Hacker News Reader

Comment by teej | Hacker News Reader

Many folks don’t know or forgot that there are ISPs in the US that do deep packet inspection and inject banner ads into http traffic.

View on HN

Seems like this has to be giving dwindling returns with so much of the web being on https these days.

One thing my current ISP still does is returns an ad-laden search page any time you visit a domain that doesn't resolve.

Super annoying. FYI every ISP I’ve had that does this has some setting buried somewhere that lets you turn this off.

If not that, you can usually bypass this by setting your router (or computer directly) to use 8.8.8.8 (Google dns) or 1.1.1.1 (cloud flare dns) as a resolver.

I’ve only heard of a couple of cases where ISPs sniff all dns and rewrite NXDOMAIN responses, and the answer for those is some kind of unpleasant tunneling.

Does DoH help with this?

Yes, it would mitigate it, until ISPs outright block all known DoH endpoints (probably not feasible though, too easy to fire up another one.)

I wonder if you could block unknown DoH endpoints via traffic analysis. They probably have pretty unique signatures, with every request/response being approximately the same size.

Not that I want to give anyone ideas.

I haven't looked closely at DoH, but based on my knowledge of plugable transports and website fingerprinting attacks, the answer is: probably, but with just a little effort on the client side, detection could be made pretty expensive -- probably expensive enough that ads on unresolved domains wouldn't justify it. Basically, if live classification of network traffic on (obfuscated) metadata were easy, China would have deployed it by now.

I've always wondered how muc CF paid to get 1.1.1.1

For the specific behaviors that GP mentioned, that's true perhaps.

But who is your DNS provider? If it's your ISP then they know who and where you are, when you're home, and what you browse...TLS or not.

Reply on news.ycombinator.com