Hacker News Reader

Comment by judge2020 | Hacker News Reader

judge2020

Spectrum still takes over NXDOMAIN and points it to a Yahoo search page when using their DNS, meaning you now have exposed the browser to all of the oath trackers and pushed it to AdChoices, meaning targeted ads. Not every DNS provider/ISP does this, but when you have one that does, it's probably a net positive to instead beam it to CF which makes guarantees about logging and gets audited[0].

0: https://1.1.1.1/dns/#explanation

View on HN

Does this apply even when you are not using Spectrum's DNS? I.e. do they modify the DNS responses of other DNS providers?

I am not a customer of theirs, nor have I been a customer of an ISP that engages in such practice.

As a EU citizen I am much more concerned about sending my data to a US company which I am not a customer of. ("if it's free, you are the product") At least my ISP is subject to European regulation and I'm paying them to provide the service.

It does only happen with their default DNS servers, and their router interface (at least on newer routers) makes it easy to change DNS, but the users Mozilla is targeting by making it the default likely don't know how to change DNS or why they would want to do so.

I moved recently and let my ex keep my network gear and went with the default Spectrum cable modem and WiFi access point.

The new modems not have user-facing access pages to check connection status and signal levels. Additionally the bundled WiFi access point let you change everything you want except for the DNS settings your routers local DHCP pushes out.

They are actively forcing users to use their DNS unless you buy your own equipment. Its too bad because its actually a pretty decent WiFi router (1+ Gbps AC, 4 gigabit ports, no crashes with excessive usage, etc)

Put your own router behind it if you can't configure it fully. That's what I've done when my ISP wouldn't let me.

>At least my ISP is subject to European regulation

As is CF in the EU, no?

The CLOUD Act is extraterritorial and in direct conflict with GDPR. On a more practical level, how would the EU even know a violation occurred given the systematic practice of adding a gag order to national security letters?

It's pretty unusual for ISPs to do this. But Spectrum is big enough that it's a still a valid concern.

Especially now that more and more people are using mobile networks from people like AT&T and Verizon, and these companies are effectively scum of the earth.

The real solution is to have the OS itself deal with DNS privacy concerns, not the browser. Localhost DNS resolver with DNSSEC enabled that will bypass the default DNS settings and go out to 'trusted' DNS servers when DNSSEC fails. Maybe even use DoH if ISP blocks normal DNS traffic.

Verizon does it.

Hm. I have AT&T and T-mobile, and both of them do it to me?

From my understanding there is no reason a OS level resolver library can't support DoH, I am surpised we haven't seen whatever Linux uses add support for it. Or maybe it did and I missed it.

unbound supports DoH.

Doesn't systemd-resolved support it?

Do they use Google DNS servers by default? Or is that just NTP?

https://github.com/systemd/systemd/blob/master/meson_options...

To add to all the other replies, CenturyLink does this too. This is a major problem with US ISPs.

Frontier (8th-largest US broadband provider) has also done this in the recent past, not sure if they still do.

> It's pretty unusual for ISPs to do this. But Spectrum is big enough that it's a still a valid concern.

At least one major ISP owned by a German company does it. It's not that weird.

I do not think a full local resolver is necessary. E.g. stubby [0] can be set up to use a remote resolver via DNS over TLS (simpler than DoH, less of a hack, all the same crypto guarantees). That remote resolver can be CloudFlare, Quad 9/101, or self-hosted unbound instance. Then only the remote resolver has to worry about caching and DNSSEC, etc.

[0] https://github.com/getdnsapi/stubby/blob/develop/README.md

Just a reminder that DNSSEC doesn't do much of anything to protect Internet privacy --- all it does is sign queries, it doesn't encrypt, and the signatures are with keys effectively escrowed to the owners of the TLDs (most frequently, world governments).

Reply on news.ycombinator.com