4 ms·
After we combined the search bar and address bar some queries turn into page loads. So before typing example.zip would perform a search, but now it leaks the te
by 8organicbits 3y ago
After we combined the search bar and address bar some queries turn into page loads. So before typing example.zip would perform a search, but now it leaks the terms out to my DNS server, usually in plaintext.
For TLDs that match popular file extensions, this risk is pretty high.
Enabling separate search and URL fields is one of the first things I do when setting up a browser, along with defaulting to DDG search.
- rgrmrts 3y agoWhy would it leak terms to the DNS in plaintext? Aren't most DNS servers encrypted between the client and server? I know that's true for DNS over HTTPS but I thought it was generally true as well these days
- packetlost 3y agohahaha no. You have to go out of your way to use DNS-over-HTTPs or DNSSEC.
- jeroenhd 3y agoDNSSEC only provides signatures, it doesn't encrypt your queries. How much you need to go out if your way depends. Firefox enables DoH by default in some areas, for example. Windows and Chrome will try to use it if your DNS server of choice supports it (i.e. if you've set up 1.1.1.1 or 8.8.8.8). Android has Private DNS enabled by default, I believe. Some manufacturers may turn it off, I don't remember the setting my devices shipped with.
- packetlost 3y agoOh! I always thought DNSSEC was encrypted, thanks for the correction
- 8organicbits 3y agoI believe DoH rollout is still ongoing. The last I see from Chrome is https://blog.chromium.org/2020/05/a-safer-and-more-private-browsing-DoH.html https://blog.chromium.org/2020/05/a-safer-and-more-private-b... and the last I see from Firefox is https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https Those changes are driving up the adoption rate, but it's not complete. I suspect most DNS is still unencrypted at this point, but I can't confirm.
- gaudat 3y agoSome of the old ccTLDs are offenders too. Too many times have I pasted a shell script's file name into the url bar and it starts loading a search result page. For more sensitive use cases a better default will disabling search in the "omnibar" altogether like in ungoogled-chromium.
- CydeWeys 3y agoI would say it's the other way around, no? Common file extensions are offenders for copying ccTLDs that already existed.
- jorams 3y agoThe .sh ccTLD was registered in 1997[1]. I can't quickly find a reference for when the .sh file extension was first used, but I'd be surprised if it weren't older. [1]: https://www.iana.org/domains/root/db/sh.html https://www.iana.org/domains/root/db/sh.html
- CydeWeys 3y agoYes, I was more talking about the older ccTLDs for more real countries.
- nequo 3y agoFor these situations, it is useful to type ?example.zip and force the browser to perform a search.
- crazygringo 3y agoWow, here I am having used Chrome and Firefox for a decade and a half, and I never knew the "?" trick. That is super-useful, thanks.
- bmacho 3y agoWhy not "g example.zip"? It is faster to type, also configurable what to do. Or ctrl+e, ctrl+v, if your left hand is there.
- crazygringo 3y agoI don't understand. "?" already works. "g" doesn't do anything, no matter if I follow it with a space or a tab. It's also not faster to type, since "?" doesn't need to be followed by whitespace.
- CydeWeys 3y agog and space are both home finger keys though. Question mark is not nearly so easy to type. I think "g " might win out. To get it to work I think you need to configure g as a bookmark shortcut though, so it's not built-in.
- sp332 3y agoIn Chrome, you can change the shortcut for each search engine in the settings. The default shortcut for google is "google.com".
- bmacho 3y ago"g " does whatever you want, and it has cross browser support. "?" does whatever the browser you use happen to do. Typing-wise you may be right, it depends how do you type, or where are your hands.