5 ms·

i assume in days of https, most of the history they would be able to obtain are only domain names, not specific URLs, right?

will0 6y ago
Correct
PaulKeeble 6y ago
Hence the desire to backdoor all encryption to see the full juicy details. Also the reason DNS over HTTPS exists and is spreading.
- schmorptron 6y ago
  Does DNS over HTTPS allow the dns provider to see beyond the domain name?
  - capableweb 6y ago
    Since DNS (Domain Name System) only deals with the domain names themselves, any DNS resolver (communicated to via HTTP, TCP, UDP, QUIC or what have you) will only resolve a domain name => IP address. Adding a path in there makes no sense.
  - dahfizz 6y ago
    They can see the IP address of the machine making the request, if that's what you mean.
  - 1vuio0pswjnm7 6y ago
    I am guessing the parent commenter is wondering if the full URL can be deciphered from DoH. In the way DoH is being used in practice, it alllows third parties to collect histories of DNS lookups for myriad users, separated by individual program. In other words, the third party can tell which program was used by a given user to initiate any given DNS lookup. The program often reveals identifying information about the device on which it is installed. Other parties collect user data pertaining to IP address and device. Device fingerprinting, i.e., associating a given user with a given device, is in widespread use purportedly "as a security measure" by "tech" companies like Facebook. Can we be sure the data collected is also not being used for other purposes.1 Combine the DNS program+IP fingerprint with, e.g., a web browser+IP fingerprint and now we can potentially identify a user from DNS lookups. Now consider that Facebook prefixes all external URLs posted to Facebook pages (including external URLs posted in messages) so that any clicks on these URLs are captured, and the HTTP requests to non-Facebook sites are redirected via Facebook servers, again as a purported "security measure". Can we be sure the data collected is not also being used for other purposes.1 Thus Facebook has a history for each user of the URLs in Facebook pages/messages that the user clicks/follows. The problem with DoH in practice is that it is being used almost exclusivelt to provide third party DNS. When we use third party DNS we give anyone (e.g., a "tech" company, a government, etc.) the potential opportunity to obtain from the third party (e.g., through subpoena, acquiring assets through merger, undisclosed data breach, etc.) complete DNS lookup histories for users' individual programs. There is no need to do this because there is no technical need to use third party DNS. And, of course, DoH does not have to be used only by third party DNS providers, so DoH itself is not the problem. 1. If I recall correctly, Facebook in the past has been caught lying about collecting telephone numbers "only" as a security measure.
    - schmorptron 6y ago
      Makes sense, thanks for explaining the bigger picture.
BiteCode_dev 6y ago
Except if you have a root certificate, then you can MITM you heart away. Which govs probably have.
- asddubs 6y ago
  yes, but it'd be the ISPs storing the internet history
  - BiteCode_dev 6y ago
    Backbones have the reputation of being filled with intercepting devices from various entities, including gov's own.
    - asddubs 6y ago
      wouldn't certificate pinning partially prevent this though? i'm not saying this is impossible, but for regular ISP-logged data that some schmuck wants access to, rather than a 3 letter agency or whatever, i doubt this is much of a concern
    - tialaramex 6y ago
      Intercepting at line rate isn't a thing. Recording absolutely happens, but that's why we're talking about End to End Encryption. It would suit snoops very much if what they recorded wasn't 90% unintelligible noise. Right now they get a good idea which sites are visited (because of Server Name Indication) by web browsers, and they get some portion of email (sent in the clear) plus a small fraction of web traffic (HTTP-only) and numerous older unencrypted protocols. In particular they also get most of DNS. DPRIVE work (DNS over TLS, DNS over HTTPS, and eventually DNS over QUIC) reduces that considerably. Future DPRIVE work also includes oblivious transfer (you ask say Google to do a DNS lookup on your behalf, they learn who you are and which DNS server was asked but not what you asked it, the DNS server learns what was asked but not who you are, you get your answer). Or of course, if you're particularly worried, you use Tor and everything on the snoops' screens dissolves into noise.
- tialaramex 6y ago
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
thro1 6y ago
What about specific lengths of the documents, linked from pages which may be known or be easy to guess (earlier visited, front page or known size)?

will0 6y ago

Correct

PaulKeeble 6y ago

Hence the desire to backdoor all encryption to see the full juicy details. Also the reason DNS over HTTPS exists and is spreading.

schmorptron 6y ago
Does DNS over HTTPS allow the dns provider to see beyond the domain name?
- capableweb 6y ago
  Since DNS (Domain Name System) only deals with the domain names themselves, any DNS resolver (communicated to via HTTP, TCP, UDP, QUIC or what have you) will only resolve a domain name => IP address. Adding a path in there makes no sense.
- dahfizz 6y ago
  They can see the IP address of the machine making the request, if that's what you mean.
- 1vuio0pswjnm7 6y ago
  I am guessing the parent commenter is wondering if the full URL can be deciphered from DoH. In the way DoH is being used in practice, it alllows third parties to collect histories of DNS lookups for myriad users, separated by individual program. In other words, the third party can tell which program was used by a given user to initiate any given DNS lookup. The program often reveals identifying information about the device on which it is installed. Other parties collect user data pertaining to IP address and device. Device fingerprinting, i.e., associating a given user with a given device, is in widespread use purportedly "as a security measure" by "tech" companies like Facebook. Can we be sure the data collected is also not being used for other purposes.1 Combine the DNS program+IP fingerprint with, e.g., a web browser+IP fingerprint and now we can potentially identify a user from DNS lookups. Now consider that Facebook prefixes all external URLs posted to Facebook pages (including external URLs posted in messages) so that any clicks on these URLs are captured, and the HTTP requests to non-Facebook sites are redirected via Facebook servers, again as a purported "security measure". Can we be sure the data collected is not also being used for other purposes.1 Thus Facebook has a history for each user of the URLs in Facebook pages/messages that the user clicks/follows. The problem with DoH in practice is that it is being used almost exclusivelt to provide third party DNS. When we use third party DNS we give anyone (e.g., a "tech" company, a government, etc.) the potential opportunity to obtain from the third party (e.g., through subpoena, acquiring assets through merger, undisclosed data breach, etc.) complete DNS lookup histories for users' individual programs. There is no need to do this because there is no technical need to use third party DNS. And, of course, DoH does not have to be used only by third party DNS providers, so DoH itself is not the problem. 1. If I recall correctly, Facebook in the past has been caught lying about collecting telephone numbers "only" as a security measure.
  - schmorptron 6y ago
    Makes sense, thanks for explaining the bigger picture.

BiteCode_dev 6y ago

Except if you have a root certificate, then you can MITM you heart away. Which govs probably have.

asddubs 6y ago
yes, but it'd be the ISPs storing the internet history
- BiteCode_dev 6y ago
  Backbones have the reputation of being filled with intercepting devices from various entities, including gov's own.
  - asddubs 6y ago
    wouldn't certificate pinning partially prevent this though? i'm not saying this is impossible, but for regular ISP-logged data that some schmuck wants access to, rather than a 3 letter agency or whatever, i doubt this is much of a concern
  - tialaramex 6y ago
    Intercepting at line rate isn't a thing. Recording absolutely happens, but that's why we're talking about End to End Encryption. It would suit snoops very much if what they recorded wasn't 90% unintelligible noise. Right now they get a good idea which sites are visited (because of Server Name Indication) by web browsers, and they get some portion of email (sent in the clear) plus a small fraction of web traffic (HTTP-only) and numerous older unencrypted protocols. In particular they also get most of DNS. DPRIVE work (DNS over TLS, DNS over HTTPS, and eventually DNS over QUIC) reduces that considerably. Future DPRIVE work also includes oblivious transfer (you ask say Google to do a DNS lookup on your behalf, they learn who you are and which DNS server was asked but not what you asked it, the DNS server learns what was asked but not who you are, you get your answer). Or of course, if you're particularly worried, you use Tor and everything on the snoops' screens dissolves into noise.
tialaramex 6y ago

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]

thro1 6y ago

What about specific lengths of the documents, linked from pages which may be known or be easy to guess (earlier visited, front page or known size)?