Surveillance capitalism will transform the domain name system

I hate to be the bearer of bad news, but this isn't fixable at the DNS level.

I can't remember when it was first researched, but sometime after the birth of Tor, there was increased interest by DoD and others to track connections over an obscured network. The end result was a paper that showed you could identify the sources and destinations of traffic solely by monitoring aggregate traffic over major routes in the network. In essence, for completely encrypted tunnels, you could know exactly what user was using what Tor exit node, assuming you had enough network sensors spread out and enough sample data. There was also the possibility of discovering Tor hidden nodes and what users were using them.

Therefore, regardless of traffic (ex. DNS), if you have the motive to find out who is doing what on the internet, and the capital and access for the network sensors, you can find out who's going where (and even doing what to a certain extent).

The more traffic is encrypted, and the more we push for more privacy and more difficult we make it to monetize our network access, the more reason they have to increase their surveillance, so they can continue to fund all these products and technologies we take for granted.

The cause of an arms race isn't arms. It's the inability to come to terms on an issue. We should be addressing the issue, not ramping up our weapons research. I know this isn't a "sexy solution", but it would definitely free up our time to worry about more important or interesting things.

I have configured local Unbound to use four different open DNS provideds, round-robin, the rationale being each one gets 1/4th of requests. On the other hand, I am sending requests to four providers instead of one, so I have to trust four providers instead of one. What’s better?

This sounds like Tor but for DNS.

so we will make our own DNS system with blackjack and hookers

"One way to make DNS surveillance more difficult is to use a public open DNS server, such as Google's 8.8.8.8..."

Lol

"Knowing the domain names of the websites you visit, or servers that apps access on your behalf, is valuable intelligence. DNS traffic is especially valuable because it reflects what users are doing in real time.

"The names you asked for, and when you ask for them, say an awful lot about you," Huston said in his presentation to the APNIC 52 conference on Wednesday."

This goes on the assumption that a DNS request and HTTP request are coupled in time. They can be decoupled.

Ive been gathering DNS data in bulk for many years. This can be done, e.g., by making UDP/TCP DNS requests to the appropriate authoritative nameservers, making UDP/TCP requests to DNS caches run by third parties (this is what developers seems to prefer; its an inefficient, inconsiderate and braindead method, IMO), extracting the data from public scan datasets available for download, extracting from passive DNS datasets, and most recently making pipelined HTTP requests to DoH servers over a single TCP connection. Its good to have multiple sources of DNS data so one can note any differences.

A surveillance capitalist acting as a passive DNS data or DoH provider could be observing this data gathering but it would be difficult to connect any subsequent HTTP requests, separated in time, days, months or years later, with particular domainnames. With the way CDNs are used today, a large percentage of these domainnames can be requested from the same IP address. Obviously CDNs can have troves of data on users' browsing habits. Perhaps surveillance capitalists approach CDNs to get data about users.

What this article fails to mention is TLS 1.2 leaking domainnames in certificates and SNI extensions, in plaintext. Using third party DNS like Google, or even "Oblivious DNS" wont stop ISPs and others on path from seeing every domainname for every site the customer visits. TLS 1.3 with ESNI will fix this but its still experimental and Cloudflare is the only host I am aware of that supports it. Nevertheless I use it and it works well. For non-Cloudflare sites that require SNI (its quite a small of the sites submitted to HN) I use archive.org. Of course, I am trusting that archive.org isnt engaged in "surveillance capitalism". :) Another trick for Cloudfront hosted sites is one can use the [hash].cloudfront.net domainnname for SNI instead of the "real" domainname. If only mall number of customers are doing this, it makes more work for ISPs or marketers for very small reward, but its a trivial amount of work. Archive.org is the best solution I have so far.

For recreational web use, I have stopped using DNS altogether. I let the forward proxy store the IP address info for each host in memory. Its very fast.

Same problem as TOR; the servers can share information. DNS seems like a good service for homomorphic PIR.

> One way to make DNS surveillance more difficult is to use a public open DNS server, such as Google's 8.8.8.8

I assumed Google ran 8.8.8.8 to collect data for targeted advertising, as one of the major players in surveillance capitalism. Am I mistaken?

Check https://handshake.org/ it has the potential to overthrow DNS and CA while also providing real ownership to names.

Whatever happened with namecoin?

DNS is getting rather long in the tooth and I expect it will be replaced largely RSN. Article assumes we will keep internet address assignment the same as well and not at least move to IPV6 and a less stingy model of effectively static addresses. And the use of VPN today and something rather different tomorrow will likely change this. What happens when you effectively throw an authenticated request into some pool/queue of outstanding request and something else pools it and forwards it then putting response in pool? The assumed direct link of packet IP address to website that is fixed is not likely to last so long imho. Already we are starting to see blockchain mediated DNS like services. I would not be surprised by some kind of NFT registration of sites.