Hacker News

points by simonjgreen 3 days ago | 0 comments

Noting this article skips over any discussion about why, or potentially (in the eyes of the law at least) legitimate reason an ISP might do this.

Many ISPs in many countries are forced to do this for certain enforcement action that gets put upon them by their respective states for things such as age gating, censorship, monitoring, it varies state by state.

And to be clear this is in no way an endorsement of the practice, and I am confident no ISP WANTS to do this.

I am speaking here as the owner of a UK ISP (who does not currently do this).

[–] mqwdojhv5 2 days ago

If you're a UK ISP owner, you're almost certainly a RIPE NCC member, given the UK is within its regional scope. Therefore, you've probably spoken to other RIPE NCC members via mailing lists or meetings at least once. Since I also represent a provider that is a RIPE NCC member, I can object that not everybody shares the same ideology you noted. There are some providers that actually speak in favor of such over-regulation and censorship. Everybody can read and/or participate in the RIPE Discussion List, though, and you will be amazed by some responses from ISPs that speak in favor of such measures.

But the good news is that at least the majority (for now) is against it.

[–] eqvinox 2 days ago

I speak for another RIPE NCC member when I say that that ideology is limited to a very small minority.

Even outside ideology, plain business sense makes ISPs not want to deal with censorship & co. It's work to do that, hence costs money. But there are also ISPs resisting out of ideology and civic duty.

[–] andreareina 1 day ago

I've lived in countries where the isps voluntarily block sites out of ideology and what they call civic duty.

[–] Geezus_42 3 days ago

I'm pretty confident ISPs do want hijack DNS since they've been doing it for decades in order to push ads to their customers.

[–] Jnr 2 days ago

I hijack DNS in my LAN and block popular DoH servers so they would have to fall back to my DNS. It is a good way to block ads for smart TVs and services that try to use DoH to bypass DNS level ad-blocking.

[–] Melatonic 2 days ago

Do you use a dynamic list of IP addresses to block ?

[–] Geezus_42 2 days ago

...

[–] gruez 3 days ago

Examples?

[–] dspillett 3 days ago

There were certainly a number of ISPs in the UK that tested ways to inject ads in content in the 2000s, there was quite a hoo-hah about it in some forums. That was usually by modifying HTML content in transit via transparent proxies though, not DNS poisoning, but it shows that the intent exist{ed|s}. This is one of the reasons that HTTPS-everywhere is a good idea even if you aren't concerned about snooping in general.

[–] robjan 3 days ago

An example I remember is when Virgin Media replaced any DNS queries returning NXDOMAIN with their own "search page" plastered with ads.

https://shkspr.mobi/blog/2021/03/advanced-network-error-sear...

[–] dreamcompiler 2 days ago

Verisign tried this trick too.

https://dn.org/the-sitefinder-debacle-that-shook-the-interne...

[–] dspillett 3 days ago

Ah, yes, I forgot the NXDOMAIN hijacking.

I was thinking about interfering with existing sites.

[–] DaSHacka 2 days ago

AT&T definitely used to do this ~14 years ago.

[–] wolrah 2 days ago

AT&T still does this, if you're using their (intentionally terrible) standard gateway device the default DNS will return a "search page" instead of NXDOMAIN which predictably has all sorts of negative impacts on non-browser devices but the wastes of oxygen responsible for this don't care as long as they see that delicious ad revenue.

[–] paranoidrobot 3 days ago

Some mobile phone network carriers would inject certain PII (such as your mobile number) into HTTP request headers sent to ad networks. I'm sure they still do it, but by requiring the site to have some extra request to be made instea.

Some carriers also passed info in these headers to be used to make billing calls to the Telco, such as subscribing to premium services with minimal (if any) consent from the user.

I got stung by this years ago. An ad for mobile ringtones showed up on some news site I visited on my phone, I scrolled past without clicking. Next minute I get a text telling me I've subscribed signed up to a (iirc) $25/month ringtone plan and that it'd show up on my phone bill. It took an hour on the phone to my carrier to block the charges and get a refund. The ringtone company kept messaging me for a year that I needed to contact them and "fix" the issue.

[–] dTal 2 days ago

Insanity that people used to pay more for goofy little midi files than they do now for Netflix.

[–] toast0 2 days ago

I dunno what was in a ringtone subscription. I used to work at a ringtone company, and it was $1-$3 per ringtone ($1 for monophonic, $2 for polyphonic and $3 for wav/mp3/whatever; which yeah, is more than a high quality download from iTunes... But $25/month is a ton of money.

Even with free ringtones, I'd send myself about three if I got a new phone. These days, I just keep a copy of the Nokia dubstep ringtone on hand in case I turn the ringer on, but it doesn't happen.

[–] Brian_K_White 2 days ago

As someone who was sometimes using http as a back end transport for "edi" data (hey at the time it was usually ftp in that industry so no worse, but at least http got around nat problems than even pasv didn't), one time in the mid 00's I was in a coffee shop and just speechless flabbergasted outraged to discover the contents of a random web page I happened to know the contents of get some extra html and js injected into it from the isp (the isp not the coffee shop).

"WHO THE F gave them the right to modify the data in my tcp session!!!!".

Spying on it I assumed but modifying one byte of it? A naively written edi that did not expect that would be completely destroyed.

Probably shouldn't have been so stupid for 15 years already by that point. There is no such thing as the right, there is only the ability.

If someone has the ability to do something, they will. Reputation, right & wrong, none of that actually exists or matters.

I didn't track down if the mechanism was based on dns. Could have been but I don't see why it would have had to be. But I was also not attempting to use any non default dns on that device at that time anyway. Obviously since they are trasporting unencrypted data they could modify it any time simply because it's in their hands.

dns would just be one handy low-hanging-fruit way to detour the data to a convenient dedicated purpose server to do the work. But not special or necessary at all. If they want to do the same thing without hijacking dns, they can with almost not even any difference in total effort.

[–] cowlevel 2 days ago

That's one of the reasons we now have HTTPS in most places.

[–] breakwaterlabs 2 days ago

Comcast and/or verizon did it in the 2010s, there was an opt-out in the account dashboard.

It's sort of an absurd question, the prevalence of such things by ISPs was the literal impetus for DoH and DoT.

[–] somehnguy 2 days ago

Last I checked Verizon FIOS still has the opt-out. You have to go into your account preferences and manually disable it because spying is on by default.

This is a good reminder to login and take a look, I wouldn't put it past them to change the setting name and reset the default.

edit: apparently Verizon has zero record of the username I've used for my FIOS account for years (and have saved in my password manager). Their account reset also fails with an error. What a dumpster fire of a company.

[–] Projectiboga 2 days ago

Yep, I've been in Verizon online account purgatory for awhile now. They merged my mom's with mine and nothing works to reset or restore online account access for even bill pay. I have to push their payment out via billpay. I really need to move that phone number over to voip, I kept the classic POTS line as a type 1 diabetic I like that it stayed on during both NYC blackouts in 2003 and 2012. But now I'm in a fiber only building and that redundancy is mostly moot.

[–] flakes 2 days ago

Thank you for this. Just opted out. They certainly made that page as hard as possible to find. Figuring out how to change my routers DNS server was also made needlessly complex.

[–] breakwaterlabs 2 days ago

You should be NATing outbound 53 to a local resolver that upstreams to DoH/DoT. Relying on such an opt-out is rather optimistic.

[–] somehnguy 2 days ago

I don't use their resolver at all. Their opt-out was more of an all-encompassing "let us take whatever data we can manage to get" than DNS specifically.

[–] bradknowles 2 days ago

AT&T has been well-known to do this, since they are violently opposed to net neutrality and they want to force you to only use their approved paid partners for everything. They do this on all their internet services.

Netflix has always listed AT&T as their number one worst offender when it comes to net neutrality.

So, I always run VPNs that I can trust.

[–] Geezus_42 2 days ago

Time Warner Cable used to do it. I haven't checked since they became Spectrum.

[–] pbnjeh 2 days ago

IIRC, early into ATT’s US fiber / gigabit rollout, they wanted an additional $40 / month to forgo collecting and selling your browsing history (DNS queries).

[–] GlickWick 2 days ago

RCN definitely was doing it for a while, so was Comcast. I learned quickly to override this garbage

[–] mafuy 3 days ago

Deutsche Telekom (largest ISP in Germany) did this, not sure if they still do or were ordered to stop by court yet

[–] j45 2 days ago

One massive reason is they redirect requests for videos to closer (or local) caches of videos for netflix (directly from youtube placing it with a large enough ISP), or local caching at the ISP level so less traffic hits the internet.

If you've ever been hit with a "webpage isn't updating" issue when someone else can see it, often it's different DNS servers.

It's best to never use the ISP's DNS servers, regardless of the reason why they might do what they do.

[–] simonjgreen 1 day ago

Streaming provider edge optimisation is usually done using one of BGP or specific streaming provider config, depending on the platform, and is a positive in everyone’s interest

[–] xiconfjs 2 days ago

> It's best to never use the ISP's DNS servers, regardless of the reason why they might do what they do.

But providers overwriting DNS packets regardless – this is the topic of the article :)

P.S.: And yes, there are ways around this like DNSsec etc.

[–] j45 2 days ago

For sure, I read the article.

Introducing what ISPs do with DNS information is helpful to understand how encompassing DNS self-hosting needs to be thought about - DNS requests are important to consider the appropriate encryption for.

From the homelab side, increasingly with the automated attacks on systems, it seems wise to keep all services off the internet directly and put it behind one or more service to keep them safe. From that perspective, setting up something like Tailscale can also help mitigate this kind of issue.

[–] akerl_ 2 days ago

A reminder that the average consumer device doesn't actually validate DNSSEC in its default configuration: it relies on its recursive resolver to set a bit on the response saying "I validated DNSSEC, things are all good". In that configuration, DNSSEC gets you no protection against this.

One of the reasons a variety of providers have been pushing for DoH is because DoH fully closes the risk of ISP MITM without needing individual site operators to do anything. This is why you're seeing folks like Firefox and Chrome enable DoH by default.

[–] cowlevel 2 days ago

DoH is fine if a bit complicated. The problem is who the DoH provider is. Usually it's Cloudflare.

[–] account42 1 day ago

> One of the reasons a variety of providers have been pushing for DoH is because DoH fully closes the risk of ISP MITM without needing individual site operators to do anything.

... by replacing it with Google/Cloudflare MITM with whom the user doesn't even have a business relationship or even shared jurisdiction.

[–] akerl_ 1 day ago

The business relationship most home users have with their ISP explicitly permits that ISP to harvest data from their DNS requests.

[–] account42 1 day ago

I'm glad you know everyones ISP terms of services as well as the local laws that restrict which parts of them are worth a damn.

[–] akerl_ 1 day ago

Do you actually disagree with my claim, or is your concern purely that you don’t like my generalization?

[–] cowlevel 2 days ago

They don't mess with DNS to do that. The video provider points them to the appropriate cache. And it's usually only for video content, not the whole web app.

[–] saidnooneever 3 days ago

this is valid, in NL most DNS is also heavy monitored and intercepted to do blocks if mandated etc. if you want to get around it u can tunnel ur tlsdns thingy to another place and they essentially cannot intercept it, they can still block the IPs it resolves to so its hit and miss depending on how the other end is implemented.

its usually not nefarious, that is just the simpelest (and usually, not always) wrong explanation.

people who think this is not normal probarbly didnt experience what kind of shit u could find on the pre google pre monitored internet. for sure shit u do not want your kids to find. if u dont understand, then likely u dont have kids and very weird fetishes...

[–] witnessme 3 days ago

Why do you assume the others have same ethical compass as you? I hope everyone has the same compass but we have seen again and again trust being broken.

[–] eqvinox 2 days ago

ISPs talk to each other, and people move jobs between them. It's not a uniform community but you certainly get a sense of the general spread of opinions after a while.

There are of course outliers but most people I know in the field care as much about personal rights & freedom as anyone else. Maybe even a small bit more.

[–] gib444 3 days ago

This is a complete non sequitur