4 ms·

"Advanced Tracking and Fingerprinting Protection" Leaks DNS Queries to Apple

47 points by kryptoncalm 3y ago

kryptoncalm 3y ago
I noticed I couldn't reach my home servers which use split dns resolution, and it turns out that's because iOS 17 routes DNS queries via Apple DNS servers when using 'Advanced Tracking and Fingerprinting Protection'. Good to know * when setting up home networks or * you want to use DNS for content filtering or * you prefer your DNS queries to stay private
- rcarmo 3y ago
  I just have Avahi and mDNS active on my machines, and access everything through .local names.
  - desro 3y ago
    I also pretty much gave up on running split DNS for internal stuff at home. avahi & .local just works enough of the time (though definitely not all of the time).
fullspectrumdev 3y ago
Imagine being technically competent enough to know how to configure alternative DNS servers and also stupid enough to bother trying to filter your teenage kids internet.
boesboes 3y ago
As opposed too cloudflare, or google, or my shady provider. Cloudflare does exactly the same but call it filtering. Use a VPN and unbounded orso if you want to keep you queries private..
Obscurity4340 3y ago
I would be interest for Kagi (with their browser Orion) to comment and get their take on this
- fh9302 3y ago
  While Orion also has anti-tracking technology, they do not have this specific feature where a custom DNS server is used to block tracking.
  - Obscurity4340 3y ago
    They say they literally use Advance Tracking Protection, even at the most basic level of Ads and Tracking Protection (which is a mandatory minimum setting)... It Advance Tracking Protection™ an Apple thing or is it a broader more extensible standard?
    - fh9302 3y ago
      Orion uses https://webkit.org/tracking-prevention/ https://webkit.org/tracking-prevention/ and they have their own custom ad and tracking blocker. They do not set a custom DNS server like the linked issue says.
      - Obscurity4340 3y ago
        Gotcha. Excellent work, thank you
bastard_op 3y ago
Being a network and security guy, I've watched firewalls start blocking Apple devices "privacy" proxy as "Proxy Avoidance" category on common firewalls such as Palo Alto and Fortinet, and have often debated whether to allow or filter this. It's mostly noise to me, but I just facepalm with silly apple users falling for these consumer traps. To me, this is just another way Big Tech is trying to siphon everything you do via them for inspection, ie. their marketing or selling of trending what you do regularly, including Apple. People don't know any better, it sounds real good to the normal layperson user as "protection", but really, it's not. When Apple switches this on globally under the guise of user benefit, I just laugh knowing better. Now that Apple sees _everything_ you do, they can go ahead and build that search engine they always wanted too. Think differently said the wolf to the sheep. Funny just a week or so ago Google of all people announced a "Privacy VPN" product. Hah, yeah right Google, you're just mad Apple thought of the racket first and want in on the action since Microsoft already has their Telemetry spyware well established for everything a user does sent to them, and Apple now too with their privacy proxy spyware.
rasz 3y ago
Dont leak DNS queries to Apple, leak them to Cloudflare 1.1.1.1 instead plox! K thx bye.

47 points by kryptoncalm 3y ago

I noticed I couldn't reach my home servers which use split dns resolution, and it turns out that's because iOS 17 routes DNS queries via Apple DNS servers when using 'Advanced Tracking and Fingerprinting Protection'. Good to know * when setting up home networks or * you want to use DNS for content filtering or * you prefer your DNS queries to stay private

rcarmo 3y ago
I just have Avahi and mDNS active on my machines, and access everything through .local names.
- desro 3y ago
  I also pretty much gave up on running split DNS for internal stuff at home. avahi & .local just works enough of the time (though definitely not all of the time).

fullspectrumdev 3y ago

Imagine being technically competent enough to know how to configure alternative DNS servers and also stupid enough to bother trying to filter your teenage kids internet.

boesboes 3y ago

As opposed too cloudflare, or google, or my shady provider. Cloudflare does exactly the same but call it filtering. Use a VPN and unbounded orso if you want to keep you queries private..

Obscurity4340 3y ago

I would be interest for Kagi (with their browser Orion) to comment and get their take on this

fh9302 3y ago
While Orion also has anti-tracking technology, they do not have this specific feature where a custom DNS server is used to block tracking.
- Obscurity4340 3y ago
  They say they literally use Advance Tracking Protection, even at the most basic level of Ads and Tracking Protection (which is a mandatory minimum setting)... It Advance Tracking Protection™ an Apple thing or is it a broader more extensible standard?
  - fh9302 3y ago
    Orion uses https://webkit.org/tracking-prevention/ https://webkit.org/tracking-prevention/ and they have their own custom ad and tracking blocker. They do not set a custom DNS server like the linked issue says.
    - Obscurity4340 3y ago
      Gotcha. Excellent work, thank you

bastard_op 3y ago

Being a network and security guy, I've watched firewalls start blocking Apple devices "privacy" proxy as "Proxy Avoidance" category on common firewalls such as Palo Alto and Fortinet, and have often debated whether to allow or filter this. It's mostly noise to me, but I just facepalm with silly apple users falling for these consumer traps. To me, this is just another way Big Tech is trying to siphon everything you do via them for inspection, ie. their marketing or selling of trending what you do regularly, including Apple. People don't know any better, it sounds real good to the normal layperson user as "protection", but really, it's not. When Apple switches this on globally under the guise of user benefit, I just laugh knowing better. Now that Apple sees _everything_ you do, they can go ahead and build that search engine they always wanted too. Think differently said the wolf to the sheep. Funny just a week or so ago Google of all people announced a "Privacy VPN" product. Hah, yeah right Google, you're just mad Apple thought of the racket first and want in on the action since Microsoft already has their Telemetry spyware well established for everything a user does sent to them, and Apple now too with their privacy proxy spyware.

rasz 3y ago

Dont leak DNS queries to Apple, leak them to Cloudflare 1.1.1.1 instead plox! K thx bye.