Noting this article skips over any discussion about why, or potentially (in the eyes of the law at least) legitimate reason an ISP might do this.
Many ISPs in many countries are forced to do this for certain enforcement action that gets put upon them by their respective states for things such as age gating, censorship, monitoring, it varies state by state.
And to be clear this is in no way an endorsement of the practice, and I am confident no ISP WANTS to do this.
I am speaking here as the owner of a UK ISP (who does not currently do this).
show comments
jwrallie
My workplace is messing with DNS as well, probably to filter specific websites, and I would not mind it since for the context of my usage that is perfectly fair.
But their DNS responses have latency spikes every couple of minutes of 1-2 seconds that was driving me crazy. I simply enabled DNS over HTTPS in Firefox and everything feels so smooth now.
I have no idea how my coworkers seem to be so insensitive to it.
show comments
Terr_
I fear a future where pretty much everything is trying to hack you or doing something which is indistinguishable from the meddling of a hostile actor.
I suppose the answer is politics rather than technology: Get enough people together to make a rule against it, and at least it will become niche.
show comments
daitangio
Telecom Italia locks my DNS server (I cannot change it).
I ended up using PIHole as DHCP, to drive home devices to PIHole, and control my privacy.
The trick is simple: disable DHCP on your router, and activate it on PIHole.
As a bonus, PIHole on my RasperryPI2 is way faster than the little chip on my provider Router, and can be patched automatically with unattended upgrades.
show comments
nunez
AT&T in the US does this. Traditionally they did this so that failed lookups were routed to their search engine, which of course fed users ads.
The point of running a local unbound is indeed to turn on DNSsec validation. After that, it's the domains' fault for not using DNSsec. But at least your own stuff won't be tampered with, because you use DNSsec on your own domains, right? Right?
:-(
Coincidentally, a bunch of free wifi stuff blocks the root key queries unbound does at startup, resulting in nothing working until you get those records in there somehow (e.g. load_cache).
show comments
aand16
How is this not illegal... isn't what the ISP doing "hacking"?
show comments
AceJohnny2
Which ISP was doing this? It's worth calling out the bad actors.
show comments
itopaloglu83
I’m using NextDNS over https and frequently experience connection freezes with both Spectrum and T-Mobile. I don’t know what they’re trying to do, but I’m not happy with the way they’re trying to block basic services.
arcfour
> Although your regular internet traffic is encrypted with TLS, your ISP can see the hostname during the TLS handshake (SNI).
Deutsche Telekom did that too on my DSL line once, took some arguing to them suddenly 'do nothing' but it suddenly 'worked'
tripdout
We need root DNS servers that support DoH/DoT.
show comments
Sha1rholder
Sounds familiar to a Chinese
amstan
Reminds me of the Xfinity "Your personalized WiFi summary" emails. Despite returning their router, using a third party almost-layer-2 modem, my own openwrt router (with its own wifi, thank you very much), their emails seem spooky.
They have a counter of all of my devices, somehow (i mean... i guess their count is wrong, but it's infuriating that they try to keep track).
show comments
ck2
ISP can still see exit IP unless you VPN
Cloudflare Warp is handy, complete tunnel even if not as private as real VPN
since 80% of the web is on cloudflare it accidentally makes it faster anyway
and you don't have to use the cloudflare client, you can use Wireguard
mariofdistrust
my mobile network carrier blocks quad9
show comments
Tepix
Why not start by
1. contact the ISP and ask wtf they are doing
2. switch ISPs
show comments
bradknowles
Another reason to use a VPN you can trust, across your entire network and at all times.
show comments
netsharc
Yum, screenshots of terminal windows, which is just text...
Edit: oh wait, it finally loaded, 3x3MB images of text with scenery in the background!
z3t4
The story ended before it even started... What are the machine with the wrong IP doing? Is it just forwarding the request, or what is happening?
Noting this article skips over any discussion about why, or potentially (in the eyes of the law at least) legitimate reason an ISP might do this.
Many ISPs in many countries are forced to do this for certain enforcement action that gets put upon them by their respective states for things such as age gating, censorship, monitoring, it varies state by state.
And to be clear this is in no way an endorsement of the practice, and I am confident no ISP WANTS to do this.
I am speaking here as the owner of a UK ISP (who does not currently do this).
My workplace is messing with DNS as well, probably to filter specific websites, and I would not mind it since for the context of my usage that is perfectly fair.
But their DNS responses have latency spikes every couple of minutes of 1-2 seconds that was driving me crazy. I simply enabled DNS over HTTPS in Firefox and everything feels so smooth now.
I have no idea how my coworkers seem to be so insensitive to it.
I fear a future where pretty much everything is trying to hack you or doing something which is indistinguishable from the meddling of a hostile actor.
I suppose the answer is politics rather than technology: Get enough people together to make a rule against it, and at least it will become niche.
Telecom Italia locks my DNS server (I cannot change it).
I ended up using PIHole as DHCP, to drive home devices to PIHole, and control my privacy.
The trick is simple: disable DHCP on your router, and activate it on PIHole. As a bonus, PIHole on my RasperryPI2 is way faster than the little chip on my provider Router, and can be patched automatically with unattended upgrades.
AT&T in the US does this. Traditionally they did this so that failed lookups were routed to their search engine, which of course fed users ads.
Hardly a new thing.
Oh and btw, it's not "DNS Hijacking" it's a "Domain Helper", see: https://feross.org/shame-on-you-comcast/
The point of running a local unbound is indeed to turn on DNSsec validation. After that, it's the domains' fault for not using DNSsec. But at least your own stuff won't be tampered with, because you use DNSsec on your own domains, right? Right?
:-(
Coincidentally, a bunch of free wifi stuff blocks the root key queries unbound does at startup, resulting in nothing working until you get those records in there somehow (e.g. load_cache).
How is this not illegal... isn't what the ISP doing "hacking"?
Which ISP was doing this? It's worth calling out the bad actors.
I’m using NextDNS over https and frequently experience connection freezes with both Spectrum and T-Mobile. I don’t know what they’re trying to do, but I’m not happy with the way they’re trying to block basic services.
> Although your regular internet traffic is encrypted with TLS, your ISP can see the hostname during the TLS handshake (SNI).
https://support.mozilla.org/en-US/kb/understand-encrypted-cl... not anymore, with many (not all) sites.
Deutsche Telekom did that too on my DSL line once, took some arguing to them suddenly 'do nothing' but it suddenly 'worked'
We need root DNS servers that support DoH/DoT.
Sounds familiar to a Chinese
Reminds me of the Xfinity "Your personalized WiFi summary" emails. Despite returning their router, using a third party almost-layer-2 modem, my own openwrt router (with its own wifi, thank you very much), their emails seem spooky.
They have a counter of all of my devices, somehow (i mean... i guess their count is wrong, but it's infuriating that they try to keep track).
ISP can still see exit IP unless you VPN
Cloudflare Warp is handy, complete tunnel even if not as private as real VPN
since 80% of the web is on cloudflare it accidentally makes it faster anyway
and you don't have to use the cloudflare client, you can use Wireguard
my mobile network carrier blocks quad9
Why not start by
1. contact the ISP and ask wtf they are doing
2. switch ISPs
Another reason to use a VPN you can trust, across your entire network and at all times.
Yum, screenshots of terminal windows, which is just text...
Edit: oh wait, it finally loaded, 3x3MB images of text with scenery in the background!
The story ended before it even started... What are the machine with the wrong IP doing? Is it just forwarding the request, or what is happening?