19 ms·

I always find it odd that we worry so much about how much our browsers are tracking us, but almost nothing about what our ISPs are doing. Every time I've looked

• elliekelly 5y ago
  I only know enough about networking to be dangerous but I am convinced Comcast is doing shady shit with my modem when I change the DNS settings to use non-Comcast servers. Every once in a while I’ll attempt to use Wireshark to try to make sense of what’s happening but I’m pretty clueless and don’t really know what I’m looking at/for. If anyone knows any good resources to learn about the ISP nuts and bolts that make internet magic happen between my modem and everyone else’s servers I would be most appreciative.
  • bewuethr 5y ago
    I found The UNIX and Linux System Administration Handbook (5th Edition), chapters about networking and DNS very instructive, and they list a ton of additional references if you want to dig deeper.
  • gruez 5y ago
    >I am convinced Comcast is doing shady shit with my modem when I change the DNS settings to use non-Comcast servers Well that's vague. What are the symptoms? How would comcast even know that you changed DNS settings? It's possible to infer that from DNS queries to their servers dropping off and traffic to 1.1.1.1 or 8.8.4.4 increasing, but I doubt comcast is competent enough to build that sort of detection system.
    • yaur 5y ago
      On my home network I just run a transparent proxy and direct all outbound traffic bound to port 53 to my local dns server, it’s not hard.
      • xnyan 5y ago
        Interestingly enough, this is almost exactly how ISPs do it when they really want to get your attention. A couple years ago I forgot to update an expired credit card that I used to pay my spectrum cable bill. One morning every DNS request resolved to their "your account is about to be closed due to nonpayment" page. As I also use my own DNS sever I was surprised by this, and sure enough everything going out of my network on 53 was being grabbed up by their CGNAT and sent to their DNS server.
      • addingnumbers 5y ago
        I just block all outbound port 53 traffic, any device or app that doesn't honor my DHCP-provided DNS resolver can suck it. Looking at you, Chromecast that tries 8.8.8.8 40 times an hour even though you know perfectly damn well that 10.10.10.1 is working
        • robocat 5y ago
          The DNS provided by many ISPs is not to be trusted, as per this thread, so how else can your Chromecast act to find a trustworthy DNS? And with newer decides that use DoH, you can no longer prevent devices from contacting their own DNS provider without totally firewalling them (or perhaps using some IP blacklist or whitelist, if available?) https://en.wikipedia.org/wiki/DNS_over_HTTPS https://en.wikipedia.org/wiki/DNS_over_HTTPS
          • addingnumbers 5y ago
            When I said blocking all outbound 53 I meant no exceptions, my local forwarder already uses DoH to an outside resolver. Everything that I don't have complete visibility into the network stack of goes on a VLAN that does not forward traffic to the internet, it advertises a proxy via WPAD and DHCP option 252. I have a whitelist of hostnames that each device is allowed to make CONNECT requests to, so far there is only one. If it's not a plain unencrypted HTTP request to my proxy, or a CONNECT request involving a server/device pair I've decided to trust, it's not going anywhere. This breaks a lot of things that I would just as soon rather do without. I can't change my universal remote hub settings from the vendor portal, boo-hoo. I can't view my cameras from the hardened VLAN or from the internet (unless I VPN in first since the only copy of the recordings is on my local NAS)... good.
    • roelschroeven 5y ago
      I should think they just detect traffic from your IP address on port 53 to any IP address that's not one of their nameservers.
    • xnyan 5y ago
      I agree with you that comcast is incompetent, but everything becomes cheaper and easier over time and network hardware/software products that perform "deep" packet inspection at line rate as well as provide analytics on that returned data are now trivial and pretty much table stakes for Cisco, Juniper, Palo Alto et al. Specifically for detecting if a user is not using their DNS, yes you could correlate a user's http requests (unless you are using ESNI the requested domain is in plaintext by design) with traffic logs on their DNS server and observe that there was no DNS request to the ISP DNS server before a request was made, I don't think that would be necessary. Most users use the ISP default DNS - that's your baseline. If most customers hit your DNS X times per Mb of web traffic, then someone using a custom DNS is going to stand out like a sore thumb. Again, 100% agree that ISPs are not very technically competent (to put it mildly), but as time marches on the ability to both capture and more importantly analyze and report on that data is becoming cheaper and easier. ISPs want to get value from (sell) your data and vendors want to sell ISPs subscriptions to analytics and other platforms that bring them reoccurring revenue. Data from customer DNS is one of the most valuable sources of information an ISP has and I would be surprised if there was not at least an attempt to know how many customers did not use it.
    • elliekelly 5y ago
      Sorry, I didn't get into details because I wasn't intending to ask HN to troubleshoot for me. But, since you asked... I have an "XFi Gateway" combination modem/router provided by Comcast (perhaps my first mistake) so the DNS settings are restricted and cannot be changed. I have the Comcast modem/router set to bridge mode and connected my own router where I can control the DNS settings. My understanding is the DNS settings closer to the client control. So in addition to having set my router to Cloudflare's DNS I also set my devices as well. One day, maybe a year ago or so, I'm on HN and I click an archive.is link, read the article, and go to the discussion thread only to see several comments about how archive.is is blocked by Cloudflare DNS. I checked the DNS settings on my MacBook and router and I was indeed using Cloudflare DNS but for some reason I was able to access the "blocked" address. So I went to the terminal, cleared the cache, and checked nslookup archive.is and it responded correctly. Then I checked a nonsense DNS server: nslookup archive.is 5.9.3.7 or something and it still responded correctly. I tried the same with different websites and got the same result. So I searched "see my DNS server" or something and found a few websites but they all showed Cloudflare. Very odd. When I logged in with my VPN, Mullvad, and changed the DNS settings on the router and my laptop to Mullvad's and repeated the experiment it finally returned NXDOMAIN. Then I disconnected from the VPN but left Mullvad's DNS settings, repeated the experiment again with the same results - even when I was using a totally bogus DNS server it was returning the correct IP address. That's when I installed Wireshark and, lo and behold, I could see the requests that should have been going to 1.1.1.1 or 5.9.3.7 going to 75.75.75.75. Comcast. A call to Comcast was, as expected, a complete waste of time. First they told me it was using their DNS settings because of "their firewall" and then they told me that if I used their built-in router rather than mine + bridge mode I wouldn't have the issue at all. Messing around in Wireshark I eventually determined the issue had something to do with one specific port that was making the requests (I can't recall how but I think because I could see Mullvad VPN was using a different port for DNS?) so I fiddled around and forced (or maybe redirected?) my router to use that port too and that finally worked in avoiding the Comcast servers. But, knowing just enough to be dangerous and not entirely sure what I was doing, I didn't keep the forced port and decided I'd have to get my own modem and use my VPN in the meantime. Before I had gotten around to buying a new modem (this was somewhat early in the pandemic) I saw a post on HN about NextDNS and decided I'd see if I ran into the same issue. I didn't, as far as I could tell at least. When I run Wireshark now (I still use NextDNS) I don't see any contact with 75.75.75.75 or 75.75.76.76. I think this is because NextDNS uses DoH? But who knows. Like I said, I only know enough to be dangerous so perhaps I just had something configured in an odd way that made the Comcast servers step in as a fail-safe and there's a totally innocent explanation. But based on my experience as a Comcast customer I don't really think they're deserving of the benefit of the doubt so I've definitely got a bit of a tin foil hat when it comes to them secretly messing around with my traffic through the leased modem.
  • Proven 5y ago
    in other words, you've clue what's going on with your clients, but it must be Comcast because you're knowledgeable enough to know it's not you. right.
  • jaywalk 5y ago
    Comcast isn't doing anything to your DNS. They're the largest ISP in the country, there'd be a huge uproar if they were doing something like that. There are plenty of experts who are subscribers who'd be able to figure out exactly what's going on.
    • wizzwizz4 5y ago
      There's already a huge uproar around Comcast. But Comcast isn't losing any customers, because they have monopolies.
      • jaywalk 5y ago
        Yeah, uproar around prices and speeds and stuff like that. Nothing like screwing with third-party DNS requests.
        • wizzwizz4 5y ago
          Actually, I have heard that claim more than once, about various providers (up to, and including, “when I changed my DNS settings and the traffic slowed down, the tech got me to change them back, and the traffic sped up”). It's less common, I think, because more people know how to check their speed than change their DNS.
          • jaywalk 5y ago
            The only way I can think of that working is if the provider is intercepting DNS requests for popular speed tests to redirect to an internally-hosted version that would be faster. Otherwise, I can't think of any realistic way DNS settings can affect actual throughput.
            • wizzwizz4 5y ago
              If the ISP is checking for DNS lookup of speed test websites, then allocating higher bandwidth to the connection for a brief period of time? Or, somehow more cynically, the ISP makes money from selling the data collected from DNS, so punishes people who use a different DNS provider. (DNS is plaintext-by-default, so I don't quite see how this would work, but it's possible.) Or perhaps the system uses DNS lookups as a proxy for “is a human browsing the web”; if there aren't enough, it's clearly some kind of automated computer program that doesn't deserve internet access.
  • _jal 5y ago
    The recommendation of _The UNIX and Linux System Administration Handbook_ is a good one. As far as Comcast, I'm stuck with them, too. At least in my experience, they don't monkey with DNS - I run and use my own DNS servers, and have never seen interference. They do run deep packet inspection, and if they detect you, for instance, torrenting commercial media, they'll inject scary messages in port 80 traffic. Given that nearly all web traffic is encrypted now, the main effect of this is to break things like automated `apt-get update`s. One thing you can do to detect transparent DNS hijacking is to ask a nonexistent server a question. Something like `dig @13.14.15.16 news.ycombinator.com` should not give you an answer. If it does, someone's spying on and/or gaslighting you.
    • mikro2nd 5y ago
      Curious: how can they detect whether you're torrenting commercial media if you've enabled Bittorrent protocol encryption? Surely all they can see then is the outer (envelope) of the packets...?
      • Shank 5y ago
        This is a bit of a misconception. Copyright holders have always gone after seeders based on people connecting to swarms, tracker info, and crawling DHT. There’s no reason to use DPI when the list of uploaders is just given out by trackers and DHT for free. See: https://www.usenix.org/legacy/event/woot10/tech/full_papers/Wolchok.pdf https://www.usenix.org/legacy/event/woot10/tech/full_papers/...
        • tgragnato 5y ago
          Exactly Bittorrent protocol encryption is only useful to protest against the use of DPI for bandwidth shaping, it has no influence on privacy. Even with (the weak) encryption, connections to trackers and DHT nodes are easily identified
          • mikro2nd 5y ago
            Thank you for clarifying this!
  • Cicero22 5y ago
    I'm getting this second hand, but I've heard that some isps will redirect dns traffic to their servers based on it going to port 53.
• ForHackernews 5y ago
  Almost everything is SSL-secured now. There's not very much an ISP can snoop on. DNS lookups and IP addresses, I guess.
  • atatatat 5y ago
    the timing and size of everyone's connection to everything is "not very much"?
    • vntok 5y ago
      Indeed it is not. Unless of course you find a way to map the timing and size of a pageload to its potentially sensitive content, in which case do tell.
      • HWR_14 5y ago
        > Unless of course you find a way to map the timing and size of a pageload to its potentially sensitive content, in which case do tell. Wasn't there a HN story about people doing exactly that to figure out what condition people were looking up on WebMD? I don't recall when.
  • yabones 5y ago
    TLSv1.2 traffic contains the hostname of the site you're connecting to, and the list of ciphers. This can be fingerprinted to identify your browser, and the server-side software. [1] TLSv1.3 on the other hand sometimes encrypts the hostname (eSNI) and most of the TLS handshake, so there's much less data to fingerprint. It's not as widely supported, but support is growing... [1] https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967 https://engineering.salesforce.com/tls-fingerprinting-with-j... //Edited to clarify that eSNI isn't default behaviour of 1.3
    • Aissen 5y ago
      ECH (the new name of eSNI) is not even out of draft status yet, so it's misleading to put it on the same level as TLS 1.3 (although you did say it was not as widely supported, it's an understatement).
• yoz-y 5y ago
  With the amount of VPNs popping out it seems that there is more than almost none worrying.
  • pwdisswordfish8 5y ago
    It’s not like VPNs don’t have the exact same problem, though…
    • yoz-y 5y ago
      They do, but at least in theory, their business model is built on not selling the information.
      • ziml77 5y ago
        Given how much ISPs charge I don't think they need to sell info to make money. As garbage as most US ISP options are, I'd trust them long before I trust random VPN services. And I can be reasonably certain that my physical connection goes to Verizon. My virtual connection could be going anywhere and I just have to believe that it's to people who are who they say they are.
      • kube-system 5y ago
        This is exactly the business model for some VPNs, particularly the free or very-cheap variety.
    • gruez 5y ago
      There's still an element of trust involved, but it's better than the status quo of "we'll monitor your internet, take it of leave it" from the ISPs.
      • rovr138 5y ago
        If you turn on your VPN, they can do exactly that. You’re just trading one for the other and that new one might not even have to follow the same laws.
• graderjs 5y ago
  I don't always find it odd, but when I do I find it odd that we worry so much about applications when the entire cell telephony networking layer is completely and unpatchably hacked.
  • wyager 5y ago
    Because you can work around that pretty easily with authenticating encryption. Even if the networking layer weren’t hacked, you should assume it was.
    • qeternity 5y ago
      I have a feeling that you mean "easily" in the same sense the infamous Dropbox demo comment did. EDIT: I wasn't thinking, OP is completely right. Sorry for the snark.
      • tormeh 5y ago
        You can just use whatsapp or whatever. The phone network with SIP/SS7 etc. is hopeless, but you don't have to use it, and most people I know prefer other forms of communication anyway.
        • qeternity 5y ago
          Ah right, sorry understood. You're completely right...I wasn't thinking in terms of IP-based services.
        • graderjs 5y ago
          I mean more like not just the data transfer layer, but the whole cell telephony baseband firmware enables privileged access to your phone. This can be the entry vector for multiple exploits that go way below the application layer. E2E encrypt is meaningless at this level.
          • xoa 5y ago
• mumblemumble 5y ago
  ISPs can see a lot, but it does have limits. As long as we're using SSL (and I suppose, assuming it hasn't been cracked), the ISP really only knows what domains I'm visiting. So they might know that I'm going to WebMD, but they don't necessarily know that I'm reading up on treatment options for nose fungus. They also don't necessarily know exactly which member of my household is going to that website, nor can they link it up with any browsing I do from the coffee shop. Browser-based tracking, on the other hand, can see just about everything, because it's looking at the state of the data after it's been decrypted. And it can, with a reasonable degree of confidence, individually identify people, even when more than one person shares an internet connection, and even when one person uses more than one device or connects to the Internet from more than one location. The higher fidelity of that signal does imply that it's a greater privacy threat.
  • agumonkey 5y ago
    do we need randomized dom nodes ?
    • catillac 5y ago
      No.
    • mumblemumble 5y ago
      I guess I'd have to hear more details to know exactly what you're thinking, but my first instinct is to say that doing something like that would break CSS and accessibility without actually offering any significant impediment to tracking.
      • 0des 5y ago
        The cohort concerned about tracking, one would think, would not be deterred by broken CSS considering they already live in a JS-free world and might be used to some visual-compromise when browsing.
      • agumonkey 5y ago
        I was mostly wondering about privacy up to the dom layer (if that's even possible)
• nextlevelwizard 5y ago
  You can change browsers, but in many places you have no option on ISP. In any case your ISP probably doesn't care as much about selling your information since you are already paying them. Even if they are you can always use VPN to blind them.
• swiley 5y ago
  If it bother's you there's TOR and you can ssh to a vps. Most stuff is encrypted now and there are 3 different DNS encryption standards (one of which is actually good.) IMO: what's left of that issue is getting solved.
• foobiekr 5y ago
  ISPs right now are freaking out that their very expensive solutions like Nokia Deepfield are seeing less and less. Ten years ago you’d be right, but right now that business is dying rapidly.
• slightwinder 5y ago
  ISPs are a blackbox and it's not possible to figure out what they do from user-side. There is also hardly anything you can do about from your side. Using a vpn or similar solutions is only shifting the problem from one provider to another. You can reduce the exposure with some measurments, but they are also expensive and complicated. But for this (and other) reasons companies have started to fix it from the server-side by offering encrypted connections and working on ways to hide your trail from the middleman and their attatched agencies.
  • willis936 5y ago
    Encryption solves security, but doesn't entirely address privacy. An ISP might not know what a user does at pornhub.com, but the ISP does know when and how often the user visits pornhub.com and how much data is exchanged when they do. I'm sure someone would pay for that kind of fingerprinting.
• SamuelAdams 5y ago
  You can encrypt your DNS lookups with several different services.
  • AkshitGarg 5y ago
    That still doesn't hide the IP you are connecting to unless you are on a VPN. They still know that if you are connecting to 209.216.230.240, it _could_ be hacker news. With the widespread use of CDNs, and hosting of multiple services on a single IP, this won't be 100% accurate, but the ISP can still connect the dots I guess
• HWR_14 5y ago
  I'm jealous of the fact that you're not aware that there is a solution for this. What do you think VPNs are selling? It's specifically relief from ISP-level tracking. It's profitable enough that there seem to be ads for it baked into everything. I won't repeat their name here, but have you avoided that "Sponsored by NxxxVPN" all over the Internet/baked into every YouTube video that has sponsored videos?