8 ms·

Samsung phones force Mainland China DNS service upon Hong Kong WiFi users

209 points by signa11 6y ago

mensetmanusman 6y ago
It’s sad that technology makes it so easy to be authoritarian.
- willis936 6y ago
  Technology is just a tool. Nothing here was made with authoritarianism in mind and the shape of the tools reflect that. It’s just a shame that they are authoritarian. As Uncle Ben would say: with great power comes great responsibility. Technology created a lot of power in a short time. Humans haven’t had enough time to gently learn how to be responsible with it yet. Hopefully we don’t blow a hand off.
- politelemon 6y ago
  Almost all the early protocols and systems (smtp, bgp, dns...) set up in place relied on the goodwill of people and assumed that they are inherently trustworthy. In a way it's a reflection upon the creators of those technologies themselves that they didn't see their creations being abused or exploited by large tech firms and governments - the creators did it for the joy of tech, their passion and optimism for the future potential of what they were doing. And then we came along and everything got worse.
  - rat9988 6y ago
    I would need some sort of proof to believe this narrative about a tech originally born for military usage.
    - ramphastidae 6y ago
      You might start here: https://en.m.wikipedia.org/wiki/ARPANET https://en.m.wikipedia.org/wiki/ARPANET
  - rightbyte 6y ago
    An military or university network is probably much easier to administrate as the university or regiment administrators can be relied on to disable malicious users. www is more of an almost anarchy that works suprisingly well.
  - m463 6y ago
    I strongly disagree. Although there have been some less-than-optimal implementations in some protocols, in general the internet protocols were designed by people with their eyes open. The protocols were designed to resist centralized control, and have been very successful. You should read specifically about how tcp/ip was developed, not technically, but the people behind it and their motivations.
    - DaiPlusPlus 6y ago
      > but the people behind it and their motivations. Surviving nuclear war isn't quite the same thing.
      - m463 6y ago
        That's sort of a myth. The Baran stuff wasn't responsible for tcp/ip.
    - mindslight 6y ago
      IP addressing is centralized to make routing easier. Source routing was possible for a while, but got strongly deprecated due to security. DNS is a singular centralized namespace. HTTP(s) bakes an authoritative server into the name of every object. Sure there are counterexamples - TCP doesn't require router state, UDP lets users skip the OS protocol stack, DNS could be even more centralized. But the basic protocols weren't really designed to resist much of anything. Their decentralization arose out of administrative concerns (site A should be able to administer its own names without coordinating with B and C) and engineering concerns (E2E principle) rather than power relations (powerful C can force its will onto the relationship between A and B). Designing to resist against the latter takes public key cryptography, which was nascent and too computationally expensive prior to the past few decades.
      - m463 6y ago
        I could pretty much say the opposite of everything you say and be correct as well: IP addressing is not centralized. DNS has a distributed common namespace with lots of delegation. HTTP is peer to peer. The easiest book to read about the personalities and history of this stuff is probably "the innovators" by walter isaacson. If I compare the networking we came up with to the other types of networks available in the day the ip protocols were invented, I think what we have is remarkable.
  - JumpCrisscross 6y ago
    > it's a reflection upon the creators of those technologies themselves that they didn't see their creations being abused or exploited by large tech firms and governments The designers of a network built to withstand nuclear bombardment had a wide-eyed view of human nature?
    - pokot0 6y ago
      You are merging the reason for the funding of the project (political decision) with the motivation of the people doing the actual job (scientist). That's unfair.
      - JumpCrisscross 6y ago
        The motivation could be altruistic. But OP implies they were blindsided by human nature. Given the adversarial aim of the project, which was known to them when they built the protocols, and the personal writings of its designers, I question that assumption. The protocols weren’t naïvely designed. They were designed against the threats of the day. The threat model has changed, making the protocols look childishly optimistic in the way someone walking into a modern battlefield with a wooden shield and sword might .
        salawat 6y ago
        Still, what you're doing is something like downplaying the entire space program as being merely a happy accident resulting from building a better ICBM. It's daft, and it oversimplifies the motives, goals, and characters of a hell of a lot of really great people. Sometimes military/defense applications is one of the best ways to guarantee funding. DARPA is even considered "defense" because it was decided that something like "those damn commies" being first to orbit a satellite happening again was unacceptable, and a technological lead was deemed a critical cornerstone of the United State's national defense strategy. That that lead has been completely sacrificed in the last 60 or so years to foster increasing globalization in the foolhardy belief of winning over the communist bloc through capitalist flexing notwithstanding, the people who have been pushing the envelope have not by any stretch been some sort of series of diabolical Dr. Strangelove's. Quite the contrary in fact. It's just so easy for techies to get caught up in the pedantism of historical record they completely lose sight of the rest of humanity going on around them.
- imglorp 6y ago
  I often wonder if this is the solution to the Fermi paradox. The assumptions go like this. * Natural selection works everywhere, on individuals and societies. They compete even after survival is secure * Intelligent creatures need social order and specialization to become industrial * There will be administrative/ruling specialties because flat organizational hierarchies work for ants and bees but not when work and global coordination becomes complex * Social order installed, tech attained * Absolute power corrupts absolutely * ET gulag, end of space travel, everyone is busy making war and pleasing dear leaders No references.
- sschueller 6y ago
  Especially companies that operate walled gardens for the sake of "security".
askmike 6y ago
cached: https://webcache.googleusercontent.com/search?q=cache:ABbuK3QC0b0J:https://blog.headuck.com/2020/10/12/samsung-phones-force-mainland-china-dns-service-upon-hong-kong-wifi-users/+&cd=1&hl=en&ct=clnk&gl=hk https://webcache.googleusercontent.com/search?q=cache:ABbuK3...
- utf_8x 6y ago
  Google-free alternative: https://web.archive.org/web/20201018102614/http://blog.headuck.com/2020/10/12/samsung-phones-force-mainland-china-dns-service-upon-hong-kong-wifi-users/ https://web.archive.org/web/20201018102614/http://blog.headu...
nicolas_t 6y ago
As someone who owns a samsung phone and lives in Hong Kong this is infuriating. I'm glad that at least the first issue is fixed in a more recent firmware but that destroys my trust in Samsung.
- politelemon 6y ago
  Does the use of Private DNS (dns over tls) feature override this behaviour for you? You can try a throwaway account on nextdns.io and if private dns works you can see your dns traffic in their analytics tab
torgian 6y ago
Interesting to note that this site is blocked from people living in Taiwan.
- throwaway4good 6y ago
  Why would people do that?
- numpad0 6y ago
  What? Taiwan is supposed to be a blue team nation aren’t they?
- philliphaydon 6y ago
  HN? No it’s not....
  - torgian 6y ago
    HN Is fine, I was referring to the site linked in the topic
infofarmer 6y ago
«The owner of this website (blog.headuck.com) has banned the country or region your IP address is in (CN) from accessing this website» ¯\_(ツ)_/¯
- nashashmi 6y ago
  fullhn.com?
- eznzt 6y ago
  Not a bad idea, that usually means 95% fewer bots.
  - hungryhobo 6y ago
    Sounds like the gfw is truly ahead of its time
- zhte415 6y ago
  How do you access HackerNews if not on a VPN? It's blocked in CN too.
zhte415 6y ago
Interesting and deliberate IP 114.114.114.114 114 is the mainland China number for an equivalent of the yellow pages. Phone number lookup.
red_admiral 6y ago
So, does non-China android regularly ping google.com, and could that have privacy implications? My first thought is this could be a non-malicious but perhaps not fully thought out bugfix: wi-fi connection status detection sporadically fails behind the GFW when queries to google don't resolve, let's pick a similarly dominant site on the other side of the firewall as an alternative. Apparently someone at Samsung then noticed and decided to use a Samsung .cn site instead in the latest patch.
londons_explore 6y ago
The cause of this is: * Android needs to know if a wifi network is working, since many wifi networks are broken and connecting to them degrades the user experience. * Normally it does that by connecting to google.com, and if the connection succeeds, assume wifi is good to go. * Google.com is blocked in china, meaning wifi would be broken in China. * To fix this, Samsung has replaced google.com with qq.com in china. * Samsung also needs to add a new DNS server to resolve qq.com, in case the network doesn't provide a DNS server and androids default of Google DNS is used (which is also blocked in China). Adding it last means it won't be used unless other DNS servers are broken. Overall, this behaviour seems like the simplest and most logical fix Samsung could put in place to enable their users to use phones in China. They could have run their own servers (but that would also have privacy issues), or they could have removed captive portal/bad network detection, but that probably would have broken some apps and led to unhappy users. I can't see any other real fix in this case, and I certainly don't see any malicious intent in any of their actions.
- culturestate 6y ago
  > They could have run their own servers This is exactly what Apple does, and they even include some fallback domains in case apple.com doesn't resolve. Samsung's design seems less like the most logical solution than it does the laziest solution.
  - SaltyBackendGuy 6y ago
    > laziest solution. Maybe. But also probably shortest path, least amount of risk and resource investment.
    - deleted 6y ago
      [deleted]
    - culturestate 6y ago
      I mean, Samsung is one of the largest companies in the world and they already run a global cloud infrastructure to support their electronics division. I can't imagine that a PM who really cared would have much trouble getting a couple of endpoints provisioned if he or she wanted them. The more likely scenario is that they came up with what they thought was a good-enough solution and just moved on without really considering the knock-on effects.

209 points by signa11 6y ago

mensetmanusman 6y ago

It’s sad that technology makes it so easy to be authoritarian.

willis936 6y ago
Technology is just a tool. Nothing here was made with authoritarianism in mind and the shape of the tools reflect that. It’s just a shame that they are authoritarian. As Uncle Ben would say: with great power comes great responsibility. Technology created a lot of power in a short time. Humans haven’t had enough time to gently learn how to be responsible with it yet. Hopefully we don’t blow a hand off.
politelemon 6y ago
Almost all the early protocols and systems (smtp, bgp, dns...) set up in place relied on the goodwill of people and assumed that they are inherently trustworthy. In a way it's a reflection upon the creators of those technologies themselves that they didn't see their creations being abused or exploited by large tech firms and governments - the creators did it for the joy of tech, their passion and optimism for the future potential of what they were doing. And then we came along and everything got worse.
- rat9988 6y ago
  I would need some sort of proof to believe this narrative about a tech originally born for military usage.
  - ramphastidae 6y ago
    You might start here: https://en.m.wikipedia.org/wiki/ARPANET https://en.m.wikipedia.org/wiki/ARPANET
- rightbyte 6y ago
  An military or university network is probably much easier to administrate as the university or regiment administrators can be relied on to disable malicious users. www is more of an almost anarchy that works suprisingly well.
- m463 6y ago
  I strongly disagree. Although there have been some less-than-optimal implementations in some protocols, in general the internet protocols were designed by people with their eyes open. The protocols were designed to resist centralized control, and have been very successful. You should read specifically about how tcp/ip was developed, not technically, but the people behind it and their motivations.
  - DaiPlusPlus 6y ago
    > but the people behind it and their motivations. Surviving nuclear war isn't quite the same thing.
    - m463 6y ago
      That's sort of a myth. The Baran stuff wasn't responsible for tcp/ip.
  - mindslight 6y ago
    IP addressing is centralized to make routing easier. Source routing was possible for a while, but got strongly deprecated due to security. DNS is a singular centralized namespace. HTTP(s) bakes an authoritative server into the name of every object. Sure there are counterexamples - TCP doesn't require router state, UDP lets users skip the OS protocol stack, DNS could be even more centralized. But the basic protocols weren't really designed to resist much of anything. Their decentralization arose out of administrative concerns (site A should be able to administer its own names without coordinating with B and C) and engineering concerns (E2E principle) rather than power relations (powerful C can force its will onto the relationship between A and B). Designing to resist against the latter takes public key cryptography, which was nascent and too computationally expensive prior to the past few decades.
    - m463 6y ago
      I could pretty much say the opposite of everything you say and be correct as well: IP addressing is not centralized. DNS has a distributed common namespace with lots of delegation. HTTP is peer to peer. The easiest book to read about the personalities and history of this stuff is probably "the innovators" by walter isaacson. If I compare the networking we came up with to the other types of networks available in the day the ip protocols were invented, I think what we have is remarkable.
- JumpCrisscross 6y ago
  > it's a reflection upon the creators of those technologies themselves that they didn't see their creations being abused or exploited by large tech firms and governments The designers of a network built to withstand nuclear bombardment had a wide-eyed view of human nature?
  - pokot0 6y ago
    You are merging the reason for the funding of the project (political decision) with the motivation of the people doing the actual job (scientist). That's unfair.
    - JumpCrisscross 6y ago
      The motivation could be altruistic. But OP implies they were blindsided by human nature. Given the adversarial aim of the project, which was known to them when they built the protocols, and the personal writings of its designers, I question that assumption. The protocols weren’t naïvely designed. They were designed against the threats of the day. The threat model has changed, making the protocols look childishly optimistic in the way someone walking into a modern battlefield with a wooden shield and sword might .
      - salawat 6y ago
        Still, what you're doing is something like downplaying the entire space program as being merely a happy accident resulting from building a better ICBM. It's daft, and it oversimplifies the motives, goals, and characters of a hell of a lot of really great people. Sometimes military/defense applications is one of the best ways to guarantee funding. DARPA is even considered "defense" because it was decided that something like "those damn commies" being first to orbit a satellite happening again was unacceptable, and a technological lead was deemed a critical cornerstone of the United State's national defense strategy. That that lead has been completely sacrificed in the last 60 or so years to foster increasing globalization in the foolhardy belief of winning over the communist bloc through capitalist flexing notwithstanding, the people who have been pushing the envelope have not by any stretch been some sort of series of diabolical Dr. Strangelove's. Quite the contrary in fact. It's just so easy for techies to get caught up in the pedantism of historical record they completely lose sight of the rest of humanity going on around them.
imglorp 6y ago
I often wonder if this is the solution to the Fermi paradox. The assumptions go like this. * Natural selection works everywhere, on individuals and societies. They compete even after survival is secure * Intelligent creatures need social order and specialization to become industrial * There will be administrative/ruling specialties because flat organizational hierarchies work for ants and bees but not when work and global coordination becomes complex * Social order installed, tech attained * Absolute power corrupts absolutely * ET gulag, end of space travel, everyone is busy making war and pleasing dear leaders No references.
sschueller 6y ago
Especially companies that operate walled gardens for the sake of "security".

askmike 6y ago

cached: https://webcache.googleusercontent.com/search?q=cache:ABbuK3QC0b0J:https://blog.headuck.com/2020/10/12/samsung-phones-force-mainland-china-dns-service-upon-hong-kong-wifi-users/+&cd=1&hl=en&ct=clnk&gl=hk https://webcache.googleusercontent.com/search?q=cache:ABbuK3...

utf_8x 6y ago
Google-free alternative: https://web.archive.org/web/20201018102614/http://blog.headuck.com/2020/10/12/samsung-phones-force-mainland-china-dns-service-upon-hong-kong-wifi-users/ https://web.archive.org/web/20201018102614/http://blog.headu...

nicolas_t 6y ago

As someone who owns a samsung phone and lives in Hong Kong this is infuriating. I'm glad that at least the first issue is fixed in a more recent firmware but that destroys my trust in Samsung.

politelemon 6y ago
Does the use of Private DNS (dns over tls) feature override this behaviour for you? You can try a throwaway account on nextdns.io and if private dns works you can see your dns traffic in their analytics tab

torgian 6y ago

Interesting to note that this site is blocked from people living in Taiwan.

throwaway4good 6y ago
Why would people do that?
numpad0 6y ago
What? Taiwan is supposed to be a blue team nation aren’t they?
philliphaydon 6y ago
HN? No it’s not....
- torgian 6y ago
  HN Is fine, I was referring to the site linked in the topic

infofarmer 6y ago

«The owner of this website (blog.headuck.com) has banned the country or region your IP address is in (CN) from accessing this website» ¯\_(ツ)_/¯

nashashmi 6y ago
fullhn.com?
eznzt 6y ago
Not a bad idea, that usually means 95% fewer bots.
- hungryhobo 6y ago
  Sounds like the gfw is truly ahead of its time
zhte415 6y ago
How do you access HackerNews if not on a VPN? It's blocked in CN too.

zhte415 6y ago

Interesting and deliberate IP 114.114.114.114 114 is the mainland China number for an equivalent of the yellow pages. Phone number lookup.

red_admiral 6y ago

So, does non-China android regularly ping google.com, and could that have privacy implications? My first thought is this could be a non-malicious but perhaps not fully thought out bugfix: wi-fi connection status detection sporadically fails behind the GFW when queries to google don't resolve, let's pick a similarly dominant site on the other side of the firewall as an alternative. Apparently someone at Samsung then noticed and decided to use a Samsung .cn site instead in the latest patch.

londons_explore 6y ago

The cause of this is: * Android needs to know if a wifi network is working, since many wifi networks are broken and connecting to them degrades the user experience. * Normally it does that by connecting to google.com, and if the connection succeeds, assume wifi is good to go. * Google.com is blocked in china, meaning wifi would be broken in China. * To fix this, Samsung has replaced google.com with qq.com in china. * Samsung also needs to add a new DNS server to resolve qq.com, in case the network doesn't provide a DNS server and androids default of Google DNS is used (which is also blocked in China). Adding it last means it won't be used unless other DNS servers are broken. Overall, this behaviour seems like the simplest and most logical fix Samsung could put in place to enable their users to use phones in China. They could have run their own servers (but that would also have privacy issues), or they could have removed captive portal/bad network detection, but that probably would have broken some apps and led to unhappy users. I can't see any other real fix in this case, and I certainly don't see any malicious intent in any of their actions.

culturestate 6y ago
> They could have run their own servers This is exactly what Apple does, and they even include some fallback domains in case apple.com doesn't resolve. Samsung's design seems less like the most logical solution than it does the laziest solution.
- SaltyBackendGuy 6y ago
  > laziest solution. Maybe. But also probably shortest path, least amount of risk and resource investment.
  - deleted 6y ago
    [deleted]
  - culturestate 6y ago
    I mean, Samsung is one of the largest companies in the world and they already run a global cloud infrastructure to support their electronics division. I can't imagine that a PM who really cared would have much trouble getting a couple of endpoints provisioned if he or she wanted them. The more likely scenario is that they came up with what they thought was a good-enough solution and just moved on without really considering the knock-on effects.