FWIW, Chrome does this as well. Its DNS prefetch feature will ignore your local hosts file and configured DNS servers. It creates annoying problems if you have a VPN where some hosts resolve differently than they do publicly.

Granted, in this case if you block Google's DNS servers from routing, Chrome will use your system's name resolution configuration.

TIL! This upsets me more than the Chromecast using Google's DNS.

I barely use Chrome anymore (just for testing really) but the thought that any domain I wish to go to can be overridden by the browser by default - that's scary.

I mean what if Google doesn't like your website's content. They can block it on their DNS server and 99.999% of Chrome users would think something was wrong with your site.

Thank you, I hate it.

I was thinking about buying a better network device for home and have VLANs and ACLs just to take control of my internet again. It is pretty annoying that Google not only trying to track me everywhere but actively overriding system wide settings to be able to get information what sites I am visiting.

You don’t necessarily need a better networking device if your current router is supported by openwrt/lede

I was looking into that yesterday. How can I disable forwarding in Dnsmasq for certain domain names? Maybe I should run a local resolver server myself instead of forwarding the DNS requests to 3rd parties and do it that way with ACLs? Let me know if you have detailed documentation about how to use OpenWRT for these.

In theory, couldn't Firefox's certificate store blacklist the TLS certificate your website uses, with the same user-confusing result?

I mean in theory your web browser doesn't have to respect the address bar, it can do whatever the fuck it wants. The point is what Chrome is already doing is not good behaviour.

Holy synchronicity! I just ran into this this morning when trying to null route a hostname on my co-workers computer and nobody could figure out why chrome could still resolve the IP after we changed the hosts file.

It was disheartening how much time I spent tracking this down. I generally use Firefox, but since the web is bifurcated, I need to be able to access some sites with Chrome.

Funny flashbacks to Google highjacking the .dev tld and forcing it to be https in Chrome.

Actually it was just annoying, not funny.

This is extremely annoying. The VPN will switch DNS servers and macOS and Safari work fine, but Chrome will not find internal servers. I assumed it was just a cache, but this makes sense.

I was astonished at how this was handled on the issue tracker. It was closed as "works as designed" even though the design was the problem.

https://bugs.chromium.org/p/chromium/issues/detail?id=432236

(I'm obviously a bit biased on the matter because it affected me and cost me a silly amount of time to track down.)

They also removed support for mandatory features of HTTPS [0], as defined in RFC 2818. Not that I'm against the change /per se/, but there correct way to go about it is to change the standard.

They also claimed Firefox was doing the same thing, which is false and not really sufficient justification for not supporting things that MUST be supported.

[0] https://bugs.chromium.org/p/chromium/issues/detail?id=700354

Oh, that explains a lot actually. Safari works great with a corporate VPN, Chrome randomly fails to resolve things...

I think the idea is that getting Google to fix this by telling them this is unacceptable is a swifter course of action than hoping Google will notice your individual $35 purchase went elsewhere.

You mean they can't just machine-vision the expression on your face, through your webcam, when you decide against a purchase?

Lol! Unfortunately only on Android 8 devices.

First they came for the appliances I don't want or need, because I don't use appliances I don't want or need.

This has been discussed to death. Slippery slope, etc., etc.

I disagree. People who care about not hitting 8.8.8.8 simply do not own a Chromecast.

This is patently false, as Paul Vixie, who created DNS, clearly owns one.

I own one and have bought three. Cloudflare DNS for me (via a Pihole).

You have to masquerade at your router. Or at the vpn. For example https://ba.net/adblock/vpn/roku-chromecast-fix.html

Thanks.

are you internally masquerading 8.8.8.8 to 1.1.1.1?

I just pointed the Pihole at 1.1.1.1 and added 8.8.8.8 to the block list. The Chromecast works fine with it. Not sure if the Pihole does something clever though? I’m very sure that the Chromecast does but I can see it’s traffic on the Pihole.

Not really, before you could firewall it off from the rest of your network - though now you can just masquerade 8.8.8.8 and 8.8.4.4 to your DNS server of choice

I run an OpenBSD router with PF:

pass in quick on { $lan $wireguard } proto udp to { 8.8.8.8 8.8.4.4 } port 53 rdr-to 192.168.2.1

Locally I run Unbound for caching, local dns zones and ad/malware domain blocking[2]. I have a DNS forwarder in Unbound configured to a local Stubby[1] instance that does dns over tls to Cloudflare.

Having done "big data" contract work for the largest telco in my current country of residence who are some of the worst skilled people I have ever work with, your local ISP is highly likely abusing your DNS history profiling your household for various questionable things just as much as Google. At least with Cloudflare they have a clear privacy policy[3] and I have faith their technical skill to anonymize data and use it can't be as bad as my ISP.

[1] https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+... [2] https://github.com/StevenBlack/hosts [3] https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

Until Google implements DNS over TLS and does cert checking.