6 ms·

American ISPs can and do sell your data legally. I don't really trust my ISP (I run my own DNS server at home and tunnel its requests over to a cloud VM), but I

American ISPs can and do sell your data legally. I don't really trust my ISP (I run my own DNS server at home and tunnel its requests over to a cloud VM), but I trust Cloudflare even less.

nullc 7y ago
"Legally" is dubious. Intercepting any private wire communication is a clear violation of federal law (e.g. 18 U.S. Code § 2511), and a violation of the law in many states (e.g. CA PC 631). Unfortunately, the US government is one of the larger users of ISP surveillance activities, benefiting through the purchase of private data as well as using administrative subpoena to obtain the data collected by ISPs without due process or meaningful oversight. This creates a conflict of interest which I believe is preventing the US from zealously enforcing existing criminal law which would be otherwise sufficient to significantly reduce surveillance by communications providers.
- djsumdog 7y ago
  Are you sure about that? This passed in 2017 and I don't think it's been reversed: http://clerk.house.gov/evs/2017/roll202.xml http://clerk.house.gov/evs/2017/roll202.xml
  - nullc 7y ago
    Hm. FCC getting a ruling overturned that strengthens the law doesn't change the existing law, however.
  - saagarjha 7y ago
    Wow, that's one polarized vote…
syshum 7y ago
I dont use my ISP as my DNS provider, I have a custom setup using PiHole and other methods to provide secure DNS Resolution Firefox should not be forcing this shit on me, time to search for yet another browser that will respect users. Mozilla is clearly more interested in commercial viability via their partnerships with large corporations (like CloudFlare) then in protecting Users
- zamalek 7y ago
  The only way to solve the ISP DNS inspection problem is by one of: * Using DoH. For this to work with PiHole, you need to have a DoH resolver on the device, and then instruct the PiHole to recurse to that resolver instead - possibly your own in a VM somewhere? * Using a permanent encrypted VPN to your own machine in the cloud and routing all DNS through that, then recursing to some DNS that you trust. * Write your own encrypted protocol that communicates with some machine in the cloud. Anything else and your ISP/evil-state-actor is able to to see your DNS traffic in plain-text. PiHole and DoH approach the problem at different OSI layers, you ideally need both.
  - alwillis 7y ago
    DNS over TSL (DoT) is a much better alternative to DoH, at least when it comes to the ability to be tracked. For example, because it’s not using HTTP, there are no cookies or SNI to worry about. More at https://news.ycombinator.com/item?id=22418005 https://news.ycombinator.com/item?id=22418005.
    - growse 7y ago
      > DNS over TSL (DoT) is a much better alternative to DoH, at least when it comes to the ability to be tracked. > For example, because it’s not using HTTP, there are no cookies or SNI to worry about. > More at https://news.ycombinator.com/item?id=22418005 https://news.ycombinator.com/item?id=22418005. The fact that it can be trivially blocked by anyone on the network path does not make it "much better".
      - alwillis 7y ago
        The fact that it can be trivially blocked by anyone on the network path does not make it "much better". Of course anyone on the "network path" can block almost any protocol; DoT isn’t unique in that regard. The concern is many large businesses block port 853 but that's because prior to the development of DoT, there was no reason for IT departments to configure firewalls to enable it. Most organizations only have a handful of ports available, including 443, which is what HTTPS uses and therefore DoH works as a result. I've been running DNS over TLS using the Unbound [1] resolver for my home LAN on a spare laptop for a few weeks now and it’s been great. Given the privacy trade-offs between privacy and security, many IT departments would opt to make port 853 available for DoT rather than increasing the ability for their users to be tracked. As I mentioned elsewhere in this thread, the article Centralised DoH is bad for Privacy, in 2019 and beyond [2] clearly describes the issues with DoH: DNS over HTTPS opens up DNS to all the tracking possibilities present in HTTPS and TLS. As it stands, DNS over UDP almost always gets some free privacy by mixing all devices on a network together – an outside snooper sees a stream of queries coming from a household, a coffeeshop or even an entire office building, with no way to tie a query to any specific device or user. Such mixing of queries provides an imperfect but useful modicum of privacy. DNS over HTTPS however neatly separates out each device (and even each individual application on that device) to a separate query stream. This alone is worrying, as we now have individual users’ queries, but the TLS that underlies HTTPS also typically uses TLS Resumption which offers even further tracking capabilities. [1]: https://www.ctrl.blog/entry/unbound-tls-forwarding.html https://www.ctrl.blog/entry/unbound-tls-forwarding.html [2]: https://labs.ripe.net/Members/bert_hubert/centralised-doh-is-bad-for-privacy-in-2019-and-beyond https://labs.ripe.net/Members/bert_hubert/centralised-doh-is...
9HZZRfNlpR 7y ago
I trust my ISP but not American companies. They roll out only in America but obviously it's coming, and they use locale to detect it? My locale is set to en_US too, surely I'm not alone doing it because of translated software. Firefox has a small market in America anyway and America is not the world. We know big tech is in bed with your three letter agencies.

American ISPs can and do sell your data legally. I don't really trust my ISP (I run my own DNS server at home and tunnel its requests over to a cloud VM), but I trust Cloudflare even less.

nullc 7y ago

"Legally" is dubious. Intercepting any private wire communication is a clear violation of federal law (e.g. 18 U.S. Code § 2511), and a violation of the law in many states (e.g. CA PC 631). Unfortunately, the US government is one of the larger users of ISP surveillance activities, benefiting through the purchase of private data as well as using administrative subpoena to obtain the data collected by ISPs without due process or meaningful oversight. This creates a conflict of interest which I believe is preventing the US from zealously enforcing existing criminal law which would be otherwise sufficient to significantly reduce surveillance by communications providers.

djsumdog 7y ago
Are you sure about that? This passed in 2017 and I don't think it's been reversed: http://clerk.house.gov/evs/2017/roll202.xml http://clerk.house.gov/evs/2017/roll202.xml
- nullc 7y ago
  Hm. FCC getting a ruling overturned that strengthens the law doesn't change the existing law, however.
- saagarjha 7y ago
  Wow, that's one polarized vote…

syshum 7y ago

I dont use my ISP as my DNS provider, I have a custom setup using PiHole and other methods to provide secure DNS Resolution Firefox should not be forcing this shit on me, time to search for yet another browser that will respect users. Mozilla is clearly more interested in commercial viability via their partnerships with large corporations (like CloudFlare) then in protecting Users

zamalek 7y ago
The only way to solve the ISP DNS inspection problem is by one of: * Using DoH. For this to work with PiHole, you need to have a DoH resolver on the device, and then instruct the PiHole to recurse to that resolver instead - possibly your own in a VM somewhere? * Using a permanent encrypted VPN to your own machine in the cloud and routing all DNS through that, then recursing to some DNS that you trust. * Write your own encrypted protocol that communicates with some machine in the cloud. Anything else and your ISP/evil-state-actor is able to to see your DNS traffic in plain-text. PiHole and DoH approach the problem at different OSI layers, you ideally need both.
- alwillis 7y ago
  DNS over TSL (DoT) is a much better alternative to DoH, at least when it comes to the ability to be tracked. For example, because it’s not using HTTP, there are no cookies or SNI to worry about. More at https://news.ycombinator.com/item?id=22418005 https://news.ycombinator.com/item?id=22418005.
  - growse 7y ago
    > DNS over TSL (DoT) is a much better alternative to DoH, at least when it comes to the ability to be tracked. > For example, because it’s not using HTTP, there are no cookies or SNI to worry about. > More at https://news.ycombinator.com/item?id=22418005 https://news.ycombinator.com/item?id=22418005. The fact that it can be trivially blocked by anyone on the network path does not make it "much better".
    - alwillis 7y ago
      The fact that it can be trivially blocked by anyone on the network path does not make it "much better". Of course anyone on the "network path" can block almost any protocol; DoT isn’t unique in that regard. The concern is many large businesses block port 853 but that's because prior to the development of DoT, there was no reason for IT departments to configure firewalls to enable it. Most organizations only have a handful of ports available, including 443, which is what HTTPS uses and therefore DoH works as a result. I've been running DNS over TLS using the Unbound [1] resolver for my home LAN on a spare laptop for a few weeks now and it’s been great. Given the privacy trade-offs between privacy and security, many IT departments would opt to make port 853 available for DoT rather than increasing the ability for their users to be tracked. As I mentioned elsewhere in this thread, the article Centralised DoH is bad for Privacy, in 2019 and beyond [2] clearly describes the issues with DoH: DNS over HTTPS opens up DNS to all the tracking possibilities present in HTTPS and TLS. As it stands, DNS over UDP almost always gets some free privacy by mixing all devices on a network together – an outside snooper sees a stream of queries coming from a household, a coffeeshop or even an entire office building, with no way to tie a query to any specific device or user. Such mixing of queries provides an imperfect but useful modicum of privacy. DNS over HTTPS however neatly separates out each device (and even each individual application on that device) to a separate query stream. This alone is worrying, as we now have individual users’ queries, but the TLS that underlies HTTPS also typically uses TLS Resumption which offers even further tracking capabilities. [1]: https://www.ctrl.blog/entry/unbound-tls-forwarding.html https://www.ctrl.blog/entry/unbound-tls-forwarding.html [2]: https://labs.ripe.net/Members/bert_hubert/centralised-doh-is-bad-for-privacy-in-2019-and-beyond https://labs.ripe.net/Members/bert_hubert/centralised-doh-is...

9HZZRfNlpR 7y ago

I trust my ISP but not American companies. They roll out only in America but obviously it's coming, and they use locale to detect it? My locale is set to en_US too, surely I'm not alone doing it because of translated software. Firefox has a small market in America anyway and America is not the world. We know big tech is in bed with your three letter agencies.