9 ms·
Wait, so Chrome leaks the first word of my searches to my ISP? That doesn’t sound like something I want to happen
by peteretep 6y ago
Wait, so Chrome leaks the first word of my searches to my ISP? That doesn’t sound like something I want to happen
- londons_explore 6y agoChrome leaks 1 word searches in the address bar, yes.
- merlinscholz 6y agoThat's another reason to use an internal DNS server which queries an upstream DOH server.
- lstamour 6y agoLast I checked, I think “DNS Security” (DoH) was shipped in Chrome, you can pick an alternative in Settings, I think. Such as, in this case, Google. Not sure if that changes the way this nxdomain check behaves, presumably Chrome trusts TLS but not the ISP’s DoH?
- IX-103 6y agoFor DoH Chrome does not do that check. Instead one of the requirements to be one their allowed DoH providers is that they don't do the evil redirect NX Domain responses. But Chrome also falls back to try non-DoH on NX-Domain, so it doesn't really help. I guess they need to do that so internal domains work correctly.
- rsync 6y ago"That's another reason to use an internal DNS server which queries an upstream DOH server." Even better, spin up a little VM or VPS somewhere in the cloud, install 'unbound' as a recursive resolver and point it to your nextdns.io account/address. Let's unpack this ... backwards ... DNS servers out on the Internet are queried by nextdns, which presumably has no PII from you other than your CC number[1] and zip code. Nextdns receives nothing but queries from some random VPS/EC2/VM IP. Again, presumably a provider that knows (almost) nothing about you. Your ISP sees nothing ... just encrypted DNS traffic. It's win, win, win. You see no ads, since nextcloud.io acts like a pihole and strips/blocks all of the malicious hostname lookups. [1] Remember, only AMEX verifies cardholder FIRST LAST. Use your VISA/MC. I think my first/last is Nextdns User or whatever ... YMMV if a merchant is enrolled in that weird "verified by visa" service ...
- bacondude3 6y ago> Remember, only AMEX verifies cardholder FIRST LAST. Use your VISA/MC. Do you have a source for this?
- rsync 6y agoAnecdotally, I use three different Amazon accounts for both personal and business accounts and none of them have a real first/last name on them. In fact, I only use my actual first/last name with online payments when dealing with government agencies or regulated purchases. But don't take my word for it: https://ux.stackexchange.com/questions/31006/should-we-ask-for-name-on-card-even-though-its-not-required-for-credit-card-pay https://ux.stackexchange.com/questions/31006/should-we-ask-f... "While you're correct that Visa and MasterCard do not validate this information, that's not true of all credit card providers." ... actually, the entire stackex discussion at that link is fairly interesting ...
- bacondude3 6y agoThanks!
- vetinari 6y agoI still don't understand what's nextdns.io doing in the stack. Couldn't you just run your recursive resolver as recursive resolver and let it ask respective authoritative servers directly, instead of forwarding to the middleman? You can run your own blocklists on your unbound/kresd/whatever. Then DNS servers out on the Internet are queried by some random IP from a VPS/EC2/VM IP range, so they are about as wise as when queried by nextdns.io.
- rsync 6y agoYes, of course nextdns is not required - I simply added it because that is my own setup and it adds the pihole-like ad-blocking to the workflow. They are my favorite IaaS startup of the last 5-10 years - it is a genius idea and I wish I had thought of it.
- brown9-2 6y agoYou can prefix your searches in the omnibox with “?” and they won’t be treated as possible short local network names
- mehrdadn 6y agoCtrl+K for Windows users looking for a shortcut key.
- tylercrompton 6y agoThat works on multiple platforms! I'm able to do that on Arch.
- deleted 6y ago[deleted]
- viraptor 6y agoIn the good old times, ctrl-l went to the location bar and ctrl-k went to the search bar. After they merged, ctrl-k just prepends the question mark. But... as an old shortcut, pretty much everything supports it.
- onionisafruit 6y agoIsn’t “?” and ctrl-k the same number of keystrokes?
- mehrdadn 6y agoOnly if you don't count your mouse clicking the omnibar as a keystroke.
- onionisafruit 6y agoThat’s a good point. I didn’t consider that, and now I’ll use this shortcut. If I had been at my computer I would have realized that immediately.
- deleted 6y ago[deleted]
- boring_twenties 6y agoYour local nameserver should be configured to not forward unqualified names upstream.
- taneq 6y agoAny time you say something 'should' be something, it's an indication that sometimes it's not.
- kevincox 6y agoSo how does it resolve com then? Or the (small number) of sites that are on the TLD.
- boring_twenties 6y agoIt doesn't. It's not a recursive resolver. It forwards qualified names (those including a dot) to the upstream nameserver (the ISP's).
- stjohnswarts 6y agoHow many people know how to configure their local name server outside of the HN crowd?
- boring_twenties 6y agoThis is the default configuration in all consumer routers I've seen. Granted, that's not very many.
- jacobsenscott 6y agoMy local nameserver is run by comcast!
- boring_twenties 6y agoReally? Your router does not have a caching nameserver built in?
- josteink 6y ago> Wait, so Chrome leaks That’s obviously so, because that’s it’s entire raison d’entre.
- a1369209993 6y agoIts raison d'entre is to leak stuff to Google. While that's a problem, and probably a worse one, it's not the same problem as leaking stuff to a ISP.
- AndyMcConachie 6y agoNot exactly. Chrome doesn't know if you're trying to enter a domain name, hence URL, or are trying to enter a search term. The Omnibar supports both. So Chrome tries to resolve the string you entered and if it gets back an NXDOMAIN it can assume that it's a search term. The problem is that some ISPs have configured their DNS resolvers to lie and not return NXDOMAIN. Instead redirecting you to some website for marketing purposes. The Chromium workaround is to try and detect if it is using a lying DNS resolver by issuing queries that it knows SHOULD return an NXDOMAIN. If this concerns you run your own resolver, enable DNSSEC validation, and enable aggressive NSEC caching(RFC 8198).
- bo1024 6y agoThis post contains a bunch of information about the question, but it doesn't seem to actually address the question. The question is: does Chromium send the first word I type to my ISP? The answer appears to be: yes.
- throwaway18231 6y agoI justed tested this myself via logging the DNS queries, and yes, this is true.
- rfoo 6y ago> the first word No. The answer appears to be yes if you said "the only word", though.
- deleted 6y ago[deleted]
- JeremyBanks 6y ago...which the first word would be, as you typed it?
- notatoad 6y agodepends how fast you type - there's a delay on the query so it's not re-querying for every keystroke. but probably yes.
- gruez 6y agoI'm always baffled why chrome can't have a separate search/address bar, which avoids this issue entirely.
- majewsky 6y agoThey design for an audience that, on average, cannot distinguish betweeen the address bar of the browser and the search bar on the Google homepage.
- Spivak 6y agoI mean after a certain point you just have to accept the kinds of things that your users will type in whatever text boxes you show them and make it work. If you know what the user is trying to do then it's not good UX to throw an error or tell them "I know you're trying to search, but I won't until you retype it into this other box". Google Maps is a good example of this. Like the original text box you were shown was searching for an address but enough people typed business search terms that eventually they just implemented that feature. The Ansible vault is a bad example of this. They have a little command `ansible-vault` that lets you manage encrypted files and strings. If you run `ansible-vault edit ./nonexistent_file` it tells you that you meant `ansible-vault create` and vice versa but doesn't just do it despite the user intent being clear. This ultimately lead me to just patching it to do the right thing.
- awj 6y ago> The Ansible vault is a bad example of this. They have a little command `ansible-vault` that lets you manage encrypted files and strings. If you run `ansible-vault edit ./nonexistent_file` it tells you that you meant `ansible-vault create` and vice versa but doesn't just do it despite the user intent being clear. This ultimately lead me to just patching it to do the right thing. IMO it's a bit much to decide what "the right thing" is there. Blindly assuming that someone attempting to edit credentials didn't mistype a file name isn't exactly safe and sounds like a great way to cause problems based on believing you updated something you did not in fact update.
- HuangYuSan 6y agoWAIT
- blindm 6y agoHow do you mean? So if I type ihavecancer, it tries to resolve to ihavecancer.com or something?
- 0xffff2 6y agoIt tries to resolve `ihavecancer` as a TLD, because it may be a local TLD on your intranet.