5 ms·

> Route DNS to trusted non-profit entities. I'm sure you know this, but some readers might not. DNS is totally insecure. Even if you change your DNS server fro

> Route DNS to trusted non-profit entities. I'm sure you know this, but some readers might not. DNS is totally insecure. Even if you change your DNS server from the default to 1.1.1.1 or whatever, your ISP can and does still read and/or intercept these requests. This sort of interference is absolutely trivial to implement, even at scale. Don't think it isn't happening to you.

solarkraft 6y ago
... which is exactly why DoH is gaining attention. But I keep wondering: Can't the ISP trivially correlate the accessed IP addresses with their corresponding sites even without DNS query data?
- SAI_Peregrinus 6y ago
  Only for sites with dedicated IPs. If they're hosted on some sort of cloud service then the ISP has to sniff the SNI data. And with ESNI coming to encrypt it that hole will be plugged soon.
  - the8472 6y ago
    That just means moving from the ISP in a prime position for snooping to various CDNs being in that prime position. You traded one master for another.
    - judge2020 6y ago
      Let's try the one that hasn't eagerly and willingly (that we know of) gone against their users.
      - the8472 6y ago
        That heavily depends on who those parties are. E.g. a european might trust their local ISP (subject to GDPR) more than an american CDN (subject to the cloud act and NSLs).
    - xoa 6y ago
      >You traded one master for another. No. By definition, last mile ISP sees 100% of net-bound traffic. "Various CDNs" itself already represents a dilution of that view, and are not universal themselves. It's an inherent improvement even outside of other factors. But there are other factors, including a decrease in the level of natural monopoly. Last-mile ISPs often have zero effective competition, and even with one or two there are often high change over costs, longer term contracts involved, etc. The closer you get to the net's core however, the more bandwidth there is and the more players there are and in turn vastly more competition potential. That's not a guarantee sure, but it absolutely makes a difference. There's also a limiting factor principle at work: even if you do trust a given ISP, how does that help you avoid CDNs anyway? It's the same reason that spinning up your own instance of an algo VPN on some VPS and funneling all your home and mobile traffic through that may have practical benefits. Sure in principle the VPS (or data center if you go on your own metal) provider could try spying as well. But competition there is fierce, the average technical level of users is higher, major business interests are involved in reputation, and swapping to another provider is utterly trivial. The incentives and business models for the likes of Amazon/DigitalOcean/Google/Microsoft/OVH/Scaleway/Vultr/[...] in their compute offerings are completely different from the likes of AT&T/Charter/Comcast/T-mobile/Verizon. So it is in fact reasonable to expect a difference in the level of shenanigans too, and hey, if not you can easily move, which also in turn makes it much easier as a practical matter to retaliate (sue), which virtuously further decreases the likelihood of shenanigans.
      - the8472 6y ago
        You have a contractual relation with your ISP and they're in your jurisdiction so at least in theory you have legal recourse. Advocating for ESNI on the other hand means argueing for more centralization towards entities which are far more removed from you where you have little recourse. So as far as incentives go they may be more beholden to some law enforcement agency than you the non-customer. There are difference, but it does not appear to be an obvious improvement to me.
        wrkronmiller 6y ago
        I think you bring up good points but your takeaway is 180 off. Different jurisdiction means less likely to be answerable to your local government should they be oppressive. The fact you don't have a contractual relationship with a CDN is a good thing because it becomes trivial simply to stop using them, should the need arise. Don't like Cloudflare? block them. Your choice of websites will be reduced greatly but you still have an operational internet connection.
    - SAI_Peregrinus 6y ago
      Only if the site is using a CDN. I said some sort of "cloud" service, which (IMO, it's an admittedly fuzzy term for someone else's computer) includes shared hosting providers. All together there are a LOT of shared hosts out there, not just AWS, Azure, and GCP. So collating all your habits becomes much harder.
  - pabs3 6y ago
    I found this study interesting: "What can you learn from an IP?" https://irtf.org/anrw/2019/slides-anrw19-final44.pdf https://irtf.org/anrw/2019/slides-anrw19-final44.pdf So essentially ESNI/DoH are only useful for websites on global CDN providers? Why would Mozilla be interested in enhancing those companies profits?
    - SAI_Peregrinus 6y ago
      Or any other shared hosting. I never mentioned global CDNs, just "cloud" (somebody else's computer with other clients) hosting.
- ethbro 6y ago
  Trivial in the individual case is not trivial at scale.
- grishka 6y ago
  Also don't forget about SNI. This exposes the domain you're connecting to over TLS. Yes, I know eSNI is a thing, but it's new and so unlikely to be deployed much.
sandworm101 6y ago
>> Even if you change your DNS server from the default to 1.1.1.1 or whatever, your ISP can and does still read and/or intercept these requests. Not if VPNs/firewalls are properly implmented. Plugging DNS leaks is security 101.
- treve 6y ago
  I get that VPNs are considered more trustworthy by some (although so many also have shoddy records/ownership), but it's still 1 extra party to trust vs. just your DNS provider.
  - efreak 6y ago
    If your VPN is only being used for DNS queries, then they don't have much useful data there. I've recently seen instructions for setting this up on free cloud instances from AWS/Azure/etc. If the only traffic is DNS wrapped in VPN, it should stay within the free tier (especially if you add local caching, but even that shouldn't be necessary)

solarkraft 6y ago

... which is exactly why DoH is gaining attention. But I keep wondering: Can't the ISP trivially correlate the accessed IP addresses with their corresponding sites even without DNS query data?

SAI_Peregrinus 6y ago
Only for sites with dedicated IPs. If they're hosted on some sort of cloud service then the ISP has to sniff the SNI data. And with ESNI coming to encrypt it that hole will be plugged soon.
- the8472 6y ago
  That just means moving from the ISP in a prime position for snooping to various CDNs being in that prime position. You traded one master for another.
  - judge2020 6y ago
    Let's try the one that hasn't eagerly and willingly (that we know of) gone against their users.
    - the8472 6y ago
      That heavily depends on who those parties are. E.g. a european might trust their local ISP (subject to GDPR) more than an american CDN (subject to the cloud act and NSLs).
  - xoa 6y ago
    >You traded one master for another. No. By definition, last mile ISP sees 100% of net-bound traffic. "Various CDNs" itself already represents a dilution of that view, and are not universal themselves. It's an inherent improvement even outside of other factors. But there are other factors, including a decrease in the level of natural monopoly. Last-mile ISPs often have zero effective competition, and even with one or two there are often high change over costs, longer term contracts involved, etc. The closer you get to the net's core however, the more bandwidth there is and the more players there are and in turn vastly more competition potential. That's not a guarantee sure, but it absolutely makes a difference. There's also a limiting factor principle at work: even if you do trust a given ISP, how does that help you avoid CDNs anyway? It's the same reason that spinning up your own instance of an algo VPN on some VPS and funneling all your home and mobile traffic through that may have practical benefits. Sure in principle the VPS (or data center if you go on your own metal) provider could try spying as well. But competition there is fierce, the average technical level of users is higher, major business interests are involved in reputation, and swapping to another provider is utterly trivial. The incentives and business models for the likes of Amazon/DigitalOcean/Google/Microsoft/OVH/Scaleway/Vultr/[...] in their compute offerings are completely different from the likes of AT&T/Charter/Comcast/T-mobile/Verizon. So it is in fact reasonable to expect a difference in the level of shenanigans too, and hey, if not you can easily move, which also in turn makes it much easier as a practical matter to retaliate (sue), which virtuously further decreases the likelihood of shenanigans.
    - the8472 6y ago
      You have a contractual relation with your ISP and they're in your jurisdiction so at least in theory you have legal recourse. Advocating for ESNI on the other hand means argueing for more centralization towards entities which are far more removed from you where you have little recourse. So as far as incentives go they may be more beholden to some law enforcement agency than you the non-customer. There are difference, but it does not appear to be an obvious improvement to me.
      - wrkronmiller 6y ago
        I think you bring up good points but your takeaway is 180 off. Different jurisdiction means less likely to be answerable to your local government should they be oppressive. The fact you don't have a contractual relationship with a CDN is a good thing because it becomes trivial simply to stop using them, should the need arise. Don't like Cloudflare? block them. Your choice of websites will be reduced greatly but you still have an operational internet connection.
  - SAI_Peregrinus 6y ago
    Only if the site is using a CDN. I said some sort of "cloud" service, which (IMO, it's an admittedly fuzzy term for someone else's computer) includes shared hosting providers. All together there are a LOT of shared hosts out there, not just AWS, Azure, and GCP. So collating all your habits becomes much harder.
- pabs3 6y ago
  I found this study interesting: "What can you learn from an IP?" https://irtf.org/anrw/2019/slides-anrw19-final44.pdf https://irtf.org/anrw/2019/slides-anrw19-final44.pdf So essentially ESNI/DoH are only useful for websites on global CDN providers? Why would Mozilla be interested in enhancing those companies profits?
  - SAI_Peregrinus 6y ago
    Or any other shared hosting. I never mentioned global CDNs, just "cloud" (somebody else's computer with other clients) hosting.
ethbro 6y ago
Trivial in the individual case is not trivial at scale.
grishka 6y ago
Also don't forget about SNI. This exposes the domain you're connecting to over TLS. Yes, I know eSNI is a thing, but it's new and so unlikely to be deployed much.

sandworm101 6y ago

>> Even if you change your DNS server from the default to 1.1.1.1 or whatever, your ISP can and does still read and/or intercept these requests. Not if VPNs/firewalls are properly implmented. Plugging DNS leaks is security 101.

treve 6y ago
I get that VPNs are considered more trustworthy by some (although so many also have shoddy records/ownership), but it's still 1 extra party to trust vs. just your DNS provider.
- efreak 6y ago
  If your VPN is only being used for DNS queries, then they don't have much useful data there. I've recently seen instructions for setting this up on free cloud instances from AWS/Azure/etc. If the only traffic is DNS wrapped in VPN, it should stay within the free tier (especially if you add local caching, but even that shouldn't be necessary)