4 ms·

Okay, I concede that they have injected cookies into HTTP sites for tracking purposes, and maybe injected ads. But 8 years later the web landscape has changed,

by rjh29 3y ago

Okay, I concede that they have injected cookies into HTTP sites for tracking purposes, and maybe injected ads. But 8 years later the web landscape has changed, everyone uses TLS by default and we have Certificate Transparency, so this sort of thing can't be done anymore. The most they can do now is spy on your DNS and redirect unresolved domains to some ad-filled page.

Reisen 3y ago
It's worth considering that spying on DNS is a tremendous privacy leak, much more than "the most they can do" implies. An aware user might configure their system with DoH and use a privacy respecting DNS provider but for many users on a default home connection the ISP is pretty much able to build up a traffic profile of everything you visit and when you visit it. A VPN provider can close this hole too quite easily. Just from DNS, your ISP can: 1. Infer shopping habbits. 2. Infer which communication services you use (flag users hitting signal.org) 3. Infer when you install, update, or open programs based on telemetry DNS, potentially the versions being run, and how long they run for. 4. Infer when you're most active, infer sleeping habits. 5. Infer probability of health problems if you're hitting more medical sites. 6. Infer political alliance from news sites you visit. And much more. Since US congress dropped the rules preventing ISPs selling this data this might be the most insidious thing your ISP can do today. If you believe that a VPN provider is less likely to spy due to it being the incentive for a paying customer, then a VPN with a no-log DNS option is a huge privacy win. I would argue DoH with NextDNS by itself does more for your privacy than any VPN does with IP masking.
- doublerabbit 3y ago
  How many folk here on HN are using 1.1.1.1 or 8.8.8.8 for DNS? I do not believe that Google/Cloudflare are not doing something with the DNS data. Data is a commodity after-all.
  - PlutoIsAPlanet 3y ago
    It depends on what they're using the data for. Cloudflare if they use their DNS data, is likely to use it to improve their network and security products. Google likely uses it to sell intrusive ads. I know which one I'm more comfortable with.
jsnell 3y ago
So, the original statement that companies like AT&T can trivially get root certificates and MITM TLS traffic is just crazy talk, and you were right to challenge that. > The most they can do now is spy on your DNS and redirect unresolved domains to some ad-filled page. But this isn't really true either. There's a lot more that can be done with a packet stream than spy on DNS, even if the actual payload traffic is encrypted. A combination of DNS, SNI, IPs, and packet sizes and transmission patterns can allow fairly granular classification of traffic by type, and specific connections can then be traffic-shaped, e.g. by explicit throttling to some target bitrate or by applying differential QoS to them.

by rjh29 3y ago

Reisen 3y ago

It's worth considering that spying on DNS is a tremendous privacy leak, much more than "the most they can do" implies. An aware user might configure their system with DoH and use a privacy respecting DNS provider but for many users on a default home connection the ISP is pretty much able to build up a traffic profile of everything you visit and when you visit it. A VPN provider can close this hole too quite easily. Just from DNS, your ISP can: 1. Infer shopping habbits. 2. Infer which communication services you use (flag users hitting signal.org) 3. Infer when you install, update, or open programs based on telemetry DNS, potentially the versions being run, and how long they run for. 4. Infer when you're most active, infer sleeping habits. 5. Infer probability of health problems if you're hitting more medical sites. 6. Infer political alliance from news sites you visit. And much more. Since US congress dropped the rules preventing ISPs selling this data this might be the most insidious thing your ISP can do today. If you believe that a VPN provider is less likely to spy due to it being the incentive for a paying customer, then a VPN with a no-log DNS option is a huge privacy win. I would argue DoH with NextDNS by itself does more for your privacy than any VPN does with IP masking.

doublerabbit 3y ago
How many folk here on HN are using 1.1.1.1 or 8.8.8.8 for DNS? I do not believe that Google/Cloudflare are not doing something with the DNS data. Data is a commodity after-all.
- PlutoIsAPlanet 3y ago
  It depends on what they're using the data for. Cloudflare if they use their DNS data, is likely to use it to improve their network and security products. Google likely uses it to sell intrusive ads. I know which one I'm more comfortable with.

jsnell 3y ago

So, the original statement that companies like AT&T can trivially get root certificates and MITM TLS traffic is just crazy talk, and you were right to challenge that. > The most they can do now is spy on your DNS and redirect unresolved domains to some ad-filled page. But this isn't really true either. There's a lot more that can be done with a packet stream than spy on DNS, even if the actual payload traffic is encrypted. A combination of DNS, SNI, IPs, and packet sizes and transmission patterns can allow fairly granular classification of traffic by type, and specific connections can then be traffic-shaped, e.g. by explicit throttling to some target bitrate or by applying differential QoS to them.