9 ms·

The Cloudflare DNS servers you connect to are in the EU and are subject to EU regulation just like your ISP. You don't have 11 ms (or anything sub-~90 ms) laten

The Cloudflare DNS servers you connect to are in the EU and are subject to EU regulation just like your ISP. You don't have 11 ms (or anything sub-~90 ms) latency to the US. One thing to consider also is that unencrypted DNS means that virtually anyone can read (and modify) those requests, not just your ISP. That can be before the data enters your ISPs network, or at any point that isn't physically or technically well protected. Or, in the case of state actors, at any point really.

judge2020 7y ago
> or at any point that isn't physically or technically well protected Kind of off topic, but I was wondering if ISPs use any encryption whatsoever between the home and their IX/servers. Could you theoretically attach something to the wire in the ground, or monitor a satellite-based internet signal, and observe the HTTP/unencrypted data?
- missosoup 7y ago
  There's no additional encryption layer if that's what you're asking. There will still be multiplexing and whatnot, but if you can recover a particular stream from that, it'll be the same stream that the endpoints see.
  - Hikikomori 7y ago
    There is macsec, probably not that common but the ISP I was working for was looking to implement it in their network. Multiplexing on what?
    - tialaramex 7y ago
      > Multiplexing on what? Light. Optical fibres can move _way_ more data than actual households need, so you use one fibre to move data for, say, 16 endpoints until you get closer, and split it later, saving the cost of 15 long fibres. You can do everything so that there are no active components out in the field where it's annoying except at the customer site, a passive splitter is quite capable of shoving frequencies A-A' to Alice, B-B' to Bob and so on, it's not just solid state it's completely passive, no more likely to need maintenance than, say, the fibre itself.
      - Hikikomori 7y ago
        Not sure how that is relevant to OP's question then. You're describing PON, ONT-OLT communication is typically encrypted as well which makes the response make even less sense. Wouldn't say that the cost benefits are from that, majority of the cost is going to be from putting fibre into the ground or on poles, same cost for 1 or 200 pairs. The real benefit is that you don't need any active equipment like in an ethernet distribution network.
        tialaramex 7y ago
        > ONT-OLT communication is typically encrypted as well Is it? I guess that's conceivable though it looks _optional_ to me, but I have no statistics as to how widely the option is taken up. Nevertheless the G.948 work basically doesn't care about eavesdroppers. The threat model they've engineered around is that Eve lives next to Bob, and so if she tweaks the ONT (which legally belongs to her ISP but is on her property) she can see Bob's messages, whereas we're talking about a fibre tap to receive everybody's messages and then we'll root through that for Bob's messages. G.948 as amended makes random keys in each ONT and sends them to the OLT, knowing Eve can't see the key chosen by Bob's ONT (it passes upstream not downstream). But as an eavesdropper with a fibre tap we do see both directions so this countermeasure doesn't inconvenience us. Good on them for spelling out a threat model, and to me their model seems reasonable (if Alice buys Premium Sports for $180 per month we don't want Bob to watch Premium Sports free by pirating Alice's data) but it doesn't stop bad guys snooping this traffic.
- Hikikomori 7y ago
  Anyone with physical access can read unencrypted traffic if the ISP has not implemented any link layer encryption. All you need is to slightly bend a fiber and it will leak light.
throw0101a 7y ago
> The Cloudflare DNS servers you connect to are in the EU and are subject to EU regulation just like your ISP. Yeah, sure: > Primarily the CLOUD Act amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil. * https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
- tomschlick 7y ago
  The CLOUD Act would do nothing in this case because Cloudflare doesn't store data related to your requests and claims they are regularly audited to prove that. CF has a lot more privacy minded people to whistle blow on that if they were lying than your local ISP would.
  - throw0101a 7y ago
    Can they be forced to store data? People at Yahoo were monitoring e-mail on behest of the US government, and not even telling the company's CISO about it: * https://www.reuters.com/article/us-yahoo-nsa-exclusive-idUSKCN1241YT https://www.reuters.com/article/us-yahoo-nsa-exclusive-idUSK... * https://arstechnica.com/tech-policy/2016/10/report-fbi-andor-nsa-ordered-yahoo-to-build-secret-e-mail-search-tool/ https://arstechnica.com/tech-policy/2016/10/report-fbi-andor...
    - tomschlick 7y ago
      I'm not sure. Going by the Apple example, they refused to create new code to do something they were not in the past. That limit made the courts agree with them that they could not be compelled to create something new. Yahoo / ISPs already have the data so they have to comply with the law by providing that data upon request.
      - throw0101a 7y ago
        > Yahoo / ISPs already have the data so they have to comply with the law by providing that data upon request. Data is being sent to CF: can they be forced to raise the logging level from "INFO" to "DEBUG"? See also Lavabit: > Lavabit is an open-source encrypted webmail service, founded in 2004. The service suspended its operations on August 8, 2013 after the U.S. Federal Government ordered it to turn over its Secure Sockets Layer (SSL) private keys, in order to allow the government to spy on Edward Snowden's email.[2][3][4][5] * https://en.wikipedia.org/wiki/Lavabit https://en.wikipedia.org/wiki/Lavabit
deleted 7y ago
[deleted]
tjoff 7y ago
Regulations of cloudfare and an ISP are often hugely different though.
ti_ranger 7y ago
> The Cloudflare DNS servers you connect to are in the EU and are subject to EU regulation just like your ISP. In my (non-EU) country, ISPs are subject to relatively strict regulations, and Cloudflare doesn't fall under those regulations. > One thing to consider also is that unencrypted DNS means that virtually anyone can read (and modify) those requests Not "virtually anyone", it would require physical access to the GPON fibre between my home and the MSAN/CO/Exchange (non-trivial, scales really bandly), or the MetroEthernet backhaul from the MSAN to the BNG (where they would trip alarms and the last-mile provider would investigate). From the BNG onwards traffic is encrypted on-the-wire (MPLS with group encryption as far as I know) until it is handed over to the ISP. My ISP co-locates caching DNS with their hand-over routers, so here it would require tapping the fibres in their data-center (not happening without their knowledge). Also, someone who is just mass-collecting my DNS requests without any other identifying data, and no ability to correlate IP address to users, has limited privacy exposure. A centralised third-party, who can correlate source IP addresses with user-identifying browser cookies from other HTTP requests in the same time window seems like a much bigger privacy concern. Americans, please sort out your last-mile provider+ISP monopolies (e.g. lobby your politicians for regulations that enforce competition), so that you can stop forcing unnecessary technical solutions on the rest of the world, who doesn't have this problem (if ISPs do anti-customer things, they lose business).
pergadad 7y ago
It's an untested legal situation: EU claims authority (GDPR for European customers) AND US claims authority (various snooping acts binding for US companies even when working abroad). At least in public there's no resolution at this point in time.
- chopin 7y ago
  In contrast to the US the EU does almost nothing to enforce their claimed authority.
mtsr 7y ago
There is a perfectly good alternative which is encrypted DNS or DNS-over-TLS. That should be implemented instead. Sure it’s harder, because it’s decentralized, but that’s the whole point of DNS.

judge2020 7y ago

> or at any point that isn't physically or technically well protected Kind of off topic, but I was wondering if ISPs use any encryption whatsoever between the home and their IX/servers. Could you theoretically attach something to the wire in the ground, or monitor a satellite-based internet signal, and observe the HTTP/unencrypted data?

missosoup 7y ago
There's no additional encryption layer if that's what you're asking. There will still be multiplexing and whatnot, but if you can recover a particular stream from that, it'll be the same stream that the endpoints see.
- Hikikomori 7y ago
  There is macsec, probably not that common but the ISP I was working for was looking to implement it in their network. Multiplexing on what?
  - tialaramex 7y ago
    > Multiplexing on what? Light. Optical fibres can move _way_ more data than actual households need, so you use one fibre to move data for, say, 16 endpoints until you get closer, and split it later, saving the cost of 15 long fibres. You can do everything so that there are no active components out in the field where it's annoying except at the customer site, a passive splitter is quite capable of shoving frequencies A-A' to Alice, B-B' to Bob and so on, it's not just solid state it's completely passive, no more likely to need maintenance than, say, the fibre itself.
    - Hikikomori 7y ago
      Not sure how that is relevant to OP's question then. You're describing PON, ONT-OLT communication is typically encrypted as well which makes the response make even less sense. Wouldn't say that the cost benefits are from that, majority of the cost is going to be from putting fibre into the ground or on poles, same cost for 1 or 200 pairs. The real benefit is that you don't need any active equipment like in an ethernet distribution network.
      - tialaramex 7y ago
        > ONT-OLT communication is typically encrypted as well Is it? I guess that's conceivable though it looks _optional_ to me, but I have no statistics as to how widely the option is taken up. Nevertheless the G.948 work basically doesn't care about eavesdroppers. The threat model they've engineered around is that Eve lives next to Bob, and so if she tweaks the ONT (which legally belongs to her ISP but is on her property) she can see Bob's messages, whereas we're talking about a fibre tap to receive everybody's messages and then we'll root through that for Bob's messages. G.948 as amended makes random keys in each ONT and sends them to the OLT, knowing Eve can't see the key chosen by Bob's ONT (it passes upstream not downstream). But as an eavesdropper with a fibre tap we do see both directions so this countermeasure doesn't inconvenience us. Good on them for spelling out a threat model, and to me their model seems reasonable (if Alice buys Premium Sports for $180 per month we don't want Bob to watch Premium Sports free by pirating Alice's data) but it doesn't stop bad guys snooping this traffic.
Hikikomori 7y ago
Anyone with physical access can read unencrypted traffic if the ISP has not implemented any link layer encryption. All you need is to slightly bend a fiber and it will leak light.

throw0101a 7y ago

> The Cloudflare DNS servers you connect to are in the EU and are subject to EU regulation just like your ISP. Yeah, sure: > Primarily the CLOUD Act amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil. * https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act

tomschlick 7y ago
The CLOUD Act would do nothing in this case because Cloudflare doesn't store data related to your requests and claims they are regularly audited to prove that. CF has a lot more privacy minded people to whistle blow on that if they were lying than your local ISP would.
- throw0101a 7y ago
  Can they be forced to store data? People at Yahoo were monitoring e-mail on behest of the US government, and not even telling the company's CISO about it: * https://www.reuters.com/article/us-yahoo-nsa-exclusive-idUSKCN1241YT https://www.reuters.com/article/us-yahoo-nsa-exclusive-idUSK... * https://arstechnica.com/tech-policy/2016/10/report-fbi-andor-nsa-ordered-yahoo-to-build-secret-e-mail-search-tool/ https://arstechnica.com/tech-policy/2016/10/report-fbi-andor...
  - tomschlick 7y ago
    I'm not sure. Going by the Apple example, they refused to create new code to do something they were not in the past. That limit made the courts agree with them that they could not be compelled to create something new. Yahoo / ISPs already have the data so they have to comply with the law by providing that data upon request.
    - throw0101a 7y ago
      > Yahoo / ISPs already have the data so they have to comply with the law by providing that data upon request. Data is being sent to CF: can they be forced to raise the logging level from "INFO" to "DEBUG"? See also Lavabit: > Lavabit is an open-source encrypted webmail service, founded in 2004. The service suspended its operations on August 8, 2013 after the U.S. Federal Government ordered it to turn over its Secure Sockets Layer (SSL) private keys, in order to allow the government to spy on Edward Snowden's email.[2][3][4][5] * https://en.wikipedia.org/wiki/Lavabit https://en.wikipedia.org/wiki/Lavabit

deleted 7y ago

[deleted]

tjoff 7y ago

Regulations of cloudfare and an ISP are often hugely different though.

ti_ranger 7y ago

> The Cloudflare DNS servers you connect to are in the EU and are subject to EU regulation just like your ISP. In my (non-EU) country, ISPs are subject to relatively strict regulations, and Cloudflare doesn't fall under those regulations. > One thing to consider also is that unencrypted DNS means that virtually anyone can read (and modify) those requests Not "virtually anyone", it would require physical access to the GPON fibre between my home and the MSAN/CO/Exchange (non-trivial, scales really bandly), or the MetroEthernet backhaul from the MSAN to the BNG (where they would trip alarms and the last-mile provider would investigate). From the BNG onwards traffic is encrypted on-the-wire (MPLS with group encryption as far as I know) until it is handed over to the ISP. My ISP co-locates caching DNS with their hand-over routers, so here it would require tapping the fibres in their data-center (not happening without their knowledge). Also, someone who is just mass-collecting my DNS requests without any other identifying data, and no ability to correlate IP address to users, has limited privacy exposure. A centralised third-party, who can correlate source IP addresses with user-identifying browser cookies from other HTTP requests in the same time window seems like a much bigger privacy concern. Americans, please sort out your last-mile provider+ISP monopolies (e.g. lobby your politicians for regulations that enforce competition), so that you can stop forcing unnecessary technical solutions on the rest of the world, who doesn't have this problem (if ISPs do anti-customer things, they lose business).

pergadad 7y ago

It's an untested legal situation: EU claims authority (GDPR for European customers) AND US claims authority (various snooping acts binding for US companies even when working abroad). At least in public there's no resolution at this point in time.

chopin 7y ago
In contrast to the US the EU does almost nothing to enforce their claimed authority.

mtsr 7y ago

There is a perfectly good alternative which is encrypted DNS or DNS-over-TLS. That should be implemented instead. Sure it’s harder, because it’s decentralized, but that’s the whole point of DNS.