32 ms·

Comcast Is Lobbying Against DNS Encryption

502 points by president 7y ago

wayneftw 7y ago
How can you lobby against a browser feature? It's not like Google or Mozilla were trying to write a new law. Are there laws that browsers MUST adhere to? Because I'm pretty sure I can create a web browser that behaves in any way that I see fit.
- kevingadd 7y ago
  If web browsers want to allow playing content from DRM'd services like Netflix, they get tangled up in a bundle of regulations like the DMCA and have to use specific services like this: https://en.wikipedia.org/wiki/Widevine https://en.wikipedia.org/wiki/Widevine At a lower level, formats like H264 are basically part of the web platform too, so you end up implementing them and that exposes you to software patent laws. So, in practice: Yes, there are laws browsers must adhere to. If you're willing to strip a bunch of features out of your browser and you live in a country with a less awful legal climate, maybe not too many laws. For a while the US banned export of encryption if you aren't familiar with that - it impacted stuff like web browsers and resulted in people using 56-bit (!) encryption keys for things.
  - Darth_Hobo 7y ago
    In practice you can host your browser redistributable on non-US server that has no obligation to US laws. And if US user chooses to download from that location there is nothing they can do about it.
- tptacek 7y ago
  There were literally just House hearings about the impact of DoH on law enforcement investigations. You lobby against it by trying to get a law passed to ban it.
  - schoen 7y ago
    Are you sure you're not thinking of hearings about some other aspect of encryption? I've been working on the DoH issue, including writing to Congress about it, and I don't recall a hearing having happened yet.
    - tedunangst 7y ago
      Possibly meant the investigation letter. https://www.wsj.com/articles/google-draws-house-antitrust-scrutiny-of-internet-protocol-11569765637 https://www.wsj.com/articles/google-draws-house-antitrust-sc...
    - tptacek 7y ago
      I’m sure. I’ll dig up a link; you can watch it.
      - schoen 7y ago
        Please!
        tptacek 7y ago
        https://youtu.be/FBF1n6Q5vvY?t=6144 https://youtu.be/FBF1n6Q5vvY?t=6144
jedisct1 7y ago
And at the same time, they deployed a DoH server: https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v2/public-resolvers.md#xfinity https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v...
- magashna 7y ago
  No mention of whether it is logging or not. I think I can safely assume they are logging everything.
  - cremp 7y ago
    Which is just gravy, because the whole DoH crowd is against ISP monitoring and selling it. Goes to show that the only thing Doh/DoT/et al. did was to make things more complicated and harder to work with.
ivankolev 7y ago
That instantly makes me feel dns encryption is something worth exploring in depth...
- flatiron 7y ago
  I do DoH with pi hole and cloudflare (followed arch wiki for all of that) but I think it’s silly. You don’t know what I’m resolving but you still know what ips I’m visiting and can just look up their host names. What does it really do?
  - fweespeech 7y ago
    You can have multiple hostnames per IP. (i.e. If you are using a site that uses cloudflare) That fact will make it very difficult to resolve hostname to ip address for anyone behind a CDN. That is the reason Comcast is fighting it.
    - flatiron 7y ago
      Makes sense. Thanks. Then I’m glad I’m using it! I fell into the arch wiki black hole and an hour later had pi hole, DoH and OpenVPN all configured so all my devices including my iPhone go through my home internet and the pi hole. Pretty neat. No ads while mobile. I did have to do tcp on 443 since udp and t mobile did not play nice together. I was too lazy to debug that though.
  - giggles_giggles 7y ago
    I thought DoH would defeat the pihole. Is this incorrect?
    - flatiron 7y ago
      Check out the pi hole arch wiki. Tells you how to use DoH with cloudflare. Takes 2 minutes.
  - sliken 7y ago
    A fair chunk of internet content is hosted in the cloud. So while comcast knows exactly what IPs you are talking to they can't tell much else. This prevents them from tracking your habits, selling that data, and creating or marketing competition. It also makes it harder to crippling the network for some specific competitor like youtube or netflix. How else is Comcast going to hold it's users hostage so netflix has to pay extra to get the bits the customers paid to get?
koolba 7y ago
How hard would it be for them to instead reverse lookup the outbound socket IP addresses to determine the servers to which you are connecting? Assuming they have some people performing the same DNS lookups from similar locations I bet they could construct a good enough mapping. It’d probably be even more accurate if there’s DNS caching client side as it’d count actual connections and not just lookups.
- GhettoMaestro 7y ago
  Your method wouldn't work too well as multiple websites will be multiplexed behind a single IP address via a method known as "named-based virtual hosting". It exists even with TLS, as SNI (Server Name Indication) was added to serve this purpose. However, in the future, TLS will most likely mandate that SNI be encrypted and not visible to a passive attacker (it is currently in IETF draft status, as someone pointed out below).
  - anfilt 7y ago
    Its still just a draft last I checked. https://tools.ietf.org/html/draft-ietf-tls-esni-04 https://tools.ietf.org/html/draft-ietf-tls-esni-04 Where as tls 1.3 is a RFC. https://tools.ietf.org/html/rfc8446 https://tools.ietf.org/html/rfc8446
- JMTQp8lwXL 7y ago
  One IP address could have multiple hostnames pointing to it. DNS permits this. I could register my own domain name, right now, and point it to what `dig facebook.com`'s IP address is.
  - vanadium 7y ago
    Pretty much the default position for everyday shared hosting environments, unless a static IP is explicitly requested by a customer.
- jcampbell1 7y ago
  My thought is that with SNI (Server Name Identification), the domain is transmitted in plaintext as is. Encrypted SNI is a long way off unless everyone starts letting a 3rd party like Cloudflare manage everything. To cut Comcast out of the loop requires the OS/Browsers to switch away from Comcast's DNS, and a huge amount of the web terminating at generic Cloudflare IPs with Encrypted SNI.
mrlala 7y ago
I still can't wrap my head around DNS encryption; can someone explain it or link me to an article/video? I seem to remember reading that for this to work, you would have to trust someone like google, but then wouldn't you essentially have to proxy all of your data through google or some dns encryption source.. i.e., almost making it a VPN? Surely I am missing something- I just don't see how you can hide traffic from your ISP without a proxy in the middle..
- heavyset_go 7y ago
  DNS isn't encrypted. Anyone passing your DNS queries between you and your DNS provider can inspect them. DoH or DoT would allow your upstream DNS provider to see your queries, but anyone passing them around wouldn't see the content of the queries. Comcast won't be able to read those queries if they're encrypted via DoH, and part of their business model involves spying on their customers' queries and selling the data. DoH has nothing to do with proxying.
  - mrlala 7y ago
    Thank you, however I still don't understand how it works from what you said. What is an "upstream DNS provider" in this context? I'm just not seeing how Comcast can't still know where you going, since obviously you are routing your traffic through them and they see the IP address; how is the IP not giving them enough information to figure out where you are going? Is encrypted DNS only going to work for a handful of sites running in some special way, or is this supposed to work for everything?
    - heavyset_go 7y ago
      > What is an "upstream DNS provider" in this context? This would be your DoH provider. You can have layers of caching and DNS servers on your machine and network, but DNS queries ultimately have to go a foreign DNS provider. > I'm just not seeing how Comcast can't still know where you going If your connections aren't encrypted, or you only access servers with static IP addresses, then Comcast will be able to know where you're going. Modern web applications have many layers of indirection, and you can't always correlate accessed IP addresses with the service the user is using. As an example, consider a site that uses HTTPS and is proxied with Cloudflare. To Comcast, you're sending encrypted bytes to an IP address that doesn't identify the site, it's just Cloudflare. With unencrypted DNS, Comcast can just look at your DNS queries and determine the sites you're visiting. With encrypted DNS, Comcast sees that you connected to your DNS provider and Cloudflare, which isn't exactly valuable.
gormandizer 7y ago
Encrypted DNS is great. My only problem (as a linux user) is that I want all DNS lookups on my machine to be performed by querying the servers listed in "/etc/resolve.conf". DoH as implemented by Firefox and Chrome breaks that.
- LogicX 7y ago
  You should look into DoT instead
  - gormandizer 7y ago
    I've been doing DNS over TLS with pfSense for over a year now. The problem as I understand it is that Firefox and Chrome will soon default to DoH. Now I have to remember to go in and change default app settings. Ok not a huge deal with just two apps but yet something else I shouldn't have to do.
    - growse 7y ago
      Just set your network resolver to return NXDOMAIN for the canary domain use-application-dns.net. (https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...) That will signal to firefox (at least) to disable DoH and use the system resolver.
  - tptacek 7y ago
    How exactly does DoT make any of this any better? Conceptually, your local system resolver can use DoH just as easily as DoT. The primary difference between the two protocols, from a pragmatic perspective, is that DoT can be blocked by ISPs and network providers, and DoH is harder to block.
- zrm 7y ago
  There is a solution for that -- install a local resolver that makes queries using DoT/DoH/DNSCurve/DNS-over-WireGuard/whatever but answers them using ordinary UDP DNS, then make that your DNS server in /etc/resolv.conf.
pmlnr 7y ago
Pitiful people Comcast, shame on you. This information never should have been sold.
- sliken 7y ago
  Just imagine if Comcast loses the ability to hold content providers hostage. With DOH it's much harder to tell that most of your customers are streaming from Netflix, so it's much harder to artificially degrade their network connections so you can ask Netflix to pay extra.
  - zzzcpan 7y ago
    Beefy cache nodes of any company, not just Netflix, are trivially identifiable.
    - sliken 7y ago
      But if you have a list of 1000 beefy cache nodes who do you send the ransom letters to? How about if each beefy cache node has 1000 IPs instead of 1? What if each client was sticky, so if Comcast buys a Netflix account they only end up on one beefy cache node? Hell if pushed hard enough maybe netflix would enable p2p (encrypted with DRM of course) for content delivery. I'd happily hook up a 1TB usb to my roku if it improved the playback experience. Of course DoT is not perfect, but it does seem like it would help, so much so that Comcast is lobbying against it.
meed 7y ago
Is there anything that this company does that ain't suck?!
peterwwillis 7y ago
DNS encryption is going to be one of the big boondoggles of the 21st century internet. I am currently going through a project at work to certify all the applications which need a custom root CA cert added to them, for their traffic to be inspected. This is part of GDPR certification. This is not some nefarious project to spy on employees, or even a DLP initiative. To comply with GDPR, we have to know where PII comes and goes, and over 80% of that data goes over HTTPS. That means that for any company to be able to comply with GDPR, they have to inspect all HTTPS traffic. Now, could TLS clients provide a mechanism to export all decrypted traffic, separate from the validation path? Sure. But that's not a part of the TLS spec, so to my knowledge, TLS libraries just don't have that option, and all the applications I know of certainly don't expose it. So even though to provide for the above requirements, all we need is a read-only tap of the decrypted content, it wasn't required (or possibly even considered), so now we need read-write access to all content, which is in no way what the requirements were intended for. That's bad, but what's worse is this process is introducing dozens of bugs. In many cases, the proprietary content filters are actually failing to validate correctly, and proxying payloads from hosts with invalid certs to unsuspecting clients. Not only do we have to MITM everything, but we're making security worse, and breaking apps. Take all of these considerations, and now instead of it being HTTP content, it's DNS. From an internet privacy perspective, there are only so many hostnames and IPs on the internet. Regardless of how you encrypt it, if you can observe hundreds of millions of individual users' traffic, it will be trivial to discover what DNS records a connection is requesting by statistical analysis. I agree with making the data integrity immutable, but that doesn't mean we have to force it all to also be private, not to mention breaking the distributed, decentralized design that made DNS resilient to begin with.
- outworlder 7y ago
  > To comply with GDPR, we have to know where PII comes and goes, and over 80% of that data goes over HTTPS. That means that for any company to be able to comply with GDPR, they have to inspect all HTTPS traffic. Fine. A company can inspect their own traffic. This doesn't mean that _other_ companies should have the same ability, including upstream providers. > Not only do we have to MITM everything, but we're making security worse, and breaking apps. Sounds like what most of the "security compliance" certifications actually do.
jrockway 7y ago
ISPs are dying to find some sort of "value add" to get more revenue, but it's just not there. ISPs need to realize that they are strictly a utility now. All the value that they could possibly add can be obtained from any other company now. They used to provide TV service, but nobody wants linear TV and can just send their money directly to the company that produces the TV content and have it delivered over IP. They used to provide phone service, but nobody wants phone service; they have a cell phone and can get a fake landline from any number of companies for almost no money. They used to provide a DNS resolver, but they used the DNS resolver to inject fake addresses, so the power has been moved away from them. They used to provide Usenet, but their "content partners" didn't like that, so now you get Usenet from a third-party provider. IP is just too versatile. All customers want from their ISP is the dumbest possible pipe, because they can get all other services over that pipe and pick the best deals. If you aren't interested in infrastructure, then you shouldn't be an ISP. (That said, I don't see why companies like Comcast aren't pursuing things like becoming Cloudflare or AWS. "Click here to host your docker container 1ms away from 87% of the US population," seems like a service that could make a lot of money.)
- snagglegaggle 7y ago
  Unless something drastic happens ISPs are going to win. They're increasingly charging per bit for wire data (where there is no inherent scarcity), lobbying to prevent competitors, and have taken public funds and failed to reinvest in their infrastructure.
  - andrei_says_ 7y ago
    Lobbying and changing laws to apply reality distortion fields on all their customers and the competition is cheaper than investing into R&D or infrastructure and provide a better service or innovate and compete. If it’s true for ISPs, it’s true for other big players and is a symptom of a failing system.
  - hombre_fatal 7y ago
    Well, there definitely is bandwidth scarcity. Also, unmetered bandwidth is just one major reason botnets are so trivial. Nobody knows or even has incentive to know that their smart toaster is involved in DDoS attacks so now we're all centralizing behind Cloudflare to mitigate this reality. Now, I'd like to see a fair price per bit, but I'm not convinced the world is better without it.
virtuallynathan 7y ago
This isn’t exactly true... Comcast just launched their own DoH endpoint. I also used to work very closely with the DNS team at Comcast. At the time, they did not sell or even log/look at DNS data. It was sampled in aggregate to break down CDN traffic in Netflow data.
- kevin_thibedeau 7y ago
  Comcast's masters likely have the same arrangement that AT&T does. Everything passes through a closet the rank and file know nothing about.
  - virtuallynathan 7y ago
    That's a totally different and unrelated assertion. If the Gov't wants that traffic, they can just go to a Level3 fiber regeneration site in the middle of nowhere and tap the fiber traffic of hundreds of companies.
- wbl 7y ago
  Doesn't the ASN tell you that?
  - virtuallynathan 7y ago
    The ASN will only tell you the traffic is from Akamai, not that it was for apple.akamai.com or steampowered.akamai.com, etc.
- kitteh 7y ago
  Didn't Comcast have a long history of sandvine boxes in passive mode until they finally realized they were too expensive and ditched them?
rammy1234 7y ago
how will this enhance common man's life is something they need to expose to the public , don't they need to let everyone know?
NelsonMinar 7y ago
If Comcast doesn't want it then it must be a good thing for consumers.
js2 7y ago
Direct link to slide deck: https://assets.documentcloud.org/documents/6509454/ISP-DoH-Lobbying-Slide-Deck.pdf https://assets.documentcloud.org/documents/6509454/ISP-DoH-L...
ga-vu 7y ago
And this is a problem why? DoH is garbage and Mozilla's implementation is just a cashgrab with Cloudflare. Adopt DoT+DNSSEC instead.
- arpa 7y ago
  A million times yes. DoH is powergrab crap and needs to die.
steve19 7y ago
Does anyone know how DoH works in browsers when connected to a new WiFi network with a captive portals?
ijiiijji1 7y ago
Xfinity (Comcast) experience has been 2-10 modem resets per day and the VOIP landline would randomly not let the calling party hear you. To me, Comcast is invasive and trying to monetize everything not nailed down just like FANAG. Encrypt your DNS, get your own Wifi AP and use a VPN.
kodablah 7y ago
From the summary[0]: > If activated, this feature would by default route all DNS traffic from Chrome and Android users to Google Public DNS, thus centralizing a majority of worldwide DNS data with Google I can't decide if Comcast is just ignorant since Chrome's plans are to NOT do this, or if they are outright lying about what Chrome's plans are. As I mentioned the other day, this is the problem with not separating the DoH protocol discussion from the DoH browser-provided default resolver. Good job Mozilla, now we can't have a debate about the merits of DoH the protocol because y'all have muddied it with default resolver choice. [0] https://assets.documentcloud.org/documents/6509454/ISP-DoH-Lobbying-Slide-Deck.pdf https://assets.documentcloud.org/documents/6509454/ISP-DoH-L... (PDF)
Darth_Hobo 7y ago
At first I was excited about DOH, until I realized that you are simply switching data collection from ISP to whomever you choose as your trusted resolve in DOH (most likely Google or Cloudflare). So ideally we need another machine that does DOH requests and then sends you the results, but at this point you might as well setup a full VPN. DOH might be a good alternative in places like China, because Cloudflare knowing about your browsing history is a lot less dangerous than Chinese goverment knowing about it. Unless DOH providers will sell that data to China. Which they probably will.
- wp381640 7y ago
  You can still use DoH with your ISP - it's about finally encrypting DNS requests in transit The reason why ISPs are afraid is because they know that given the choice most people wouldn't opt for ISP hosted DNS since they have a history of being abusive
  - wahern 7y ago
    Most people won't care. The coming battles are about defaults. Mozilla's motives may be pure, but with a key press they're poised to funnel the DNS requests of hundreds of millions of users to a single entity. That's power anyway you look at it.
apeace 7y ago
Which is exactly why government should have nothing to do with internet standards.
raxxorrax 7y ago
That probably just means they take advantage of DNS data of their users and that DNS encryption is a very good idea.
foxfired 7y ago
I may be the last person to join the party, but I do not understand how Dns over HTTPS hides me from my ISP. From my understanding to fetch a url, my make a request to the dns server. If I do it unencrypted, the isp sees the request in plain text. They know where I am going. But when I do it over DoH, I send an encrypted DNS request to a service, of my choosing, that gives me the ip address of my destination. (is this correct?) Now, in order to reach that destination ip address, don't I have to use the ISP? Aren't they the ones routing me my request to the destination? Even if it is under HTTPS, the destination has to be known, right? I'm sure I am missing a piece of the puzzle, but where exactly I don't know.
- zeta0134 7y ago
  With DNS over HTTPS, the ISP would have the ability to see the IP address you are connecting to, yes, but critically they would not have the ability to see the domain name that you had visited unless your browser is also doing SNI. Which it probably is, so from a privacy standpoint, not much changes. What does change is the ISP's inability to tamper with the DNS response. Many, many ISPs will refuse to actually send a DNS not found for certain record types, instead serving up their own custom search pages with advertisements and other garbage. It also prevents certain classes of MitM that involve intercepting plain-text DNS and re-routing that request to a different server by responding with an attacker-controlled value. So, from a privacy standpoint, DNS over HTTPS by itself isn't buying you all that much (since SNI leaks the same information during the SSL handshake to your target) but in terms of making your access to the DNS infrastructure much harder to tamper with, it does a whole bunch. EDIT: ooohhh, ESNI is a thing? This seems interesting to keep an eye on: https://blog.cloudflare.com/esni/ https://blog.cloudflare.com/esni/
  - judge2020 7y ago
    eSNI is still in the draft stages, which is why Chrome has opted not to implement the draft until the standard is finalized or in a state it deems satisfactory[0]. Currently FF and CF implement draft. There are also many hurdles Google has to consider when rolling out things like this that will break Enterprise deployments. Currently, DoH is completely inaccessible if the browser is "managed" (has Policies) at all, even if the disable DoH policy isn't set. I imagine the same will happen with eSNI. 0: https://crbug.com/908132#c7 https://crbug.com/908132#c7
ravenstine 7y ago
Did everyone forget that it was Comcast that was injecting JavaScript into unencrypted HTTP responses? I wish I had time to dig out that HN thread. It only makes sense given Comcast's lack of ethos that they would be against encrypted DNS.
- proverbialbunny 7y ago
  I worked on that code. Sorry. Originally it was a dutch isp that wanted the feature. They wanted a pop up that would ask the customer if they would like to buy more gigabytes when the costumer began running low on data. There was a large back and forth. The general thought process at the time was, "If technology can be used a certain way, it will be used that way." So, we went back and forth over hypothetical situations of how an ISP or business could use javascript injection. Like, "Could an ISP use this to steal personal data?" Ultimately, browsers were beginning to default to tls at the time, so it seemed like it would be a short lived feature.
dreamcompiler 7y ago
The fundamental law of pipe companies: Every pipe company hates being a pipe company.
alzaeem 7y ago
Just so I understand, why does an ISP care so much about providing the DNS resolution? Anyway once you have a destination IP address, that'll be visible to your ISP from your packets, and a simple reverse DNS can tell them what these IPs are for. Or am I missing something? That's also why I'm not so bullish on the benefits from DNS encryption, though it's a step in the right direction.
xedrac 7y ago
Doesn't DNS encryption effectively break ad blocking software?

502 points by president 7y ago

How can you lobby against a browser feature? It's not like Google or Mozilla were trying to write a new law. Are there laws that browsers MUST adhere to? Because I'm pretty sure I can create a web browser that behaves in any way that I see fit.

kevingadd 7y ago
If web browsers want to allow playing content from DRM'd services like Netflix, they get tangled up in a bundle of regulations like the DMCA and have to use specific services like this: https://en.wikipedia.org/wiki/Widevine https://en.wikipedia.org/wiki/Widevine At a lower level, formats like H264 are basically part of the web platform too, so you end up implementing them and that exposes you to software patent laws. So, in practice: Yes, there are laws browsers must adhere to. If you're willing to strip a bunch of features out of your browser and you live in a country with a less awful legal climate, maybe not too many laws. For a while the US banned export of encryption if you aren't familiar with that - it impacted stuff like web browsers and resulted in people using 56-bit (!) encryption keys for things.
- Darth_Hobo 7y ago
  In practice you can host your browser redistributable on non-US server that has no obligation to US laws. And if US user chooses to download from that location there is nothing they can do about it.
tptacek 7y ago
There were literally just House hearings about the impact of DoH on law enforcement investigations. You lobby against it by trying to get a law passed to ban it.
- schoen 7y ago
  Are you sure you're not thinking of hearings about some other aspect of encryption? I've been working on the DoH issue, including writing to Congress about it, and I don't recall a hearing having happened yet.
  - tedunangst 7y ago
    Possibly meant the investigation letter. https://www.wsj.com/articles/google-draws-house-antitrust-scrutiny-of-internet-protocol-11569765637 https://www.wsj.com/articles/google-draws-house-antitrust-sc...
  - tptacek 7y ago
    I’m sure. I’ll dig up a link; you can watch it.
    - schoen 7y ago
      Please!
      - tptacek 7y ago
        https://youtu.be/FBF1n6Q5vvY?t=6144 https://youtu.be/FBF1n6Q5vvY?t=6144

jedisct1 7y ago

And at the same time, they deployed a DoH server: https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v2/public-resolvers.md#xfinity https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v...

magashna 7y ago
No mention of whether it is logging or not. I think I can safely assume they are logging everything.
- cremp 7y ago
  Which is just gravy, because the whole DoH crowd is against ISP monitoring and selling it. Goes to show that the only thing Doh/DoT/et al. did was to make things more complicated and harder to work with.

ivankolev 7y ago

That instantly makes me feel dns encryption is something worth exploring in depth...

flatiron 7y ago
I do DoH with pi hole and cloudflare (followed arch wiki for all of that) but I think it’s silly. You don’t know what I’m resolving but you still know what ips I’m visiting and can just look up their host names. What does it really do?
- fweespeech 7y ago
  You can have multiple hostnames per IP. (i.e. If you are using a site that uses cloudflare) That fact will make it very difficult to resolve hostname to ip address for anyone behind a CDN. That is the reason Comcast is fighting it.
  - flatiron 7y ago
    Makes sense. Thanks. Then I’m glad I’m using it! I fell into the arch wiki black hole and an hour later had pi hole, DoH and OpenVPN all configured so all my devices including my iPhone go through my home internet and the pi hole. Pretty neat. No ads while mobile. I did have to do tcp on 443 since udp and t mobile did not play nice together. I was too lazy to debug that though.
- giggles_giggles 7y ago
  I thought DoH would defeat the pihole. Is this incorrect?
  - flatiron 7y ago
    Check out the pi hole arch wiki. Tells you how to use DoH with cloudflare. Takes 2 minutes.
- sliken 7y ago
  A fair chunk of internet content is hosted in the cloud. So while comcast knows exactly what IPs you are talking to they can't tell much else. This prevents them from tracking your habits, selling that data, and creating or marketing competition. It also makes it harder to crippling the network for some specific competitor like youtube or netflix. How else is Comcast going to hold it's users hostage so netflix has to pay extra to get the bits the customers paid to get?

koolba 7y ago

How hard would it be for them to instead reverse lookup the outbound socket IP addresses to determine the servers to which you are connecting? Assuming they have some people performing the same DNS lookups from similar locations I bet they could construct a good enough mapping. It’d probably be even more accurate if there’s DNS caching client side as it’d count actual connections and not just lookups.

GhettoMaestro 7y ago
Your method wouldn't work too well as multiple websites will be multiplexed behind a single IP address via a method known as "named-based virtual hosting". It exists even with TLS, as SNI (Server Name Indication) was added to serve this purpose. However, in the future, TLS will most likely mandate that SNI be encrypted and not visible to a passive attacker (it is currently in IETF draft status, as someone pointed out below).
- anfilt 7y ago
  Its still just a draft last I checked. https://tools.ietf.org/html/draft-ietf-tls-esni-04 https://tools.ietf.org/html/draft-ietf-tls-esni-04 Where as tls 1.3 is a RFC. https://tools.ietf.org/html/rfc8446 https://tools.ietf.org/html/rfc8446
JMTQp8lwXL 7y ago
One IP address could have multiple hostnames pointing to it. DNS permits this. I could register my own domain name, right now, and point it to what `dig facebook.com`'s IP address is.
- vanadium 7y ago
  Pretty much the default position for everyday shared hosting environments, unless a static IP is explicitly requested by a customer.
jcampbell1 7y ago
My thought is that with SNI (Server Name Identification), the domain is transmitted in plaintext as is. Encrypted SNI is a long way off unless everyone starts letting a 3rd party like Cloudflare manage everything. To cut Comcast out of the loop requires the OS/Browsers to switch away from Comcast's DNS, and a huge amount of the web terminating at generic Cloudflare IPs with Encrypted SNI.

mrlala 7y ago

I still can't wrap my head around DNS encryption; can someone explain it or link me to an article/video? I seem to remember reading that for this to work, you would have to trust someone like google, but then wouldn't you essentially have to proxy all of your data through google or some dns encryption source.. i.e., almost making it a VPN? Surely I am missing something- I just don't see how you can hide traffic from your ISP without a proxy in the middle..

heavyset_go 7y ago
DNS isn't encrypted. Anyone passing your DNS queries between you and your DNS provider can inspect them. DoH or DoT would allow your upstream DNS provider to see your queries, but anyone passing them around wouldn't see the content of the queries. Comcast won't be able to read those queries if they're encrypted via DoH, and part of their business model involves spying on their customers' queries and selling the data. DoH has nothing to do with proxying.
- mrlala 7y ago
  Thank you, however I still don't understand how it works from what you said. What is an "upstream DNS provider" in this context? I'm just not seeing how Comcast can't still know where you going, since obviously you are routing your traffic through them and they see the IP address; how is the IP not giving them enough information to figure out where you are going? Is encrypted DNS only going to work for a handful of sites running in some special way, or is this supposed to work for everything?
  - heavyset_go 7y ago
    > What is an "upstream DNS provider" in this context? This would be your DoH provider. You can have layers of caching and DNS servers on your machine and network, but DNS queries ultimately have to go a foreign DNS provider. > I'm just not seeing how Comcast can't still know where you going If your connections aren't encrypted, or you only access servers with static IP addresses, then Comcast will be able to know where you're going. Modern web applications have many layers of indirection, and you can't always correlate accessed IP addresses with the service the user is using. As an example, consider a site that uses HTTPS and is proxied with Cloudflare. To Comcast, you're sending encrypted bytes to an IP address that doesn't identify the site, it's just Cloudflare. With unencrypted DNS, Comcast can just look at your DNS queries and determine the sites you're visiting. With encrypted DNS, Comcast sees that you connected to your DNS provider and Cloudflare, which isn't exactly valuable.

gormandizer 7y ago

Encrypted DNS is great. My only problem (as a linux user) is that I want all DNS lookups on my machine to be performed by querying the servers listed in "/etc/resolve.conf". DoH as implemented by Firefox and Chrome breaks that.

LogicX 7y ago
You should look into DoT instead
- gormandizer 7y ago
  I've been doing DNS over TLS with pfSense for over a year now. The problem as I understand it is that Firefox and Chrome will soon default to DoH. Now I have to remember to go in and change default app settings. Ok not a huge deal with just two apps but yet something else I shouldn't have to do.
  - growse 7y ago
    Just set your network resolver to return NXDOMAIN for the canary domain use-application-dns.net. (https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...) That will signal to firefox (at least) to disable DoH and use the system resolver.
- tptacek 7y ago
  How exactly does DoT make any of this any better? Conceptually, your local system resolver can use DoH just as easily as DoT. The primary difference between the two protocols, from a pragmatic perspective, is that DoT can be blocked by ISPs and network providers, and DoH is harder to block.
zrm 7y ago
There is a solution for that -- install a local resolver that makes queries using DoT/DoH/DNSCurve/DNS-over-WireGuard/whatever but answers them using ordinary UDP DNS, then make that your DNS server in /etc/resolv.conf.

pmlnr 7y ago

Pitiful people Comcast, shame on you. This information never should have been sold.

sliken 7y ago
Just imagine if Comcast loses the ability to hold content providers hostage. With DOH it's much harder to tell that most of your customers are streaming from Netflix, so it's much harder to artificially degrade their network connections so you can ask Netflix to pay extra.
- zzzcpan 7y ago
  Beefy cache nodes of any company, not just Netflix, are trivially identifiable.
  - sliken 7y ago
    But if you have a list of 1000 beefy cache nodes who do you send the ransom letters to? How about if each beefy cache node has 1000 IPs instead of 1? What if each client was sticky, so if Comcast buys a Netflix account they only end up on one beefy cache node? Hell if pushed hard enough maybe netflix would enable p2p (encrypted with DRM of course) for content delivery. I'd happily hook up a 1TB usb to my roku if it improved the playback experience. Of course DoT is not perfect, but it does seem like it would help, so much so that Comcast is lobbying against it.

meed 7y ago

Is there anything that this company does that ain't suck?!

peterwwillis 7y ago

DNS encryption is going to be one of the big boondoggles of the 21st century internet. I am currently going through a project at work to certify all the applications which need a custom root CA cert added to them, for their traffic to be inspected. This is part of GDPR certification. This is not some nefarious project to spy on employees, or even a DLP initiative. To comply with GDPR, we have to know where PII comes and goes, and over 80% of that data goes over HTTPS. That means that for any company to be able to comply with GDPR, they have to inspect all HTTPS traffic. Now, could TLS clients provide a mechanism to export all decrypted traffic, separate from the validation path? Sure. But that's not a part of the TLS spec, so to my knowledge, TLS libraries just don't have that option, and all the applications I know of certainly don't expose it. So even though to provide for the above requirements, all we need is a read-only tap of the decrypted content, it wasn't required (or possibly even considered), so now we need read-write access to all content, which is in no way what the requirements were intended for. That's bad, but what's worse is this process is introducing dozens of bugs. In many cases, the proprietary content filters are actually failing to validate correctly, and proxying payloads from hosts with invalid certs to unsuspecting clients. Not only do we have to MITM everything, but we're making security worse, and breaking apps. Take all of these considerations, and now instead of it being HTTP content, it's DNS. From an internet privacy perspective, there are only so many hostnames and IPs on the internet. Regardless of how you encrypt it, if you can observe hundreds of millions of individual users' traffic, it will be trivial to discover what DNS records a connection is requesting by statistical analysis. I agree with making the data integrity immutable, but that doesn't mean we have to force it all to also be private, not to mention breaking the distributed, decentralized design that made DNS resilient to begin with.

outworlder 7y ago
> To comply with GDPR, we have to know where PII comes and goes, and over 80% of that data goes over HTTPS. That means that for any company to be able to comply with GDPR, they have to inspect all HTTPS traffic. Fine. A company can inspect their own traffic. This doesn't mean that _other_ companies should have the same ability, including upstream providers. > Not only do we have to MITM everything, but we're making security worse, and breaking apps. Sounds like what most of the "security compliance" certifications actually do.

jrockway 7y ago

ISPs are dying to find some sort of "value add" to get more revenue, but it's just not there. ISPs need to realize that they are strictly a utility now. All the value that they could possibly add can be obtained from any other company now. They used to provide TV service, but nobody wants linear TV and can just send their money directly to the company that produces the TV content and have it delivered over IP. They used to provide phone service, but nobody wants phone service; they have a cell phone and can get a fake landline from any number of companies for almost no money. They used to provide a DNS resolver, but they used the DNS resolver to inject fake addresses, so the power has been moved away from them. They used to provide Usenet, but their "content partners" didn't like that, so now you get Usenet from a third-party provider. IP is just too versatile. All customers want from their ISP is the dumbest possible pipe, because they can get all other services over that pipe and pick the best deals. If you aren't interested in infrastructure, then you shouldn't be an ISP. (That said, I don't see why companies like Comcast aren't pursuing things like becoming Cloudflare or AWS. "Click here to host your docker container 1ms away from 87% of the US population," seems like a service that could make a lot of money.)

snagglegaggle 7y ago
Unless something drastic happens ISPs are going to win. They're increasingly charging per bit for wire data (where there is no inherent scarcity), lobbying to prevent competitors, and have taken public funds and failed to reinvest in their infrastructure.
- andrei_says_ 7y ago
  Lobbying and changing laws to apply reality distortion fields on all their customers and the competition is cheaper than investing into R&D or infrastructure and provide a better service or innovate and compete. If it’s true for ISPs, it’s true for other big players and is a symptom of a failing system.
- hombre_fatal 7y ago
  Well, there definitely is bandwidth scarcity. Also, unmetered bandwidth is just one major reason botnets are so trivial. Nobody knows or even has incentive to know that their smart toaster is involved in DDoS attacks so now we're all centralizing behind Cloudflare to mitigate this reality. Now, I'd like to see a fair price per bit, but I'm not convinced the world is better without it.

virtuallynathan 7y ago

This isn’t exactly true... Comcast just launched their own DoH endpoint. I also used to work very closely with the DNS team at Comcast. At the time, they did not sell or even log/look at DNS data. It was sampled in aggregate to break down CDN traffic in Netflow data.

kevin_thibedeau 7y ago
Comcast's masters likely have the same arrangement that AT&T does. Everything passes through a closet the rank and file know nothing about.
- virtuallynathan 7y ago
  That's a totally different and unrelated assertion. If the Gov't wants that traffic, they can just go to a Level3 fiber regeneration site in the middle of nowhere and tap the fiber traffic of hundreds of companies.
wbl 7y ago
Doesn't the ASN tell you that?
- virtuallynathan 7y ago
  The ASN will only tell you the traffic is from Akamai, not that it was for apple.akamai.com or steampowered.akamai.com, etc.
kitteh 7y ago
Didn't Comcast have a long history of sandvine boxes in passive mode until they finally realized they were too expensive and ditched them?

rammy1234 7y ago

how will this enhance common man's life is something they need to expose to the public , don't they need to let everyone know?

NelsonMinar 7y ago

If Comcast doesn't want it then it must be a good thing for consumers.

js2 7y ago

Direct link to slide deck: https://assets.documentcloud.org/documents/6509454/ISP-DoH-Lobbying-Slide-Deck.pdf https://assets.documentcloud.org/documents/6509454/ISP-DoH-L...

ga-vu 7y ago

And this is a problem why? DoH is garbage and Mozilla's implementation is just a cashgrab with Cloudflare. Adopt DoT+DNSSEC instead.

arpa 7y ago
A million times yes. DoH is powergrab crap and needs to die.

steve19 7y ago

Does anyone know how DoH works in browsers when connected to a new WiFi network with a captive portals?

ijiiijji1 7y ago

Xfinity (Comcast) experience has been 2-10 modem resets per day and the VOIP landline would randomly not let the calling party hear you. To me, Comcast is invasive and trying to monetize everything not nailed down just like FANAG. Encrypt your DNS, get your own Wifi AP and use a VPN.

kodablah 7y ago

From the summary[0]: > If activated, this feature would by default route all DNS traffic from Chrome and Android users to Google Public DNS, thus centralizing a majority of worldwide DNS data with Google I can't decide if Comcast is just ignorant since Chrome's plans are to NOT do this, or if they are outright lying about what Chrome's plans are. As I mentioned the other day, this is the problem with not separating the DoH protocol discussion from the DoH browser-provided default resolver. Good job Mozilla, now we can't have a debate about the merits of DoH the protocol because y'all have muddied it with default resolver choice. [0] https://assets.documentcloud.org/documents/6509454/ISP-DoH-Lobbying-Slide-Deck.pdf https://assets.documentcloud.org/documents/6509454/ISP-DoH-L... (PDF)

Darth_Hobo 7y ago

At first I was excited about DOH, until I realized that you are simply switching data collection from ISP to whomever you choose as your trusted resolve in DOH (most likely Google or Cloudflare). So ideally we need another machine that does DOH requests and then sends you the results, but at this point you might as well setup a full VPN. DOH might be a good alternative in places like China, because Cloudflare knowing about your browsing history is a lot less dangerous than Chinese goverment knowing about it. Unless DOH providers will sell that data to China. Which they probably will.

wp381640 7y ago
You can still use DoH with your ISP - it's about finally encrypting DNS requests in transit The reason why ISPs are afraid is because they know that given the choice most people wouldn't opt for ISP hosted DNS since they have a history of being abusive
- wahern 7y ago
  Most people won't care. The coming battles are about defaults. Mozilla's motives may be pure, but with a key press they're poised to funnel the DNS requests of hundreds of millions of users to a single entity. That's power anyway you look at it.

apeace 7y ago

Which is exactly why government should have nothing to do with internet standards.

raxxorrax 7y ago

That probably just means they take advantage of DNS data of their users and that DNS encryption is a very good idea.

foxfired 7y ago

I may be the last person to join the party, but I do not understand how Dns over HTTPS hides me from my ISP. From my understanding to fetch a url, my make a request to the dns server. If I do it unencrypted, the isp sees the request in plain text. They know where I am going. But when I do it over DoH, I send an encrypted DNS request to a service, of my choosing, that gives me the ip address of my destination. (is this correct?) Now, in order to reach that destination ip address, don't I have to use the ISP? Aren't they the ones routing me my request to the destination? Even if it is under HTTPS, the destination has to be known, right? I'm sure I am missing a piece of the puzzle, but where exactly I don't know.

zeta0134 7y ago
With DNS over HTTPS, the ISP would have the ability to see the IP address you are connecting to, yes, but critically they would not have the ability to see the domain name that you had visited unless your browser is also doing SNI. Which it probably is, so from a privacy standpoint, not much changes. What does change is the ISP's inability to tamper with the DNS response. Many, many ISPs will refuse to actually send a DNS not found for certain record types, instead serving up their own custom search pages with advertisements and other garbage. It also prevents certain classes of MitM that involve intercepting plain-text DNS and re-routing that request to a different server by responding with an attacker-controlled value. So, from a privacy standpoint, DNS over HTTPS by itself isn't buying you all that much (since SNI leaks the same information during the SSL handshake to your target) but in terms of making your access to the DNS infrastructure much harder to tamper with, it does a whole bunch. EDIT: ooohhh, ESNI is a thing? This seems interesting to keep an eye on: https://blog.cloudflare.com/esni/ https://blog.cloudflare.com/esni/
- judge2020 7y ago
  eSNI is still in the draft stages, which is why Chrome has opted not to implement the draft until the standard is finalized or in a state it deems satisfactory[0]. Currently FF and CF implement draft. There are also many hurdles Google has to consider when rolling out things like this that will break Enterprise deployments. Currently, DoH is completely inaccessible if the browser is "managed" (has Policies) at all, even if the disable DoH policy isn't set. I imagine the same will happen with eSNI. 0: https://crbug.com/908132#c7 https://crbug.com/908132#c7

ravenstine 7y ago

Did everyone forget that it was Comcast that was injecting JavaScript into unencrypted HTTP responses? I wish I had time to dig out that HN thread. It only makes sense given Comcast's lack of ethos that they would be against encrypted DNS.

proverbialbunny 7y ago
I worked on that code. Sorry. Originally it was a dutch isp that wanted the feature. They wanted a pop up that would ask the customer if they would like to buy more gigabytes when the costumer began running low on data. There was a large back and forth. The general thought process at the time was, "If technology can be used a certain way, it will be used that way." So, we went back and forth over hypothetical situations of how an ISP or business could use javascript injection. Like, "Could an ISP use this to steal personal data?" Ultimately, browsers were beginning to default to tls at the time, so it seemed like it would be a short lived feature.

dreamcompiler 7y ago

The fundamental law of pipe companies: Every pipe company hates being a pipe company.

alzaeem 7y ago

Just so I understand, why does an ISP care so much about providing the DNS resolution? Anyway once you have a destination IP address, that'll be visible to your ISP from your packets, and a simple reverse DNS can tell them what these IPs are for. Or am I missing something? That's also why I'm not so bullish on the benefits from DNS encryption, though it's a step in the right direction.

xedrac 7y ago

Doesn't DNS encryption effectively break ad blocking software?