Hacker News Reader

Comment by bigfatkitten | Hacker News Reader

My ISP is bound by robust privacy, telecommunications interception and other legislation.

Cloudflare, on the other hand is based in a foreign jurisdiction that offers none of these protections.

> My ISP is bound by robust privacy, telecommunications interception and other legislation.

It really depends on which jurisdiction are you in, unfortunately. US ISPs are selling everything they can hover (including DNS information) to advertisers, and it is impossible to switch to another one unless you're lucky (because the monopoly is essentially maintained).

And until TLS is made secure they'll continue to rape privacy by scraping your https traffic.

So is Cloudflare, which is a US ISP....

Cloudflare is not an ISP. They have other services they sell. Maybe they're selling your data, maybe not. I honestly have not read their agreements and terms, but it's not nearly as obvious that you're the product as something like Google

So this company based in the US which provides internet services is not an internet service provider.

Given that they are funded and run by the same forces american parastical capitalism provides I would trust them as much as I'd trust google or alphabet.

I'll continue to route my DNS to quad-nine over mullvad over my specifically chosen ISP, and everything on my network does that as I can easily intercept and redirect udp/53.

The weak point are treacherous devices which use DoH which is a constant fight to block.

They provide network services on the internet, but unless I'm missing some product they don't list on their website they do not provide actual basic IP internet connectivity for businesses, everything they sell is some service on top of your existing ISP services

And google don't provide actual basic IP internet connectivity for businesses. They are still an american company that provides internet services and uses and sells your data.

Why would cloudflare, built from the same corporate background, be any more trustworthy?

That's just one category of stuff that ISPs do. In the context of "who do I pay to get Internet at home", cloudflare is not an option, but in the context of the internet itself they are one. Hetzner, for example, is an ISP that mainly provides server hosting. There are companies that only provide Internet service at data centers too.

Why not run your own recursive resolver? It's very easy to set up - worried about leaking your IP address to authoritative DNS servers?

Using the definition of "do they provide IP transit to anyone", yes, they offer services which do this, Tunnels is one, there may be others, but this would mean they are technically and legally classified as a service provider (and hence also enjoy Section 230 protection) in that case.

Some may also consider reverse proxying/caching to be providing transit service, but I'm not sure if the majority of people would agree on that.

The most important part of DoH, etc is that it allows you to make a choice. You can choose a vendor in your country. As a Canadian, I might want to use the service offered by my national TLD operator https://www.cira.ca/en/canadian-shield/configure/firefox/

Many ISPs explicitly sell DNS data, and are also advertising vendors.

Cloudflare, on the other hand, doesn’t share or sell data and retains minimal data: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns...

> The most important part of DoH, etc is that it allows you to make a choice.

So does UDP based DNS, and TLS based DNS. It’s all the same in that regard.

With insecure DNS, the choice isn't meaningful since your ISP will see all of the data no matter which DNS server you pick to use. And those kinds of ISPs will probably block DoT because they want to keep seeing it all, but they can't block DoH.

I put my DNS service on a non-standard port. I’m the only one using it so standards be damned. Windows doesn’t allow setting a nonstandard port for DNS, but pretty-much everything else does.

Do ISPs do deep packet inspection to get lookup data? Maybe, but it increases the cost of doing so and makes the business aspect of it less viable. Perhaps a minor win.

Yes, ISPs absolutely do deep packet inspection.

With cleartext DNS, your queries may never reach your chosen server. Plenty of ISPs are configured to just answer any DNS query, regardless of its destination. Using a nonstandard port might help, but you’d be much better off deploying one of the DoH / DoT / DoQ / etc secure protocols.

In addition, your ISP can also extract whichever metadata it wants from your communications, incl. a very likely perfect guess of the hostnames you visit at which times _even if you don't use DNS at all_, just by looking at IP traffic metadata such as addresses and packet sizes.

So you already have to trust your ISP anyway -- but there was no need to trust Cloudflare *. DoH to Cloudflare is almost certainly a net loss in privacy compared to using your ISP's DNS over clear text.

* Right until they became hosters of half of the WWW. So Cloudflare can pretty much also guess your activity even if you don't do DNS with them anyway.

> IP traffic metadata such as addresses and packet sizes.

Even if you use a VPN?

That just shifts the trust from your ISP to your VPN provider. Moreover if you're already using a VPN, your DoH requests to cloudflare is already anonymized.

If you are using WireGuard between endpoints your traffic if opaque, but yeah if/where it exits it becomes (depending on the encapsulated protocol) visible.

> In addition, your ISP can also extract whichever metadata it wants from your communications, incl. a very likely perfect guess of the hostnames you visit at which times _even if you don't use DNS at all_, just by looking at IP traffic metadata such as addresses and packet sizes.

Big CDNs and ECH make that impossible.

Does it, really? Have you seen wireshark output lately? (the GUI can be configured to do reverse lookup on all IP address)

If I check up right now, form the top 10 links in HN right now, it is trivial to distinguish the top-level domain from just the IPv4 or IPv6 address. Heck, even _for this website itself_ the current IPv4 reverse DNS points to ycombinator.com. I don't even need to go into packet size heuristics, or the myriad of ad networks, etc.

Sure there are some instances where you will share the IP of the CDN. This has been seen recently e.g. in the recent article of the "LaLiga" blocks in Spain. But bigger sites cannot afford for this to happen, and even smaller sites tend to have at least one paid IP address for mail (reputation is a bitch, and Cloudflare doesn't have any).

> If I check up right now, form the top 10 links in HN right now, it is trivial to distinguish the top-level domain from just the IPv4 or IPv6 address.

Two of the top 10 links in HN right now (https://news.ycombinator.com/item?id=44215603 and https://news.ycombinator.com/item?id=44212446) are to different subdomains of github.io that resolve to the exact same IP addresses, so reverse DNS doesn't tell you which one is being visited.

And you can't even tell the TLD, because the TLD is "io", but the reverse lookup on the IPs will give you a TLD ending in "com".

> Heck, even _for this website itself_ the current IPv4 reverse DNS points to ycombinator.com.

That's because HN isn't behind the kind of CDN I'm talking about. But a lot are. Is your argument "since your ISP can see some of the sites you're going to, we should remove all protections and let them see all sites you're going to?"

I said top-level domain. Anyway, you have a better estimate, for the types of sites people here would visit? If HN itself isn't an example, then Github subdomains definitely ain't (not even close to the traffic of the main domain).

> I said top-level domain.

"io" and "com" are top-level domains, and in the example I gave, you can't even distinguish between them.

Well, I appreciate the correction: I meant second level (or whatever is most distinguishing for that TLD). However, even if what you say is true, you really cannot disprove my claim with one nitpick, you need to talk majorities. (And, in case it needs to be said: i really don't think the issue here is distinguishing activity to github.io vs github.com)

Okay, how about this then. Here's some of the IP addresses of posts on the HN front page right now:

  104.21.3.245
  104.21.68.247
  104.21.80.31
  104.21.95.131
  104.21.112.1
  104.26.4.133

None of them have reverse DNS records. Can you tell which is which?

So you take literally the worst possible set of IPs (all of them cloudflare), IPv4 only, and yet Copilot (!) is easily able to reverse 50% of them:

  104.21.3.245 -- trebaol.com
  104.21.80.31 -- diwank.space
  104.26.4.133 -- daringfireball.net 
  104.21.112.1 -- simonwillison.net , taras.glek.net

This was literally the worst example you could possibly do. I hope you kept which one was which, I'd like to know if Copilot was right.

In the meanwhile, from the current top #30 articles on HN (also via copilot script, but I removed non-cloudflare IPs):

  ycombinator.com -- no CDN
  letsbend.de -- no CDN
  grepular.com -- no CDN
  xania.org -- cloudfront
  github.io -- no common CDN
  owlposting.com -- AWS, but IPv4 remained static
  netfort.gr.jp -- no CDN
  simonwillison.net -- cloudflare, 104.21.112.1 fixed
  folklore.org -- azure, 13.107.246.1-255 range
  danq.me -- no CDN
  nature.com -- fastly, IPv4 remained static
  daringfireball.net -- cloudflare, 104.26.4.133
  ssp.sh -- no CDN
  trebaol.com -- cloudflare, 104.21.3.245
  glek.net -- cloudflare, 104.21.112.1
  gov.uk -- AWS, but IPV4 remained static
  phys.org -- no CDN
  diwank.space -- cloudflare, 104.21.80.31 
  free.fr -- no CDN   (my French ISP, btw)
  ericgardner.info -- AWS, but IPv4 remained static
  ghuntley.com -- fastly, IPv4 remained static
  paavo.com -- no CDN
  railway.com -- cloudflare, 104.18.24.53
  alloc.dev -- cloudflare , 188.114.96.2

Look at how many of them are self-hosted, have zero CDN, or otherwise return me always the same IP (even when I try from 3 different ISPs) which makes them trivial to reverse address. This is already a pretty huge success rate and all my context is that you browsed HN first (which I know, see first result on the list). Now imagine the tools a ISP will have at its disposal:

- IPv6

- Its Geo region will actually match yours

- Routing tables

- The patience to also include resources fetched from these pages in the analysis (i.e. page X always gets its JS from Y domain which results in a constant Z KB transfer).

- The rest of your browsing activity

- The rest of everyone's browsing activity including most popular _current_ hosts for each hostname.

Do you still claim that it is "impossible" to track your activity because of CDNs? I still bet you your ISP can do it with _100%_ accuracy.

They're not all running single IP ECH yet. I was just making the point that it's not as trivial as a reverse DNS lookup, as you said it was.

It took me the whole of one Copilot conversation to do the entire thing. Most of the top #30 results are in fact one reverse DNS away. The rest is not much more complicated.

They're never going to be "1 IP ECH" . That would be the end of the Internet as we know it.

If it ever happens that the majority of the WWW is 1 CDN, we have a bigger privacy problem than DNS. Much bigger.