UK ISP group names Mozilla 'Internet Villain' for supporting 'DNS-over-HTTPS'

What the courts said went like this:

_If_ you have a mechanism that you've put together to block some content (in this case the IWF to block child porn porn) then you must also use this mechanism to block stuff the court wants blocked, in this case everything Hollywood has arbitrarily decided it might be a copyright infringement.

But if you don't have a mechanism to block stuff (which A&A does not because why would you want to spend money on that nonsense?) then obviously the court shouldn't order you to go around making Hollywood's life easier and you can ignore it.

>but nearly all of it is actively filtered via the IWF lists.

You wish. Those lists can only filter specific sites. Not the myriad of child porn that is shared privately. So those list based blocks might in fact protect some users who inadvertently clicked on the wrong link, not knowing where it would lead. But people actually seeking out this content do not care.

It still would be effective to just inform providers and domain registrars[0].

I'm involved in running a small, non-commercial website that offers instant chat rooms without the need to sign up first. At some point the kiddly diddlers found out about it, and used it as basically a bootstrap tool for their activities. We had to play cat and mouse with them for a while, but have improved our system where most such things get automatically detected now or at least marked as suspicious, and the rest is handled by humans. So I am in the unfortunate position to know a thing or two about how these people operate, or at least those who abused our service.

After they initially find each other, either to "trade" one on one or have a group thing going, they use services such a mega.nz[1] and other file hosters with ever new download URLs, or switch over to messenger services such as kik[2], tox[3] and discord[4] in particular, and use email (in particular protonmail these days) as a backup to finding each other again should their other accounts be taken down.

TOR also plays a minor role, of course, but TOR's importance is usually overstated in public discussions about child porn, at least as far as I have seen, and we've rarely encountered people sharing hidden services; it's mostly about using TOR as an anonymizing, free "VPN"[5].

The amount of content (aka child abuse media) they share is tremendous. Them sharing 10s of GBs with a few mega links in one go was common.

[0] We had this discussion in Germany ten years back, when the government proposed such filter lists that the ISPs should then enforce. There was a big opposition to that, as people thought the content should be actually removed and perpetrators prosecuted instead of just "hiding" it, and also establishing such a system would make all kinds of other groups eager to get courts to block other content with it, such as alleged piracy sites. Oh, and of course the lack of accountability and transparency was a big issue too.

Turns out most providers will cooperate in taking down content, and the rest can be "made" to cooperate. The German group AK Zensur (NGO) ran an experiment back in 2009, and contacted providers based on leaked government child porn filter lists (mostly from Scandinavian countries). Most providers responded within 12 hours, removing illegal content, but more often than not they did not actually find child porn whatsoever (which the AK Zensur then verified). Most providers further said they had not been contacted previously (good job, law enforcement).

https://ak-zensur.de/2009/05/loeschen-funktioniert.html (German)

[1] mega.nz's model of plausible deniability means they also cannot identify content because they never see the content unencrypted (not even a hash of the unencrypted content). So they can only take down individual URLS and accounts, but cannot take down exact copies of the same file uploaded to other accounts. This, combined with the ease of making new accounts, each of which gets 50GB storage at first, and the feature to "unshare" (invalidate share links; allows people to share content for sometimes just a few seconds, so other people can import it into their own accounts and download later), makes mega very popular not just with content pirates, but also with people sharing child porn.

[2] Easy to use, and easy to use group chats.

[3] Harder to set up, but it claims to allow quasi anonymous decentralized communication incl file sharing if you put it behind a VPN or TOR. We've encountered "how to setup tox" inforgraphics in the past.

[4] Discord used to be a bit wild west, being a new service which hadn't figured out a lot of things yet (kinda like us at the beginning), and probably underestimated the problem (also kinda like us in the beginning). They also made it pretty hard to actually report abuse (something like, "actually join the server, switch to developer mode, toggle some obscure other preference, copy the internal channel ID and write us an email containing that information"). Tho it seems they are doing a lot, lot better recently in banning "servers" involved in child porn.

[5] Which put us in the unfortunate position to proactively ban TOR users from chatting (they can still read). 99% of TOR traffic was either outright malicious stuff like child porn, or spam. Sorry to the remaining less than 1% who played nice.

That is not correct. The majority of big UK ISPs subscribe to the IWF lists but that's a self-regulatory choice. Many smaller ISPs don't and some even advertise that as an advantage.

A&A:

> We don't provide a filtering service to restrict or limit access to anything on the Internet. When you take services from us you are opting out of any filtering services. The Internet has a lot of good and useful things, but it also has a lot of unpleasant and offensive things. Don't blame us for what you find on the Internet.[...]

> We do not have, in our network, any equipment installed to filter access to any part of the public Internet for our customers as a whole. We aim to give 12 months notice if we ever add any such filtering.

https://www.aa.net.uk/legal/full-terms-services/

In the past, they've spoken out more explicitly against the IWF:

> Not using IWF watch list

> The system deployed now is not effective. It blocks web sites that have been reported, and that is all. It causes side effects (see recent wikipedia incident). It does not block ftp access, email, secure web sites, usenet, irc, peer to peer file sharing, or any tunnelled IP to proxies outside the UK, or indeed any number or simple ways around it. The system does not even try to.[...]

> We feel sure anyone wanting access to child porn will have no trouble using the 95% of ISPs that use the IWF and there is no reason for them to come to us specially.[...]

> At the end of the day, we are no more of a policeman than a power company powering a counterfeit printing press. We provide a utility - we shift IP packets. Using us for anything illegal is a matter for the police to deal with and the criminals concerned, and not for those companies that provide power, water, gas, or internet that happen to allow those activities.

https://web.archive.org/web/20130430120759/https://www.aa.ne...

Having switched to a&a at work recently, they seem to be operating several levels above the more mainstream business DSL providers we've used.

Their control panel is incredibly functional – containing detailed logs of pretty much everything. They also provide a lot of more technical line control options that you'd otherwise have to phone up and convince somebody to get changed.

We haven't had the pleasure of needing to phone them up yet, but from what I've read about them they're a technically very capable team.

They're very good, however do watch out if you're a heavy user, there is no "unlimited" for A&A. I think I have 250GB per month, and there's a scheme to carry over a fraction to discourage you burning everything on the last few days (e.g. if you have 100GB of quota left on a 250GB quota, you start the next month with 300GB) but if you're the sort of person who routinely Torrents a whole TV series to "see if I like it" and then throws it away after one episode because you didn't then you are likely to exhaust the smaller quotas before a month end and A&A's prices start to get steep.

I watch a bunch of Netflix, Youtube, play some online games, never came close to my quota, but I know people using 1TB+ per month on other ISPs so YMMV.

Banning images is a technical problem. Stopping abuse is a social problem.

It's both. Legally, child sexual abuse is considered so vile a practice that it's addressed on both supply side and demand side. Criminalizing possession and handling of such recordings is an attempt at reducing demand. It's not a complete solution, but no real world is really solved by a single thing.

Banning video cameras obviously isn't happening, because they're too useful for other things. But if, hypothetically, a company sold cameras magically limited to only recording children, and such cameras would become popular among child pornographers, then you could expect calls for a legal ban on the grounds that denying a few companies the ability to fleece people through market segmentation doesn't outweigh making life more difficult for the child pornographers.

>>> available online ... still causes them trauma

Thank you. Consider my opinion changed. There is a clear reason to pursue this course of action, even if it is less effective at the root cause.

Personally I think having my prejudices called out is one of the good things about HN.

I still would love to see research on other approaches to tackling the root problem (i.e. the abuse not the images)

(This would presumably included what properly funded social services look like, how cross-department co-operation can be improved, as well as the more "Big Society" suggestions.)

I mean a frustrating part of this is that in almost always some political issue has had a "yes but in Country X they are trying a new system that has had huge success" and slowly a consensus forms around the right way to tackle the problem - but on CSE I have never come across even the right direction of travel.

Finally I hope the threads you mention in your footnote are at an end - there is no willing victim, this is crime and vile crime at that.

Edit: general tidying

> We know from interviewing the children who were abused that they continue to be traumatised by the knowledge that images of them being raped are still available online.

Unfortunately, banning possession/distribution doesn't actually make things unavailable, so it fails to prevent this harm too... Though I suppose the knowledge that people are trying to track down and eliminate such content may help the victims in question.

There are instructions on how to route all operating system DNS requests through DoH here: https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo....

One advantage that DoH has over DNSCurve is that it is much harder to detect or block due to it being encapsulated as https traffic.

The problem isn't the lack of a configuration option, it's when the default is to ignore the one configured in the operating system.

Suppose I have all my devices configured to use my local DNS where I've added names for my other local devices or changed the ones for some names because local devices should use the RFC1918 addresses instead of the internet ones that are routed differently. Suddenly Firefox on every device is using Cloudflare even though nobody ever told it to, and now I have to go touch every device and fix it, including when they're BYOD and the owners want them to "just work" and resolve the names correctly without me having to touch them.

Then the same thing all over again when Chrome does it or any other application.

I would also add the following for Encrypted SNI:

  network.security.esni.enabled = true

Check by running all four tests i.e. Secure DNS, DNSSEC, TLS 1.3 & Encrypted SNI at https://www.cloudflare.com/ssl/encrypted-sni/

On Linux (and probably macos, windows), the kernel doesn't do DNS name resolution. The kernel provides the network stack which does IP, and also TCP and UDP. On Linux you need a tool that can do DNS operations, like NetworkManager, dhcpcd, dhclient, systemd-resolved. You could use selinux to restrict port access.

But how does that tie in with SNI? The specs say that the client sends the intended hostname as part of the TLS handshake, can the ISP sniff the hostname from that handshake?

[edit] as per wikipedia, https://en.wikipedia.org/wiki/Server_Name_Indication:

The desired hostname is not encrypted, so an eavesdropper can see which site is being requested. This helps security companies provide a filtering feature and governments implement censorship. [..] As of mid 2018, an upgrade called Encrypted SNI (ESNI) is being rolled out in an "experimental phase" to address this risk of domain eavesdropping. On March 1, 2019, Daniel Stenberg stated that Mozilla Firefox supports ESNI.

Note, on Firefox if you enable the DoH and the esni mechanisms in about:config. Then that information is encrypted to cloudflare hosted sites. At that point, they can't even use deep packet inspection to identify which sites were visited.

From what I read however, it can't be set to work OOTB for everyone on my network; I'd have to go on every machine and every Internet-connected application to try and change it, hoping all the applications would let me (if I read correctly, Chrome won't?).

This is almost certainly the reason. The first thing I do on any internet connection in the UK is change the DNS out for one that isn't broken...

Which?

Well I doubt you and I are thinking of the same party. TBH almost all of them are garbage.