Hacker News Reader

Comment by _pdp_ | Hacker News Reader

DNS has always been one of the weakest links in security in my personal experience. From transparent DNS proxing, to DNS hijacking in local network attacks, to complete and quite transparent, often very permanent and undetectable hijacks of consumer-level network equipment, such as routers, through trivial UPNP hacks.

View on HN

The worst side effect of how my ISP implements this is the failure mode for DNS queries. Instead of returning an error code, they actually return a marketing page. That page contains a fake search engine, with results. If you look at the "results", they are all ads for the ISP I'm already on...

In a just America, people who do this would be jailed. To add insult, the majority of my DNS lookups are not for hosts I'll contact via port 80 or 443, so even in some twisted universe where I wanted their ads, their lying doesn't help me.

You could switch to using GoogleDNS or OpenDNS.

If you prefer something more privacy oriented, but possibly not as fast:

  https://servers.opennicproject.org/
  84.200.69.80      # dns.watch
  84.200.70.40      # dns.watch
  37.235.1.174      # freedns.zone
  37.235.1.177      # freedns.zone
  213.73.91.35      # dnscache.berlin.ccc.de
  194.150.168.168   # dns.as250.net; Berlin/Frankfurt
  85.214.20.141     # FoeBud (digitalcourage.de)
  77.109.148.136    # privacyfoundation.ch
  77.109.148.137    # privacyfoundation.ch
  91.239.100.100    # anycast.censurfridns.dk
  89.233.43.71      # ns1.censurfridns.dk
  204.152.184.76    # f.6to4-servers.net, ISC, USA

Edit: I know this won't do anything for ISPs using transparent proxies (from the article: "Some ISP's").

This is just for people with shitty, but not as shitty ISPs. Such as ones that hijack NXDOMAIN: https://en.wikipedia.org/wiki/DNS_hijacking#Manipulation_by_...

Edit2: I couldn't get the test from dnsleaktest.com to work on my computer, but starting at step 3 from [0] seems to work fine (I do already use DNSCrypt with Unbound).

[0] https://www.smartydns.com/support/isp-doing-transparent-dns-...

You should read the article

You can't switch your DNS with transparent proxies. That's the whole point of this post. Even if you change your DNS server, your queries to that server are intercepted by your ISP.

You can pay for a VPN service that does not transparently proxy DNS and tunnel either DNS requests or DNS requests + other data through it to the DNS servers you are actually intending to use.

... which doesn't do anything if DNS is transparently intercepted, as discussed in the article.

I used to wonder where those marketing pages came from, I had assumed it was a rogue browser extension. Now that I think about it... it must've been DNS!

apt-get install unbound && echo nameserver 127.0.0.1 > /etc/resolv.conf

I'm sure you have 500 kB free RAM for a proper resolver that works in the real world, and validates DNSSEC for free. I think most resolving should be done locally nowadays. Latency is mostly a last mile problem.

Wouldn't unbound's requests out to the net get caught by this proxying?

I'd guess not since unbound does its own recursion. DNSSEC doesn't play well with nxdomain trickery so customers gets unhappy and that's something even shady ISPs avoid.

This is something I'm personally very interested in. I'm planning to add one or both of DNS over TLS (https://github.com/bluejekyll/trust-dns/issues/38) or DNSCrypt (https://github.com/bluejekyll/trust-dns/issues/4).

Currently I'm planning to do just DNS over TLS. I'd love feedback on this if people are interested. Both of these address this issue pretty well.

Reply on news.ycombinator.com