5 ms·
Many folks don’t know or forgot that there are ISPs in the US that do deep packet inspection and inject banner ads into http traffic.
by teej 6y ago
Many folks don’t know or forgot that there are ISPs in the US that do deep packet inspection and inject banner ads into http traffic.
- hn_throwaway_99 6y agoSeems like this has to be giving dwindling returns with so much of the web being on https these days.
- geerlingguy 6y agoOne thing my current ISP still does is returns an ad-laden search page any time you visit a domain that doesn't resolve.
- kortilla 6y agoSuper annoying. FYI every ISP I’ve had that does this has some setting buried somewhere that lets you turn this off. If not that, you can usually bypass this by setting your router (or computer directly) to use 8.8.8.8 (Google dns) or 1.1.1.1 (cloud flare dns) as a resolver. I’ve only heard of a couple of cases where ISPs sniff all dns and rewrite NXDOMAIN responses, and the answer for those is some kind of unpleasant tunneling.
- robertlagrant 6y agoDoes DoH help with this?
- BenjiWiebe 6y agoYes, it would mitigate it, until ISPs outright block all known DoH endpoints (probably not feasible though, too easy to fire up another one.)
- rlt 6y agoI wonder if you could block unknown DoH endpoints via traffic analysis. They probably have pretty unique signatures, with every request/response being approximately the same size. Not that I want to give anyone ideas.
- tga_d 6y agoI haven't looked closely at DoH, but based on my knowledge of plugable transports and website fingerprinting attacks, the answer is: probably, but with just a little effort on the client side, detection could be made pretty expensive -- probably expensive enough that ads on unresolved domains wouldn't justify it. Basically, if live classification of network traffic on (obfuscated) metadata were easy, China would have deployed it by now.
- samstave 6y agoI've always wondered how muc CF paid to get 1.1.1.1
- totalZero 6y agoFor the specific behaviors that GP mentioned, that's true perhaps. But who is your DNS provider? If it's your ISP then they know who and where you are, when you're home, and what you browse...TLS or not.