Slashdot Mirror
Alphabet's Intra App Encrypts DNS Queries To Help Users Bypass Online Censorship (zdnet.com)
Catalin Cimpanu, writing for ZDNet: Jigsaw, a technology incubator created by Google and operated as a subsidiary under the Alphabet brand, has released today an Android app named Intra that can encrypt DNS queries as a protection against DNS manipulation at the ISP (internet service provider) level. DNS manipulation is one of the most common forms of online censorship used by oppressive regimes or unscrupulous ISPs, used to block access to news sites, information portals, social media platforms, undesirable software, and more. Intra protects against DNS manipulation by keeping DNS traffic hidden from third-parties with state-level surveillance capabilities, such as internet service providers in countries with autocratic regimes. Reports suggest that Alphabet tested the app with a few dozen political activists in Venezuela before the global roll-out.
Where your DNS queries will be logged by Alphabet and turned over to the proper authorities for consideration, comrade.
Encryption, so all this really does is raise a huge red flag when all those dns queries start reading as gibberish.
The only real way this would work is say encryption+steganography inside of images sent via a regular http/https service that had no reason to be blacklisted by the country's authorities. Even then, as soon as the cat is out of the bag to one official it can be used to track down all those people who were using it there, assuming metadata collection.
at first. Google? Fighting Censorship? Give us a break.
It's not encrypted data sent in regular DNS queries, it's DNS over HTTPS. Like what Firefox started doing.
From a network monitoring point of view, it's regular HTTPS traffic.
TCP/IP and UDP through a DNS tunnel using HTTPS.
Thanks Jigsaw.
MITM all https connections using their own certificates, in that case encrypted dns of this form would not work anyways. Other countries connection reset or redirect to a 'banned in our country' page. This doesn't help censorship in any of the majority countries, and simply pushes them to tighten down, either by limiting the websites themselves, or their connections to the outside world. Or the third possibility, which this helps benefit: selling more Deep Packet Inspection hardware to censoring regimes.
> DoH keeps third-party observers from knowing what websites a user is trying to access.
But isn't this information normally exposed by the TLS SNI extension anyway? You'd probably need to run a VPN to escape this particular risk.
This is stupid, because the second you connect in any way to the target IP address, that's recorded, and it really doesn't matter what your DNS query was.
Even if your target is a computer that hosts multiple domain names, it's decrypted anyhow, by the DNS service.
You don't have any privacy, and Alphabet is named aptly - Alphabet agency, they work for the intelligence agencies, and they have shown, REPEATEDLY, they will gladly engage in censorship.
So it's not enough that Google tracks you via web browsing, Android phones, search queries, gmail, etc. Now they want you to use their DNS so they can track EVERY connection you make over the Internet, regardless of whether it originates from one of their products.
From the article:
"Intra is easy to install and run right away, and comes pre-configured to funnel encrypted DNS queries to Google's DoH-capable DNS servers by default. Users can also switch to Cloudflare's DNS system, or use a custom DoH-capable server as well."
Though only two browsers support this so I don't know why you would use it. Just use a VPN and everything from every app would be hidden.
DNS manipulation is one of the most common forms of online censorship used by oppressive regimes or unscrupulous ISPs, used to block access to news sites, information portals, social media platforms, undesirable software, and more.
It's not just stereotypical "oppressive regimes or unscrupulous ISPs" that do this. It's also commonly used to block sites like thepiratebay.
What a waste...
Why do you need to install squid? Surely you can just use SSH to setup a SOCKS proxy server and then get your web browser to use that with remote DNS. No requirement for squid and everything is tunnelled through SSH. All anyone ever sees looking at the traffic is an SSH session.
Note if you are running Windows 10 April 2018 update or later you will have the appropriate SSH built right into Windows. Everyone else can just install putty.
Of course Linux and Mac users have this built in from the year dot.
I use it all the time for remote admin, better than a VPN because I don't have to set up a VPN server.
Google?
You mean the one's who disappear content they don't like?