Hacker News Reader

Comment by 8organicbits | Hacker News Reader

After we combined the search bar and address bar some queries turn into page loads. So before typing example.zip would perform a search, but now it leaks the terms out to my DNS server, usually in plaintext.

For TLDs that match popular file extensions, this risk is pretty high.

Enabling separate search and URL fields is one of the first things I do when setting up a browser, along with defaulting to DDG search.

View on HN

For these situations, it is useful to type

  ?example.zip

and force the browser to perform a search.

Wow, here I am having used Chrome and Firefox for a decade and a half, and I never knew the "?" trick.

That is super-useful, thanks.

Why not "g example.zip"? It is faster to type, also configurable what to do.

Or ctrl+e, ctrl+v, if your left hand is there.

I don't understand. "?" already works. "g" doesn't do anything, no matter if I follow it with a space or a tab. It's also not faster to type, since "?" doesn't need to be followed by whitespace.

g and space are both home finger keys though. Question mark is not nearly so easy to type. I think "g " might win out.

To get it to work I think you need to configure g as a bookmark shortcut though, so it's not built-in.

In Chrome, you can change the shortcut for each search engine in the settings. The default shortcut for google is "google.com".

"g " does whatever you want, and it has cross browser support. "?" does whatever the browser you use happen to do. Typing-wise you may be right, it depends how do you type, or where are your hands.

Nice. I usually just wrap it in double quotes, but this is slightly easier.

I also like to use ctrl+K to search from the address bar.

It's nice because usually I use ctrl+L to type in the address bar and that's a similar shortcut for times when my search looks like a URL.

Or just type a space in the query (example zip). Search engines know what you mean by that.

Some of the old ccTLDs are offenders too. Too many times have I pasted a shell script's file name into the url bar and it starts loading a search result page.

For more sensitive use cases a better default will disabling search in the "omnibar" altogether like in ungoogled-chromium.

I would say it's the other way around, no? Common file extensions are offenders for copying ccTLDs that already existed.

The .sh ccTLD was registered in 1997[1]. I can't quickly find a reference for when the .sh file extension was first used, but I'd be surprised if it weren't older.

[1]: https://www.iana.org/domains/root/db/sh.html

Yes, I was more talking about the older ccTLDs for more real countries.

Why would it leak terms to the DNS in plaintext? Aren't most DNS servers encrypted between the client and server? I know that's true for DNS over HTTPS but I thought it was generally true as well these days

hahaha no. You have to go out of your way to use DNS-over-HTTPs or DNSSEC.

DNSSEC only provides signatures, it doesn't encrypt your queries.

How much you need to go out if your way depends. Firefox enables DoH by default in some areas, for example. Windows and Chrome will try to use it if your DNS server of choice supports it (i.e. if you've set up 1.1.1.1 or 8.8.8.8).

Android has Private DNS enabled by default, I believe. Some manufacturers may turn it off, I don't remember the setting my devices shipped with.

Oh! I always thought DNSSEC was encrypted, thanks for the correction

I believe DoH rollout is still ongoing. The last I see from Chrome is https://blog.chromium.org/2020/05/a-safer-and-more-private-b... and the last I see from Firefox is https://support.mozilla.org/en-US/kb/firefox-dns-over-https Those changes are driving up the adoption rate, but it's not complete.

I suspect most DNS is still unencrypted at this point, but I can't confirm.

Reply on news.ycombinator.com