3 ms·

I'm still trying to imagine the way one exploits a lack of partitioning in the DNS cache... 1. It seems like client web pages cannot directly view the DNS info

I'm still trying to imagine the way one exploits a lack of partitioning in the DNS cache... 1. It seems like client web pages cannot directly view the DNS information for a given domain name. So I would think embedding identifying information in something like a CNAME or TXT record directly wouldn't work. 2. I suppose a tracker could try to create unique records for a given domain name and then use request/responses to/from that domain to get identifying information. But this seems highly dependent on being able to control the DNS propagation. Short of my ISP trying this trick on me, I'm not really sure who else could manage. I'm sure I am missing things in this brief analysis. I'd love to hear what others think about this cache.

tyingq 6y ago
"I'm still trying to imagine the way one exploits a lack of partitioning in the DNS cache." There's a PDF here: https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-4_Klein_paper.pdf https://www.ndss-symposium.org/wp-content/uploads/2019/02/nd... Basically timing based. See https://www.audero.it/demo/resource-timing-api-demo.html https://www.audero.it/demo/resource-timing-api-demo.html for a demo of what's available in the browser's navigation and resource timing API. For example, I get this on a cached reload: domainLookupStart: 52.090000128373504 domainLookupEnd: 52.090000128373504 The PDF explains some enhancements that make it more reliable, like publishing multiple A records and watching order, etc. Also, the demo link isn't really showing what you would do...the resource being downloaded would be marked as non-cacheable so that you would be measuring "DNS lookup was cached or not" instead of "Entire Asset was cached, therefore no DNS lookup happened".
- nixpulvis 6y ago
  It's always timing isn't it... Thanks for those links.
labawi 6y ago
DNS could respond with unique IPv6 addresses and echo back on HTTP request. But it's more likely they just use a large set of (sub)domains and measure timing.

tyingq 6y ago

"I'm still trying to imagine the way one exploits a lack of partitioning in the DNS cache." There's a PDF here: https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-4_Klein_paper.pdf https://www.ndss-symposium.org/wp-content/uploads/2019/02/nd... Basically timing based. See https://www.audero.it/demo/resource-timing-api-demo.html https://www.audero.it/demo/resource-timing-api-demo.html for a demo of what's available in the browser's navigation and resource timing API. For example, I get this on a cached reload: domainLookupStart: 52.090000128373504 domainLookupEnd: 52.090000128373504 The PDF explains some enhancements that make it more reliable, like publishing multiple A records and watching order, etc. Also, the demo link isn't really showing what you would do...the resource being downloaded would be marked as non-cacheable so that you would be measuring "DNS lookup was cached or not" instead of "Entire Asset was cached, therefore no DNS lookup happened".

nixpulvis 6y ago
It's always timing isn't it... Thanks for those links.

labawi 6y ago

DNS could respond with unique IPv6 addresses and echo back on HTTP request. But it's more likely they just use a large set of (sub)domains and measure timing.