7 ms·
Funny thing is, it depends on your threat model. Using google.com/XXX for all its services protect the user from being spied by external actors such as ISP bec
by gjadi 4y ago
Funny thing is, it depends on your threat model.
Using google.com/XXX for all its services protect the user from being spied by external actors such as ISP because everything is hidden behind HTTPS.
Whereas, with XXX.google.com, external actors knows that you are using service XXX.
- nottorp 4y agoThe threat here is google.
- gjadi 4y agoIf your threat is google, it would be wise not to use google in the first place. As other mentioned, OSM is an alternative (not equivalent) of Google Maps.
- godzillabrennus 4y agoIf only there was a drop in replacement for Google Workspace… even if you use Fastmail for email you don’t have Google docs anymore and that’s a huge piece…
- nottorp 4y agoThe worse problem is you give Maps location permissions and that can translate now to the 3 billion sites that use Analytics isn't it?
- luckylion 4y agoNo, google-analytics.com is where analytics is being served from and sends tracking-requests to.
- easrng 4y agoIt also connects to https://stats.g.doubleclick.net/j/collect https://stats.g.doubleclick.net/j/collect
- luckylion 4y agoI believe that's only if the GA account is connected to an Ads account (or set up to collect demographics, I think). By itself, GA will only use https://www.google-analytics.com/j/collect https://www.google-analytics.com/j/collect (or /g/collect for GA4).
- ancientworldnow 4y agoOffice365, Zoho, there are many options.
- WhyNotHugo 4y agoYou might want to check out: https://framapad.org/abc/ https://framapad.org/abc/ (this organisation has a lot of FLOSS cloud alternatives to Google products) https://cryptpad.fr/ https://cryptpad.fr/
- savingsPossible 4y agothanks! Unfortunately it seems there is only text editing, not spreadsheets or forms (those I use a lot) But I'll look into it, and probably transfer my docs there It is important to use user respecting software when we can :)
- savingsPossible 4y agosorry, my bad, cryptpad seems to have it all!
- sgammon 4y agodrop in replacement for Google Workspace? has everybody forgotten it was replacing Microsoft?
- samwestdev 4y agoDNS over HTTPS is the solution here.
- netheril96 4y agoSNI is still in the plaintext.
- vetinari 4y agoIt it still an improvement; you need to DPI the traffic then, which is more demanding than just logging 53/udp queries.
- SkyPuncher 4y agoAnyone who is trying to invade your privacy is going to do DPI. My prosumer grade harder does DPI without any issue.
- ddalex 4y agoDoesn't change the fact that the SNI is sent in clear text.
- NavinF 4y agohttps://en.wikipedia.org/wiki/Server_Name_Indication#Encrypted_Client_Hello https://en.wikipedia.org/wiki/Server_Name_Indication#Encrypt...
- deleted 4y ago[deleted]
- Havoc 4y agoThe whole "threat model" thinking is useful for security, but I don't think it translates well to privacy and data sharing consent matters.
- gjadi 4y agoI disagree on the former, but I agree on the later, technology is not a good substitute for consent. Regarding the privacy: If you are using a VPN to protect your privacy, then you are effectively transferring your trust from your ISP to your VPN provider. The VPN provider is your new ISP. So you have to make sure you trust the VPN provider more than your ISP.
- tempera 4y agoIt is a matter of trust, but by choosing a VPN you are not limited in your options by your geographical location as is the case with an ISP. In my town there are 2 ISP I can choose to trust, whereas with VPN I can choose to trust from a much greater selection.
- nvr219 4y agoI don't use VPN when I'm on my home ISP but I do when I'm someplace where I don't control the gateway. My VPN is on a vultr VPS I control (in as much as I can control a VPS), and I do trust vultr (or digitalocean or any of the major VPS providers) more than I trust, let's say, the person who set up the wifi at the holiday inn.
- Lockal 4y agoGoogle could enable ESNI, if they wanted.
- Crosseye_Jack 4y agoI presume they are talking about the DNS "leak". google.com/maps would result in a DNS request for google.com so anyone monitoring DNS would know they are connecting to a google service but wouldn't know which one. maps.google.com would result in a DNS request that show they are connecting to maps.google.com and could presume they want some maps. DoH (and ESNI on the server side) would fix it, but iirc Chrome (the most used browser) doesn't use DoH by default.
- vetinari 4y agoChrome uses DoT, if you have configured one of the well-known resolvers that do support DoT. Otherwise, it respects your local settings.
- Crosseye_Jack 4y agoMy point about Chrome is not that it can’t do DoH but by default it doesn’t so relies on the system settings which for the vast majority of users (not us geeks who explicitly opt in) never change and use ISP supplied values so DNS snooping is still a thing for the majority. Should a browser override system settings? That’s another question, because doing so can impact other things for the avg Joe. For example my mobile providers self serve website plays up when I use custom DNS, free hotspots with captive portals also can be an issue when you override the DNS provided by the access point.
- vetinari 4y agoI understand your point, but anyway, no app, no browser should ever think that "it knows better" and attempt to fix what it considers incorrect. It may think that it protects the user, but in reality, it will break what the user configured. Private DNS zones are common, and if the browser ignores user configured DNS, they will break. And as I wrote elsewhere, just because the machine is configured to use 53/udp for a resolver, it doesn't mean that the resolver is forwarding over 53/udp too. If you want to solve unsafe defaults, this is not the way. Pushing for configuring safe defaults is.
- deleted 4y ago[deleted]
- mrjin 4y agoGoogle poses a larger threat to most people I guess.
- pygy_ 4y agoI’m pretty sure you can still identify specific services from trafic patterns. It is more expensive, but within reach for well funded actors.