7 ms·
Your intuition is correct. The exception is that DNS will, by-default, be sent to the default router DNS servers, which might monitor/track what you do (most IS
by Shank 5y ago
Your intuition is correct. The exception is that DNS will, by-default, be sent to the default router DNS servers, which might monitor/track what you do (most ISPs run DNS that do this too), and unencrypted HTTP. Unencrypted HTTP is more and more rare as time goes on.
Most of the "shame on public WiFi" comes from VPN companies, which are just trying to fearmonger into a sale. Sure, DNS over HTTPs isn't as widespread as it should be. Sure, some websites aren't encrypted, still. But that doesn't mean that routing all of your insecure traffic to a VPN provider so they can handle it instead is going to increase your security. It just moves the threat model from "your public WiFi network and people on it" to the VPN provider.
If you really want to be safe, you could run your own VPN with algo (https://github.com/trailofbits/algo https://github.com/trailofbits/algo) or manually setup WireGuard and route traffic e.g., back to your home ISP, instead. That's probably my best suggestion, rather than using any of the cliche VPN providers that advertise everywhere.
- Tijdreiziger 5y ago> (most ISPs run DNS that do this too) Is there a source confirming this, or is this just speculation?
- riquito 5y agoDepends on the country, but yes, they do sell that data. E.g. https://arstechnica.com/information-technology/2017/03/how-isps-can-sell-your-web-history-and-how-to-stop-them/ https://arstechnica.com/information-technology/2017/03/how-i...
- Tijdreiziger 5y agoThat article seems to be about the US only. I'd be kind of surprised if it were legal in the EU, though I'm not a lawyer.
- md_ 5y agoDoesn't Android do DoT by default? And iOS does iCloud Private Relay by default?
- kodah 5y ago> Most of the "shame on public WiFi" comes from VPN companies I would call that a half-truth. When I was a kid (in the early 2000's) it was exceptionally easy to crack public wifi networks. A lot of that had to do with misconfiguration and every company scrambling to create public wifi APs. It makes sense that these memories and experiences live on and have become slogans of companies vying for privacy.
- RobertMiller 5y agoFor the few years in college I was living off campus, I never paid for internet at all. Cracking WEP was that easy.
- willcipriano 5y agoI used this to get internet in my first apartment: https://www.whatsmyip.org/lib/fios-wep-key-calculator/ https://www.whatsmyip.org/lib/fios-wep-key-calculator/
- bennathanson 5y agoJust checked my (old, not-used-anymore) Fios network name and there was the original password! Keeping the default password is never a good idea.
- the_snooze 5y agoTLS/HTTPS was also far less common in the early 2000s. It's so prevalent these days that unencrypted wifi connections really don't matter anymore. Computers are talking to remote servers over encrypted connections regardless of the presence or absence of wifi-level encryption.
- acdha 5y agoA related factor was responsibility shirking: some companies tried to claim that the problem for their lack of authentication / encryption was a problem with WiFi. I gave a few talks back then pushing what's now termed zero trust and you could just see the instinctive rejection from the telecom guys who were used to thinking of security as a function of the physical environment. That got criticism at the time, of course, but it really became untenable after so many malware attacks finally got the point through that you could not possibly rely on trusting the network layer.
- sybercecurity 5y agoPlus, the plaintext DNS is rarely altered, with even NXDOMAIN hijacking* being rare these days. Usually it's just collecting for ads or basic malware detection. Or content filtering depending on the provider. *where instead of returning the proper "name not found" DNS error, the recursive server redirects to a site owned by the provider to show ads. Not to be confused with typo squatting where domain speculators register domains showing ads hoping people mistype URLs.
- sayrer 5y agoAnother problem here is the initial HTTP request on the web, if the site isn't in the HSTS preload list. It's easy for this to happen when you click a link, and there are lots of HTTP links generated by protocol-less highlighting too (think foo.com with no prefix). What usually happens these days is a redirect to the HTTPS site, but that first request can still be attacked.
- mcculley 5y agoI find that many sites implement HSTS and the redirect to HTTPS wrong. For example, they will have http://example.com http://example.com redirect to https://www.example.com https://www.example.com instead of first redirecting to https://example.com https://example.com. According to the spec, the browser will not automatically upgrade to HTTPS next time, leaving that first request still open to attack. [Kind of a plug: I made a test for this in my tool, DomainProactive (https://domainproactive.com https://domainproactive.com). I would appreciate feedback on this kind of error.]
- boring_twenties 5y agoIndeed. I now have firefox configured to always try HTTPS first. A warning pops up if it doesn't work, and you have to click through it if you want to proceed. It turns out that a large number of sites not only have http://example.com http://example.com redirect to https://www.example.com https://www.example.com, as you describe, but https://example.com https://example.com doesn't work at all -- resulting in this warning. Clicking through it, you end up at https://www.example.com https://www.example.com.
- LinAGKar 5y agoUnless you enable HTTPS-only mode, or HTTPS Everywhere EASE mode.
- zeepzeep 5y ago> HTTPS-only mode should be the default.
- 5y ago
- goodpoint 5y agoWireGuard is much much more secure than algo. Stay away from IPSEC: it's a very complex protocol and implementations have vulnerabilities as a consequence.
- 7ewis 5y agoalgo offer WireGuard too.
- goodpoint 5y agoYou don't need ansible at all to configure WireGuard
- vetinari 5y agoWhile there are many footguns in the ipsec, if you have set ip up, you can have better performance with ipsec than with wireguard. Many devices include ipsec hardware acceleration, while wireguard ciphers are purely in software. With your typical Ubiquiti or Mikrotik device you can have much more performant connection encrypted with aes+sha than with chacha+poly.
- goodpoint 5y ago> Many devices include ipsec hardware acceleration, This led to serious vulnerabilities and backdoors. > while wireguard ciphers are purely in software This is a feature, not a bug. It's quite difficult to trust commercial routers. > you can have better performance with ipsec than with wireguard Citation needed. Modern CPUs are very cost-efficient at this.
- vetinari 5y ago> This led to serious vulnerabilities and backdoors. This is a matter of implementation; not whether the implementation is in hw or sw. Do you have any examples, where there was a such issue for example in Cavium Octeon (used by Ubiquiti in their USG routers), Qualcomm IPQ-xxx or Marvel Armada SOCs (used by multitude of other vendors)? > This is a feature, not a bug. It's quite difficult to trust commercial routers. It is difficult to trust many routers; even if they are open source, their maintenance might be not exactly transparent. > Citation needed. Modern CPUs are very cost-efficient at this. Typical routers do not have desktop or server class modern CPU. They run on 700-1400 Mhz, and they are busy with things like firewall rules (why do you thing that Fasttrack on Mikrotiks exists?) or, when a beefier CPU is available, with BGP. You can test it for yourself and see, that with hw accelerated AES and SHA you can saturate your available bandwidth and with Wireguard you can saturate only a fraction (unless you have low enough bandwidth...).
- chrisweekly 5y ago"manually setup Wireguard" or take the way easier route and use Tailscale, which is built atop Wireguard, but w/ incredibly simple setup and great UX
- erohead 5y agoWireguard exit routing has resulted in pretty slow VPN-like traffic for me. Dedicated VPN seems like a better option just for secure browsing
- JamesSwift 5y agoOr the equally simple Subspace [1] if you want to stick with self-hosting Wireguard directly. [1] - The community fork at least. Upstream is no longer updated: https://github.com/subspacecommunity/subspace https://github.com/subspacecommunity/subspace
- antihero 5y agoCurrently I use Outline as it’s designed to punch through networks that don’t want to allow VPNs. Is there any reason to switch to algo?
- profmonocle 5y agoWorth noting that the benefits of DNS over TLS/HTTPS (with encrypted SNI) are a bit limited. For cases where a very large number of domains are hosted on a single IP address (or pool of IPs) it's effective at masking your destination from network sniffing. (sites behind Amazon Cloudfront, Cloudflare's free plan, Google App Engine/Cloud Run, old school web hosts, etc.) But there are still tons of sites with their own IPs, or pool of IPs, in which case seeing the destination IP will reveal what domain you're visiting with no need to observe DNS traffic or SNI. i.e. 199.232.125.140 is Reddit and only Reddit. If you visit https://199.232.125.140 https://199.232.125.140 you get an error that the cert is for *.reddit.com. If your goal is to prevent your network operator from seeing even the domains you're accessing, encrypted DNS + encrypted SNI helps but doesn't get you all the way there. A VPN (or Tor) is the only true solution there. However I imagine this is a relatively uncommon need, at least for most people on HN.
- sneak 5y agoI think most TLS today does not use encrypted SNI; the hostname to which you are connecting is still sent in the clear in the large majority of cases even when there are many sites sharing an IP.
- pabs3 5y agoThere was a study that showed that even for the cloud hosted sites, traffic patterns to the IP address can reveal the site (so ESNI/ECH are not foolproof): https://blog.apnic.net/2019/08/23/what-can-you-learn-from-an-ip-address/ https://blog.apnic.net/2019/08/23/what-can-you-learn-from-an... https://news.ycombinator.com/item?id=28103770 https://news.ycombinator.com/item?id=28103770
- zikduruqe 5y ago> WireGuard and route traffic e.g., back to your home 100% of what I have been doing for years.
- heavyset_go 5y agoThere was this vulnerability[1] that allowed attackers to hijack VPN connections and inject their own data into them. It affected all VPNs, including WireGuard. [1] https://news.ycombinator.com/item?id=21712280 https://news.ycombinator.com/item?id=21712280
- soheil 5y agoAnd now you moved your "thread model" to a repo controlled by hundreds of random contributors around the world using exotics languages as Jinja?
- j1elo 5y agoJust curious: Any practical difference between Algo [0] and PiVPN [1] from someone that has tested them? Both seem to support Wireguard. [0]: https://github.com/trailofbits/algo https://github.com/trailofbits/algo [1]: https://pivpn.io/ https://pivpn.io/ I just learned about Algo but have been a long time user of PiVPN (from when they only supported OpenVPN!) on my Raspberry Pi, so in the case that I wanted to reinstall the server, I wonder if the change would bring something new to the table.
- junon 5y ago> be sent to the default router DNS servers Unless you've manually specified them in your network/adapter settings, which means they won't be taken from the DHCP lease.