5 ms·
> Why are DNS records set with such low TTLs? The author seem to be missing one of the big reasons ridiculously low TTLs are used: it lets passive eavesdropper
by pdkl95 7y ago
> Why are DNS records set with such low TTLs?
The author seem to be missing one of the big reasons ridiculously low TTLs are used: it lets passive eavesdroppers discover a good approximation of your browsing history. Passive logging of HTTP has (fortunately) been hindered as most traffic moved to HTTPS, but DNS is still plaintext.
Low TTLs mean a new DNS request happens (apx) every time someone clicks a link. Seeing which domain names someone is interacting with every 60s (or less!) is enough to build a very detailed pattern-of-life[1]. Remember, it's probably not just one domain name per click; the set of domain names that are requested to fetch the js/css/images/etc for each page can easily fingerprint specific activities within a domain.
Yes, TTLs need to have some kind of saner minimum. Even more important is moving to an encrypted protocol. Unfortunately DOH doesn't solve this problem[2]; it just moves the passive eavesdropping problem to a different upstream server (e.g. Cloudflare). The real solution is an encrypted protocol that allows everyone to do the recursive resolution locally[3].
[1] https://en.wikipedia.org/wiki/Pattern-of-life_analysis https://en.wikipedia.org/wiki/Pattern-of-life_analysis
[2] https://news.ycombinator.com/item?id=21110296 https://news.ycombinator.com/item?id=21110296
[3] https://news.ycombinator.com/item?id=21348328 https://news.ycombinator.com/item?id=21348328
- rgbrenner 7y agoHTTPS does not hinder that type of tracking.. in fact, using SNI (which is unencrypted) would be more accurate than trying to do it with DNS... since it's sent with every request.
- mike_d 7y ago> The author seem to be missing one of the big reasons ridiculously low TTLs are used: it lets passive eavesdroppers discover a good approximation of your browsing history. I operate DNS for hundreds of thousands of domains. I've tried to reassemble browsing history from DNS logs, and I can tell you it is damn near impossible. You have DNS caches in the browser, the OS, broadband routers, and ISPs/public resolvers to account for - and half of them don't respect TTLs anyways. The reason people set low TTLs is they don't want to wait around for things to expire when they want to make a change. DNS operators encourage low TTLs because it appears broken to the user when they make a change and "it doesn't work" for anywhere from a few hours to a few days.
- brazzledazzle 7y agoThe problem is that your ISP can log and mine your DNS requests, regardless of the servers you use. They definitely do this and one can only assume they then sell it after some sort of processing.
- tyre 7y agoThe comment you're replying specifies caching at the browser, OS, and router level. Not one of three would show up as DNS refreshes with the ISP because the DNS is not being refreshed.
- ses1984 7y agoDon't browsers and operating systems mostly respect ttls? So if some things are cached, you won't get a complete picture, but the picture you get might be enough.
- spc476 7y agoI can't tell. I run Firefox at home, and set up my own DoH server (mainly because I saw the writing on the wall and and if Mozilla/Google are going to shove this down my throat, I want it shoved down on my terms, but I digress). If I visit my blog (which has a DNS TTL of 86,400) I get a query for my domain not only on every request, but even if I just hover over the link. It will also do a query when I click on a link to news.ycombinator.com (with a TTL of 300) but not when I hover over a link. It's bizarre.
- deleted 7y ago[deleted]
- mike_hock 7y agoI'm sure the destination IP:443 tells about as accurate a story as the DNS lookups?
- 33C57E63 7y agoParticularly with SNI.