providers based on leaked government child porn filter lists (mostly from Scandinavian countries). Most providers responded within 12 hours, removing illegal content, but more often than not they did not actually find child porn whatsoever (which the AK Zensur then verified). Most providers further said they had not been contacted previously (good job, law enforcement). https://ak-zensur.de/2009/05/loeschen-funktioniert.html https://ak-zensur.de/2009/05/loeschen-funktioniert.html (German) [1] mega.nz's model of plausible deniability means they also cannot identify content because they never see the content unencrypted (not even a hash of the unencrypted content). So they can only take down individual URLS and accounts, but cannot take down exact copies of the same file uploaded to other accounts. This, combined with the ease of making new accounts, each of which gets 50GB storage at first, and the feature to "unshare" (invalidate share links; allows people to share content for sometimes just a few seconds, so other people can import it into their own accounts and download later), makes mega very popular not just with content pirates, but also with people sharing child porn. [2] Easy to use, and easy to use group chats. [3] Harder to set up, but it claims to allow quasi anonymous decentralized communication incl file sharing if you put it behind a VPN or TOR. We've encountered "how to setup tox" inforgraphics in the past. [4] Discord used to be a bit wild west, being a new service which hadn't figured out a lot of things yet (kinda like us at the beginning), and probably underestimated the problem (also kinda like us in the beginning). They also made it pretty hard to actually report abuse (something like, "actually join the server, switch to developer mode, toggle some obscure other preference, copy the internal channel ID and write us an email containing that information"). Tho it seems they are doing a lot, lot better recently in banning "servers" involved in child porn. [5] Which put us in the unfortunate position to proactively ban TOR users from chatting (they can still read). 99% of TOR traffic was either outright malicious stuff like child porn, or spam. Sorry to the remaining less than 1% who played nice.
needtobeanon 7y ago
Blocking child porn is not optional in the UK. There is a mandatory block list which all ISPs are required to use, maintained by a private organization - the Orwellian named "Internet Watch Foundation", which is kept secret and is not disclosed for the stated reason that giving details would tell paedophiles where to look. They were responsible for the classification of the German band Scorpions album cover on Wikipedia being classed as child porn and resulting in blocking the Wikipedia page in the UK until that was sorted out. (Dec 7 2008)
- dingaling 7y ago
  That is not correct. The majority of big UK ISPs subscribe to the IWF lists but that's a self-regulatory choice. Many smaller ISPs don't and some even advertise that as an advantage.
- stordoff 7y ago
  A&A: > We don't provide a filtering service to restrict or limit access to anything on the Internet. When you take services from us you are opting out of any filtering services. The Internet has a lot of good and useful things, but it also has a lot of unpleasant and offensive things. Don't blame us for what you find on the Internet.[...] > We do not have, in our network, any equipment installed to filter access to any part of the public Internet for our customers as a whole. We aim to give 12 months notice if we ever add any such filtering. https://www.aa.net.uk/legal/full-terms-services/ https://www.aa.net.uk/legal/full-terms-services/ In the past, they've spoken out more explicitly against the IWF: > Not using IWF watch list > The system deployed now is not effective. It blocks web sites that have been reported, and that is all. It causes side effects (see recent wikipedia incident). It does not block ftp access, email, secure web sites, usenet, irc, peer to peer file sharing, or any tunnelled IP to proxies outside the UK, or indeed any number or simple ways around it. The system does not even try to.[...] > We feel sure anyone wanting access to child porn will have no trouble using the 95% of ISPs that use the IWF and there is no reason for them to come to us specially.[...] > At the end of the day, we are no more of a policeman than a power company powering a counterfeit printing press. We provide a utility - we shift IP packets. Using us for anything illegal is a matter for the police to deal with and the criminals concerned, and not for those companies that provide power, water, gas, or internet that happen to allow those activities. https://web.archive.org/web/20130430120759/https://www.aa.net.uk/news-censorship.html https://web.archive.org/web/20130430120759/https://www.aa.ne...

jimbob45 7y ago

I'm a bit of an internet novice so excuse me if this is dumb but won't the ISP still know which IP I've connected to? Just because I haven't conveniently looked it up in their giant DNS dictionary doesn't mean they can't just follow the traffic, right?

Ericson2314 7y ago
No HTTPs is encrypted. Edit oops I thought OP said what they communicate not what IP.
- tremon 7y ago
  But how does that tie in with SNI? The specs say that the client sends the intended hostname as part of the TLS handshake, can the ISP sniff the hostname from that handshake? [edit] as per wikipedia, https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication: The desired hostname is not encrypted, so an eavesdropper can see which site is being requested. This helps security companies provide a filtering feature and governments implement censorship. [..] As of mid 2018, an upgrade called Encrypted SNI (ESNI) is being rolled out in an "experimental phase" to address this risk of domain eavesdropping. On March 1, 2019, Daniel Stenberg stated that Mozilla Firefox supports ESNI.
  - arccy 7y ago
    Which is why encrypted SNI is in development
    - _o-O-o_ 7y ago
      Test for eSNI here: https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/
  - rocqua 7y ago
    You can sniff SNI which will still reveal hostnames. In certain cases though, you can use 'domain fronting'. That is using a different Host in the HTTPS header than is included in SNI. If that other hostname is served by the same ip address and certificate, then that server might just forward your HTTPS message to the host requested in the HTTPS header.

tremon 7y ago

So they nominated Firefox for implementing DNS over HTTP but not Chrome? Does anyone know their rationale for that?

ggg2 7y ago
less lawyers on retainer to establish a precedent? you are talking about dirty politicians, who are standing against something initially designed to twart oppressive regimes such as China's great firewall... any dirty trick in book is fair game to them.
m0xte 7y ago
Signed up to post this. This is because Google are a member of ISPA: https://www.ispa.org.uk/members/?letter=G%2CH%2CI https://www.ispa.org.uk/members/?letter=G%2CH%2CI The other nominees for Internet Villain were Donald Trump and EU article 13. But they chose Mozilla. Clearly ISPA has an agenda and cannot be trusted.

Ericson2314 7y ago

If the UK disapproves I'll be sure to use it! Only gotcha is screw this per-application stuff, will want the whole computer doing it. But that shouldn't be too hard to rig up on Linux. https://tools.ietf.org/html/draft-huitema-quic-dnsoquic-05 https://tools.ietf.org/html/draft-huitema-quic-dnsoquic-05 oooo. https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy does a few good protocols.

ggg2 7y ago
so true. the fact that browsers have dns resolvers is weird. to me only the kernel could do it, and it would limit outgoing port 53 by default to every other process. if I want to set configuration on my hosts file I damn sure want everything to follow it, not have to worry about thousands of applications that might or might not use it.
- krferriter 7y ago
  On Linux (and probably macos, windows), the kernel doesn't do DNS name resolution. The kernel provides the network stack which does IP, and also TCP and UDP. On Linux you need a tool that can do DNS operations, like NetworkManager, dhcpcd, dhclient, systemd-resolved. You could use selinux to restrict port access.

swiley 7y ago

I personally would have been a lot more comfortable with a different DNS protocol if 1) the companies pushing them didn’t limit it to just their product (and instead added it to the C runtime resolver) 2) didn’t limit it to their servers (that’s honestly pretty concerning)

zrm 7y ago
This is really the issue. DoH is a little ugly/slow, but the security improvement over vanilla DNS is real. There are superior alternatives like DNSCurve but DoH > plaintext DNS even if DNSCurve > DoH. The problem is implementing it in the application instead of the operating system. The owner of the device should be able to choose their DNS server in one place (including one that blocks or redirects domains the user actually wants to) and not have to keep after a dozen separate applications all with their own settings that ignore the user's globally stated preferences. Mozilla could do everyone a favor and produce a free independent DoH implementation for each platform they support that allows it to be used by the OS resolver in every application and have its configuration set all in one place. Extra points for supporting DNSCurve as well.
- flarex 7y ago
  There are instructions on how to route all operating system DNS requests through DoH here: https://developers.cloudflare.com/1.1.1.1/dns-over-https/cloudflared-proxy/ https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo.... One advantage that DoH has over DNSCurve is that it is much harder to detect or block due to it being encapsulated as https traffic.
  - zrm 7y ago
    > There are instructions on how to route all operating system DNS requests through DoH here Then the next step is to get operating systems to ship it by default and support DoH as a DHCP option: https://tools.ietf.org/html/draft-peterson-doh-dhcp-00 https://tools.ietf.org/html/draft-peterson-doh-dhcp-00 > One advantage that DoH has over DNSCurve is that it is much harder to detect or block due to it being encapsulated as https traffic. If you're using a network subject to active adversarial man in the middle attacks like that then you probably want to be sending all your traffic through some kind of encrypted tunnel rather than only DNS.

curt15 7y ago

I can see why the gov't would have something to say about DoH, but even though the article specifically asks "why do ISPs hate it?", it doesn't actually answer why ISPs themselves would have a hat in the ring. Surely they cannot be blamed if DoH prevents them from sniffing users' traffic?

rocqua 7y ago
Maybe they fear this will mean they need to do blocking outside the DNS level? I'd certainly be sweating as an ISP if I need to start doing SNI inspection to block certain domains. That takes some decent packet inspection infrastructure.
kevin_thibedeau 7y ago
ISPs can make money selling behavioral data to aggregators. Domain names are more valuable for this than bare IPs.
NikkiA 7y ago
I don't know if it's the reason, but... Most UK ISPs run advertising portals on DNS-not-found redirects, DoH would remove those redirects.
- jen20 7y ago
  This is almost certainly the reason. The first thing I do on any internet connection in the UK is change the DNS out for one that isn't broken...

llao 7y ago

DoH -> DNS over HTTP.

cadence- 7y ago
DNS over HTTPS.

dreamcompiler 7y ago

"The Net interprets censorship as damage and routes around it." -John Gilmore

TeMPOraL 7y ago
Obligatory reminder that this was said about packet routing, not about application-layer protocols.

rwmj 7y ago

A&A (a UK ISP) today donated £2940 to the Mozilla foundation. It's the amount that ISPA membership would have cost them if they were members which of course they are not: https://twitter.com/aaisp/status/1146803916853645314 https://twitter.com/aaisp/status/1146803916853645314

bogle 7y ago
That's worth knowing. Also, as a long-term subscriber to A&A for home/business I can recommend them as being very good as an ISP, too.
- dpwm 7y ago
  Having switched to a&a at work recently, they seem to be operating several levels above the more mainstream business DSL providers we've used. Their control panel is incredibly functional – containing detailed logs of pretty much everything. They also provide a lot of more technical line control options that you'd otherwise have to phone up and convince somebody to get changed. We haven't had the pleasure of needing to phone them up yet, but from what I've read about them they're a technically very capable team.
  - azalemeth 7y ago
    I've subscribed my mother to their FFTC service, upgrading her from ADSL. She lives in the middle of nowhere, and BT have historically cocked up an awful lot with the wiring. Their team know a hell of a lot more about networking than I do, _and_ know who in BT to get on to in order to make sure that the wires get reconnected the right way around (which they weren't!). I really can't recommend them enough. Sure, it's expensive, but a) I like the feeling that I'm contributing to things I agree with, and b) the people who work there deserve to earn a decent wage. Insofar as broadband has a "first class" product, they offer it.
m0xte 7y ago
Straight to the point. Excellent work from A&A. I am currently with Zen and as they are a member of ISPA I'm going to terminate my account and move to A&A next month.

nullwasamistake 7y ago

DNS is the last cleartext channel for ISP's to monitor browsing. This isn't about "porn" at all. Even with HTTPS ISP's have long been able to snoop DNS to find all the sites you visit. This data is extremely valuable for marketing since the ISP also knows who you are and where you live. And using DNS bypasses tracker blocking. This is all about ISP's getting mad that their advertising revanue is being cut off. And possibly a lot of pressure from governments to keep "metadata" like DNS requests in the clear

lifeisstillgood 7y ago

I applaud the IWF's intentions - I agree with ending child abuse - and am personally quiet happy with effective if draconian measures the problem there is the effective not the draconian We know some evil people record these vile acts, but we don't think that banning video cameras will solve the problem - so my gut feeling is that banning abuse images online is less about stopping the crime and more about not being reminded it exists. So I wonder what the effective solutions to child abuse are? Something to do with nosey neighbours willing to pry? With school teachers being amazingly sensitive? something to do with spending huge amounts on foster care and social services - something to do with simply getting to know and talk with your neighbours? or something else? Was childline ever effective? I don't know - but it's a huge problem with amazing ROI - and well worth spending at least as much as we do on pointless record my browser history projects.

DuskStar 7y ago
> We know some evil people record these vile acts, but we don't think that banning video cameras will solve the problem - so my gut feeling is that banning abuse images online is less about stopping the crime and more about not being reminded it exists. I'm personally always amazed that people seem to think the problem is the recording and not the abuse.
- yeaaaaaaaaaah 7y ago
  Banning images is a technical problem. Stopping abuse is a social problem.
  - penagwin 7y ago
    "Stopping abuse" isn't actionable - e.g. You can't say today I'm going to "stop abuse"(Unless you're an abuser). Banning images is an actionable measure - with the goal of stopping abuse. Not saying it's a good one.
- TeMPOraL 7y ago
  It's both. Legally, child sexual abuse is considered so vile a practice that it's addressed on both supply side and demand side. Criminalizing possession and handling of such recordings is an attempt at reducing demand. It's not a complete solution, but no real world is really solved by a single thing. Banning video cameras obviously isn't happening, because they're too useful for other things. But if, hypothetically, a company sold cameras magically limited to only recording children, and such cameras would become popular among child pornographers, then you could expect calls for a legal ban on the grounds that denying a few companies the ability to fleece people through market segmentation doesn't outweigh making life more difficult for the child pornographers.

davesmith1983 7y ago

This is pretty standard in the UK under the current political climate. The Conservative Government about 2 years ago was hell bent (and probably still is) on getting rid of "strong encryption" and wants backdoors in pretty much everything. Both major political parties are pretty censorious and many of the smaller parties aren't much better.

microcolonel 7y ago
> many of the smaller parties aren't much better There is certainly one which is much better; and maybe it's a total coincidence, but they seem to be the punching bag of the major parties. ;- )
- gmac 7y ago
  Which?
  - dijit 7y ago
    Liberal Democrat’s. They’ve been thrown under the bus for entering a coalition government and choosing to support alternative voting over scrapping tuition fees. Since they were a minority player they didn’t have much choice in fighting that ultimatum, but I understand why people feel scorned. Even if the conservatives are doing many, many more heinous things daily. As a nice conincidence the “NoToAV” campaign (lit. “No alternative vote”) was undertaken by the same people who drove the leaveEU campaign, they used remarkably similar tactics too. “AV will cost £250m, that should fund our army!” And such. https://images.app.goo.gl/Z4GP93UTWMgaVmLQ6 https://images.app.goo.gl/Z4GP93UTWMgaVmLQ6 I mention it because it was funded by the same conservative doners. So the Lib Dem’s lost both ways.
    - davesmith1983 7y ago
      The Liberal Democrats are still actively fighting against the historic Leave vote which means they cannot be trusted as they don't respect the people's will. They also support the current Hate Speech laws and want to expand them. They are essentially (like all laws against speech) essentially legitimising the idea of thought crime. Sorry but Liberal Democrats are part of the problem and I count them as part of the major parties.

ilovecaching 7y ago

DoH is plugging a security hole. ISPs and other entities were using that security hole to implement features for their users. The correct response is for them to use a different method of implementing their features that does not compromise user security. Their whole argument against DoH is ridiculous.

TeMPOraL 7y ago

I'm split here. Obviously this nomination only speaks well of Mozilla, but regarding DoH itself, isn't it a... problematic technology when it comes to user freedom? With DoH, how is Pi-hole going to work? Not sure if I like browsers working around the OS on this one; this should really be a user-configurable OS-level service.

chillydawg 7y ago
Your pi can be set up as a DoH server, of course!
- TeMPOraL 7y ago
  From what I read however, it can't be set to work OOTB for everyone on my network; I'd have to go on every machine and every Internet-connected application to try and change it, hoping all the applications would let me (if I read correctly, Chrome won't?).
  - bradknowles 7y ago
    See https://developers.cloudflare.com/1.1.1.1/dns-over-https/cloudflared-proxy/ https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo... and https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/ and https://openwrt.org/docs/guide-user/services/dns/doh_dnsmasq_https-dns-proxy https://openwrt.org/docs/guide-user/services/dns/doh_dnsmasq...

tinus_hn 7y ago

Oh no, suddenly ISPs are relegated back to their role as common carriers of data!

fryry 7y ago

I believe ISP level blocking in the UK can already be easily bypassed simply by not using your ISPs DNS servers.

jnwatson 7y ago
Yeah, I’m surprised that anybody thinks that DNS blocking is sufficient for anything save ad blocking.

antpls 7y ago

Is there any good local DNS proxy server that transforms classic DNS to DNS-over-HTTPS, for applications that don't implement it natively (such as Desktop Chromium) ?

pmoriarty 7y ago
dnscrypt-proxy[1], though you'll have to use something like iptables to redirect all DNS traffic to it [1] - https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy