Technology

59190 readers

2399 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

ISPs Hijack Cloudflare/Google DNS Requests, Ending Site-Blocking Workarounds. (torrentfreak.com)

submitted 3 months ago by ModerateImprovement@sh.itjust.works to c/technology@lemmy.world

17 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] umami_wasbi@lemmy.ml 3 points 3 months ago (1 children)

They can hijack the DNS answer to the DoH server, which have to happen if the system doesn't know where to look for, and create a DoS. However, that's how far they can go AFAIK. They can't pretend they are the real server, nor downgrade the connection. And, it can be sidesteped by using a direct IP connection.

We use DNS just because lemmy.ml is easier to remember than 54.36.178.108 or 2001:41d0:303:486c::1. DoH can still works by direct IP connection.

[–] Bookmeat@lemmy.world 2 points 3 months ago (1 children)

Aren't they a MITM here? Can't they easily forge certs for the domain name of their fake resolvers since they intercept and resolve your DNS requests?

[–] Max_P@lemmy.max-p.me 6 points 3 months ago (1 children)

They can MitM, but they can't forge certs, they need a trusted CA to issue them, and said CA is unlikely to agree to that as that's a sure way to get their trust removed from browsers and OSes, which would kill off their entire business.

[–] Bookmeat@lemmy.world 1 points 3 months ago (2 children)

Do they though? If you're going to forge one cert why not forge the whole chain?

[–] EncryptKeeper@lemmy.world 4 points 3 months ago* (last edited 3 months ago)

That’s not how certificates work. In fact, the whole point of certificates is so a man in the middle can’t do that.

When you try to visit a website at for example websiteA.com, your browser will look at the cert it receives for the website and make sure it was signed by a trusted CA, which your browser keeps a list of locally. A MiTM could make a fake CA to sign their fake websiteA.com certificate with, but your browser would obviously have no record of that fake CA and wouldn’t trust it.

In order for the attack you’re suggesting to work, the attacker would have to gain access to your host itself and plant their fake CA cert on your computer. Or somehow compromise a real trusted CA which would be… a pretty huge deal.

[–] Max_P@lemmy.max-p.me 4 points 3 months ago (1 children)

You can't forge a root CA, unless you've found a way to break RSA or trick users into installing your malicious CA. The entire chain needs to be valid for browsers to accept it, all the way up to a root that the browser trusts. It's impossible for a CA to sign a cert but also not make it traceable to them.

If RSA gets broken, the entirety of Internet security would fall apart and the entire Internet would explode into complete chaos. Every SSH server would suddenly be broken wide open. All VPNs would be useless. Tor would be useless.

Which is why we have somewhat moved to quantum resistant crypto with elliptic curves to replace RSA, well before we actually manage to break RSA.

[–] Bookmeat@lemmy.world 1 points 3 months ago

Right. I forgot that browsers have the roots built in. Thanks!