6 ms·

We agree that ISPs should not need to view your browsing data without your consent. But there are many technical reasons for an ISP to want to run DNS outside t

by dcow 7y ago

We agree that ISPs should not need to view your browsing data without your consent. But there are many technical reasons for an ISP to want to run DNS outside the resolver privacy conversation: For one some ISPs run content filtering services. Some users prefer to concede extreme privacy for what they view as a safer browsing experience. It might not be your jam, but it exists. DNS is designed to be provider independent. It literally does not matter if a Google or Cloudflare or OpenDNS or DNSFilter or your ISP resolves requests. It was designed this way so that the system could be distributed and so that there is not a single point of failure for the internet’s arguably most important system. Its distributed nature means there are technical performance advantages to doing the above: reduced request latency, localized traffic routing and reduced bandwidth, etc. You don’t need a giant any cast network to serve DNS. You just need to use the servers closest to you.

tptacek 7y ago
This is a pretty silly debate. All you have to do is look at AT&T's DNS, see it hijack NXDOMAIN to send you to ad sites, and know that mainstream ISP DNS isn't trustworthy. We don't need to weigh up counterfactuals.
- dcow 7y ago
  I’m not saying that some ISPs aren’t malicious. But to say there is no reason for an ISP to serve DNS is absurd.
  - tptacek 7y ago
    There is no reason for ISP customers to use ISP DNS, given the available alternatives, and this will become even clearer as more people boot up DoH resolvers as alternatives to Cloud Flare.
    - dcow 7y ago
      Again this is absolutely false. Your ISP, and nobody else, can deliver the lowest latency and quickest path DNS resolution short of other providers paying ISPs for last mile fog boxes (as some DNS providers do). Why can’t my ISP support DoT? But that also highlights a huge misconception about DoT/DoH: it only provides privacy to the resolver. It does not make your requests private in the eyes of the server or spanning the recursive queries that may be required during resolution. I’m not particularly compelled to trust Cloudflare more than OpenDNS or whatever. It’s the same situation with VPN. Anyway it’s well known that the actual solution for people concerned with utmost privacy is a round robin resolver selection strategy. It’s super easy to implement... why aren’t browsers providing this type of option?
      - smcameron 7y ago
        > Your ISP, and nobody else, can deliver the lowest latency and quickest path DNS resolution Ha! Tell that to Verizon, 'cause I'm pretty sure they're not aware of it.
      - Operyl 7y ago
        My ISP’s DNS servers take longer both in round trip and total resolution time compared to both 1.1.1.1 and 8.8.8.8... and I have both Comcast and AT&T in an urban area. While this might have been true in the past, that is definitely no longer the case in a lot of areas.
      - kelnos 7y ago
        > Why can’t my ISP support DoT? They can, and I would be fine using it if it were a) fast, b) reliable, and c) (here's the big one) legally required that they not log or do anything with my queries. As it stands, Comcast's provided resolver is somehow slower than some of the third-party providers for me, and I don't care to give them the ability to sell my DNS data.
  - kelnos 7y ago
    I don't think anyone is arguing that there's no reason for an ISP to serve DNS.
    - dcow 7y ago
      > There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service. That’s the part of your comment I am replying to. Anyway I see you’re arguing ISPs shouldn’t care which provider you use, not that they shouldn’t want to default you to running their own. Perhaps I misunderstood your point. Regardless I’d argue the problem in the us is that any DNS provider can abuse your data. Today it’s big ISPs, tomorrow it’s Cloudflare. Unless we actually prevent (technically and/or socially) DNS from being an open book and develop strategies to mitigate the privacy issues it’s just a game of pick your poison, and that‘s what bothers me.
      - kelnos 7y ago
        Your reply was: > But to say there is no reason for an ISP to serve DNS is absurd. The part of my comment that you quoted does not at all say that. (In fact, no part of my comment says, or even suggest, that.) I agree that any DNS provider can abuse your data, but it's important to look at incentives. Comcast doesn't care one bit about its public image because it already has a terrible one, but customers have no choice in the matter, so Comcast's public image is mostly irrelevant. Several DoH providers bill themselves as privacy-focused, and make privacy a big point in their marketing around their DNS service. Violating that privacy would be damaging to their product and reputation, in a way that they'd likely care quite a bit about. I'd rather just have my local resolver have a list of 5 or so DNS providers with reasonably low-latency presence in my area (possibly including the local ISP, even, who knows), and just round-robin requests to them. There's really no way to make DNS not an "open book" as you put it; you can't ask someone to resolve a hostname for you without telling them what the hostname is. So yes, we need ways to mitigate harm. Unless a provider has their reputation on the line, I don't really see a way to keep providers from doing sketchy things with your data, at least not without legal regulation. It's not like things like the EU's GDPR and California's CCPA were dreamed out of nothing; they came about because people have started to realize that companies just will not act as good stewards of our data unless we legally mandate toothy financial consequences as punishment.
- topranks 7y ago
  I think the missing piece here is the constant focus on the US. In Europe ISPs are under much stricter rules about data privacy and generally cannot do things like the above. Having worked for several ISPs here I’ve never found them misusing DNS data (although sometimes it was logged for a time for management / troubleshooting.) For a European; with reasonable trust in my ISP, I don’t want Mozilla sending all my queries to a US company which can be forced to reveal that to the US govt, or use it for some other nefarious purpose. FWIW I’ve never used my ISP DNS though have always run my own recursor at home.
  - b6z 7y ago
    I absolutely agree with you. I have more trust into my local European ISP than into Google, Cloudflare and such.
    - tptacek 7y ago
      Nobody is asking you to trust Google more than you already do (if you don't run Chrome, this doesn't impact you at all). But the real question is: do you trust your European ISP more than anybody else that might ever run DNS for you? That seems like an extraordinary amount of trust. What DoH allows you to do is trust someone, anyone else to safely run DNS for you, without exposing anything to your ISP. That's a capability you think Europeans shouldn't want?
  - icebraining 7y ago
    Mozilla is only enabling DoH for US users, and Chrome is only enabling DoH if you were already using a DNS provider that also supports it.
  - kd913 7y ago
    Wouldn't the US company resolver be based in the EU though and subject to EU Law? That would have to be the case without the DNS resolver having ridiculously slow DNS query times. I don't think the US govt can ask for data present/originated from the EU.
    - 7y ago
viraptor 7y ago
ISPs are still able to run their filtering version of DNS server which the users are able to opt into. Nobody is going to take this away from them. But that is not a valid use case for filtering dns requests to other services.
- judge2020 7y ago
  I'd separate "valid" and "reasonable". UK ISPs have a "valid" reason to DPI DNS and block pornhub, but i wouldn't say its reasonable for them to mess with internet packets not destined for their network. Thankfully DoH pressures them to suck it up and accept that blocking needs to be done by parents via parental controls.
  - viraptor 7y ago
    That's what I'm saying. They can run their own DNS that people can opt into. They can provide those parental controls as well.
jdblair 7y ago
But DoH is provider independent. It's just like I can swap out AT&T's regular DNS service for Cloudflare's in my home setup. Which I did. Mozilla's move to reconfigure Firefox to use DoH is a bit sneakier, but it fits with their privacy stance and their low market share does give them cover.
- dcow 7y ago
  To be clear I’m not arguing against DoH/T. I’m arguing that there are technical and product reasons an ISP might want to run DNS.
  - CameronNemo 7y ago
    That is understandable. But when the majority of US ISPs are monopolitical or oligopolitical organizations with zero oversight (Ajit Patel), it becomes harder to argue that sell.
nathanlied 7y ago
> Its distributed nature means there are technical performance advantages to doing the above: reduced request latency, localized traffic routing and reduced bandwidth, etc. You don’t need a giant any cast network to serve DNS. You just need to use the servers closest to you. My issue with this is that I've never been with an ISP that had a faster response time than Cloudflare/Google - and one would think they should, after all, my ISP should be able to reach me as quickly (or quicker) than any other corporation. My current ISP has the fastest DNS benchmarks I've seen, and they're at 81ms for an uncached response, vs Cloudflare's 63ms and Google's 69ms. Cached response is similar (since I have a local cache). In addition, my ISP does not provide DoH/DNSCrypt/DNSSec. None. Just 'vanilla' DNS. Furthermore, they also don't provide an unaltered DNS service: they block some websites from resolving, the list isn't made available, and is decided via extrajudicial means. You cannot opt-out, and all ISPs in the country adhere to this. They're not forced by law to do so. I'm also not in a normally thought of as a repressive country: it's a member state of the European Union, after all. There are very good reasons for people to be outright hostile to ISPs and their shady underhanded practices, as you're seeing in this discussion. I feel that it is in any mostly online-based organisation's best interests to expose those practices.
- dcow 7y ago
  I'm taking issue at the hyperbolic nature of the comment. I'm not an ISP apologist. But to say there are zero technical reasons for an ISP to want to provide DNS is unfair and incorrect. Cloudflare and Google pay ISPs for the latency they get, FWIW. If I made my own resolver service today I would not be able to compete with your ISP without forking over $$$.
  - judge2020 7y ago
    Do peering agreements usually have money exchanged if they're already both at the same IX?
  - creato 7y ago
    > Cloudflare and Google pay ISPs for the latency they get, FWIW. If I made my own resolver service today I would not be able to compete with your ISP without forking over $$$. I think the main reason for this is even if your competitor grew like a weed, it would be a decade or two before you had the scale to justify rolling out a CDN/caching infrastructure like that of cloudflare. That's not a matter of simply paying ISPs money.
kelnos 7y ago
I don't think any of these things justify the ISP's response. Regarding content filtering services, in that case the user is specifically opting in to that service, so they won't need or care to use an alternate resolver. I agree that, ideally, you would use a resolver that's close to you in order to minimize latency and increase reliability, but: 1) This requires you to trust your ISP. Many people don't, and with good reason. 2) ISP DNS isn't exactly always the most reliable or fast thing anyway. I easily get better latency from Cloudflare or Quad9 (their old-school Do53 stuff, not the new-fangled DoH) than from Comcast's resolver. And regardless, if your DoH provider of choice goes down, you can always fall back to a different one, or to your ISP's resolver.
tinus_hn 7y ago
The fact that some nasty hacks used to work doesn’t require anyone to keep them working. In fact, the sooner they stop working the better.

by dcow 7y ago

tptacek 7y ago

This is a pretty silly debate. All you have to do is look at AT&T's DNS, see it hijack NXDOMAIN to send you to ad sites, and know that mainstream ISP DNS isn't trustworthy. We don't need to weigh up counterfactuals.

dcow 7y ago
I’m not saying that some ISPs aren’t malicious. But to say there is no reason for an ISP to serve DNS is absurd.
- tptacek 7y ago
  There is no reason for ISP customers to use ISP DNS, given the available alternatives, and this will become even clearer as more people boot up DoH resolvers as alternatives to Cloud Flare.
  - dcow 7y ago
    Again this is absolutely false. Your ISP, and nobody else, can deliver the lowest latency and quickest path DNS resolution short of other providers paying ISPs for last mile fog boxes (as some DNS providers do). Why can’t my ISP support DoT? But that also highlights a huge misconception about DoT/DoH: it only provides privacy to the resolver. It does not make your requests private in the eyes of the server or spanning the recursive queries that may be required during resolution. I’m not particularly compelled to trust Cloudflare more than OpenDNS or whatever. It’s the same situation with VPN. Anyway it’s well known that the actual solution for people concerned with utmost privacy is a round robin resolver selection strategy. It’s super easy to implement... why aren’t browsers providing this type of option?
    - smcameron 7y ago
      > Your ISP, and nobody else, can deliver the lowest latency and quickest path DNS resolution Ha! Tell that to Verizon, 'cause I'm pretty sure they're not aware of it.
    - Operyl 7y ago
      My ISP’s DNS servers take longer both in round trip and total resolution time compared to both 1.1.1.1 and 8.8.8.8... and I have both Comcast and AT&T in an urban area. While this might have been true in the past, that is definitely no longer the case in a lot of areas.
    - kelnos 7y ago
      > Why can’t my ISP support DoT? They can, and I would be fine using it if it were a) fast, b) reliable, and c) (here's the big one) legally required that they not log or do anything with my queries. As it stands, Comcast's provided resolver is somehow slower than some of the third-party providers for me, and I don't care to give them the ability to sell my DNS data.
- kelnos 7y ago
  I don't think anyone is arguing that there's no reason for an ISP to serve DNS.
  - dcow 7y ago
    > There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service. That’s the part of your comment I am replying to. Anyway I see you’re arguing ISPs shouldn’t care which provider you use, not that they shouldn’t want to default you to running their own. Perhaps I misunderstood your point. Regardless I’d argue the problem in the us is that any DNS provider can abuse your data. Today it’s big ISPs, tomorrow it’s Cloudflare. Unless we actually prevent (technically and/or socially) DNS from being an open book and develop strategies to mitigate the privacy issues it’s just a game of pick your poison, and that‘s what bothers me.
    - kelnos 7y ago
      Your reply was: > But to say there is no reason for an ISP to serve DNS is absurd. The part of my comment that you quoted does not at all say that. (In fact, no part of my comment says, or even suggest, that.) I agree that any DNS provider can abuse your data, but it's important to look at incentives. Comcast doesn't care one bit about its public image because it already has a terrible one, but customers have no choice in the matter, so Comcast's public image is mostly irrelevant. Several DoH providers bill themselves as privacy-focused, and make privacy a big point in their marketing around their DNS service. Violating that privacy would be damaging to their product and reputation, in a way that they'd likely care quite a bit about. I'd rather just have my local resolver have a list of 5 or so DNS providers with reasonably low-latency presence in my area (possibly including the local ISP, even, who knows), and just round-robin requests to them. There's really no way to make DNS not an "open book" as you put it; you can't ask someone to resolve a hostname for you without telling them what the hostname is. So yes, we need ways to mitigate harm. Unless a provider has their reputation on the line, I don't really see a way to keep providers from doing sketchy things with your data, at least not without legal regulation. It's not like things like the EU's GDPR and California's CCPA were dreamed out of nothing; they came about because people have started to realize that companies just will not act as good stewards of our data unless we legally mandate toothy financial consequences as punishment.
topranks 7y ago
I think the missing piece here is the constant focus on the US. In Europe ISPs are under much stricter rules about data privacy and generally cannot do things like the above. Having worked for several ISPs here I’ve never found them misusing DNS data (although sometimes it was logged for a time for management / troubleshooting.) For a European; with reasonable trust in my ISP, I don’t want Mozilla sending all my queries to a US company which can be forced to reveal that to the US govt, or use it for some other nefarious purpose. FWIW I’ve never used my ISP DNS though have always run my own recursor at home.
- b6z 7y ago
  I absolutely agree with you. I have more trust into my local European ISP than into Google, Cloudflare and such.
  - tptacek 7y ago
    Nobody is asking you to trust Google more than you already do (if you don't run Chrome, this doesn't impact you at all). But the real question is: do you trust your European ISP more than anybody else that might ever run DNS for you? That seems like an extraordinary amount of trust. What DoH allows you to do is trust someone, anyone else to safely run DNS for you, without exposing anything to your ISP. That's a capability you think Europeans shouldn't want?
- icebraining 7y ago
  Mozilla is only enabling DoH for US users, and Chrome is only enabling DoH if you were already using a DNS provider that also supports it.
- kd913 7y ago
  Wouldn't the US company resolver be based in the EU though and subject to EU Law? That would have to be the case without the DNS resolver having ridiculously slow DNS query times. I don't think the US govt can ask for data present/originated from the EU.
  - 7y ago

viraptor 7y ago

ISPs are still able to run their filtering version of DNS server which the users are able to opt into. Nobody is going to take this away from them. But that is not a valid use case for filtering dns requests to other services.

judge2020 7y ago
I'd separate "valid" and "reasonable". UK ISPs have a "valid" reason to DPI DNS and block pornhub, but i wouldn't say its reasonable for them to mess with internet packets not destined for their network. Thankfully DoH pressures them to suck it up and accept that blocking needs to be done by parents via parental controls.
- viraptor 7y ago
  That's what I'm saying. They can run their own DNS that people can opt into. They can provide those parental controls as well.

jdblair 7y ago

But DoH is provider independent. It's just like I can swap out AT&T's regular DNS service for Cloudflare's in my home setup. Which I did. Mozilla's move to reconfigure Firefox to use DoH is a bit sneakier, but it fits with their privacy stance and their low market share does give them cover.

dcow 7y ago
To be clear I’m not arguing against DoH/T. I’m arguing that there are technical and product reasons an ISP might want to run DNS.
- CameronNemo 7y ago
  That is understandable. But when the majority of US ISPs are monopolitical or oligopolitical organizations with zero oversight (Ajit Patel), it becomes harder to argue that sell.

nathanlied 7y ago

> Its distributed nature means there are technical performance advantages to doing the above: reduced request latency, localized traffic routing and reduced bandwidth, etc. You don’t need a giant any cast network to serve DNS. You just need to use the servers closest to you. My issue with this is that I've never been with an ISP that had a faster response time than Cloudflare/Google - and one would think they should, after all, my ISP should be able to reach me as quickly (or quicker) than any other corporation. My current ISP has the fastest DNS benchmarks I've seen, and they're at 81ms for an uncached response, vs Cloudflare's 63ms and Google's 69ms. Cached response is similar (since I have a local cache). In addition, my ISP does not provide DoH/DNSCrypt/DNSSec. None. Just 'vanilla' DNS. Furthermore, they also don't provide an unaltered DNS service: they block some websites from resolving, the list isn't made available, and is decided via extrajudicial means. You cannot opt-out, and all ISPs in the country adhere to this. They're not forced by law to do so. I'm also not in a normally thought of as a repressive country: it's a member state of the European Union, after all. There are very good reasons for people to be outright hostile to ISPs and their shady underhanded practices, as you're seeing in this discussion. I feel that it is in any mostly online-based organisation's best interests to expose those practices.

dcow 7y ago
I'm taking issue at the hyperbolic nature of the comment. I'm not an ISP apologist. But to say there are zero technical reasons for an ISP to want to provide DNS is unfair and incorrect. Cloudflare and Google pay ISPs for the latency they get, FWIW. If I made my own resolver service today I would not be able to compete with your ISP without forking over $$$.
- judge2020 7y ago
  Do peering agreements usually have money exchanged if they're already both at the same IX?
- creato 7y ago
  > Cloudflare and Google pay ISPs for the latency they get, FWIW. If I made my own resolver service today I would not be able to compete with your ISP without forking over $$$. I think the main reason for this is even if your competitor grew like a weed, it would be a decade or two before you had the scale to justify rolling out a CDN/caching infrastructure like that of cloudflare. That's not a matter of simply paying ISPs money.

kelnos 7y ago

I don't think any of these things justify the ISP's response. Regarding content filtering services, in that case the user is specifically opting in to that service, so they won't need or care to use an alternate resolver. I agree that, ideally, you would use a resolver that's close to you in order to minimize latency and increase reliability, but: 1) This requires you to trust your ISP. Many people don't, and with good reason. 2) ISP DNS isn't exactly always the most reliable or fast thing anyway. I easily get better latency from Cloudflare or Quad9 (their old-school Do53 stuff, not the new-fangled DoH) than from Comcast's resolver. And regardless, if your DoH provider of choice goes down, you can always fall back to a different one, or to your ISP's resolver.

tinus_hn 7y ago

The fact that some nasty hacks used to work doesn’t require anyone to keep them working. In fact, the sooner they stop working the better.