News for hackers. Stuff that matters.
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by EvanAnderson on Saturday December 05, 2020 @08:16AM (#25314302)
You're right to be suspicious. The DNS-over-HTTPS model favors those who run the servers (because they get exclusive access to monetizable end user name resolution data) and those who control the resolvers.

You might control the resolver on your personal computer (for now). You probably don't control it on your phone. You most likely won't control it on your embedded devices.

Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by t0astbread on Saturday December 05, 2020 @08:21AM (#25314342)
The root evil here is that you can't change the root certificates in such devices. Even if you controlled its DNS, the device could still just be programmed to fail if it doesn't reach its analytics/ad/whatever server.
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by mstade on Saturday December 05, 2020 @10:40AM (#25315314)
The IKEA Tradfri "smart" lighting gateway will stop responding to commands if it can't phone home to some IKEA server. I noticed this when I changed my router to use NextDNS, which blocked the IKEA lookups. I was ready to return the device as broken until I realized this. I've also had issues with Bang & Olufsen speakers in the past, and inclined to believe it's for the same reasons.

I think it's insane that devices can effectively be bricked if they can't phone home. It's nothing short of waste, and I think environmental legislation should require device manufacturers to supply ways of disabling or overriding these mechanisms such that devices can continue to operate regardless of whether home servers are blocked or otherwise out of reach, e.g. company goes belly up, censorship etc.

Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by benttoothpaste on Saturday December 05, 2020 @10:53AM (#25315409)
> I was ready to return the device as broken until I realized this.

Actually you probably should return such devices as broken.

Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by m463 on Saturday December 05, 2020 @03:54PM (#25318239)
I did just that with a DJI Mavic.

It was kind of hard to send back a really nice device that I had just opened up and was ready to fly.

Thing is, some companies just use it as a way to fire their customers.

Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by CamperBob2 on Saturday December 05, 2020 @08:30PM (#25320115)
I tend to cut DJI a break, because customer (non-)compliance with no-fly zones is a class-1 existential threat to their business selling consumer drones. Pinging DJI servers to check for altitude restrictions at every power-up cycle is intrusive, but I honestly don't see that they have much choice.

However, they are also playing these sorts of games with other types of devices, where no such justifications exist ( https://www.eevblog.com/forum/eevblab/eevblab-83-dji-pocket-... ) That needs to be answered by returning the product as defective.

Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by mstade on Saturday December 05, 2020 @12:17PM (#25316220)
I’m inclined to agree, frankly.
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by gorbypark on Saturday December 05, 2020 @11:05AM (#25315509)
When I installed PiHole a few years back I blocked my tradfri gateway from connecting to Ikea's servers and everything kept working! I wonder if something has changed since then? Ikea devices are kind of nice because they don't actually rely on the internet at all and work completely locally (at least, they did a few years back).
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by mstade on Saturday December 05, 2020 @12:17PM (#25316214)
All I can say is when I had NextDNS configured on my router it blocked requests to some IKEA domain, possibly smetrics.ikea.com from a cursory search through he logs, and my Tradfri gateway would just straight stop responding to anything at that point. I googled around for a while and found other people having issues with DHCP and QoS with Tradfri gateways, so I made sure it had a static IP set as well as all QoS “features” being disabled, but this didn’t help. It would work at first, for some period of time (30 min maybe?) and then stop responding. Once I saw the blocked DNS lookups I disabled NextDNS on the router and flushed any caches on the router, rebooted everything and it’s worked fine now for a good month or so.

I will admit I haven’t done any further investigation, but simply concluded that the gateway at some point started phoning home and if it didn’t receive a response went into some catatonic state. Maybe I’ll dig deeper at some point, time permitting.

Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by GekkePrutser on Saturday December 05, 2020 @08:33AM (#25314413)
The Amazon Fire TV does this already :(

If it doesn't see internet it just blocks itself and goes to a screen "Oops I have no internet".

So you can forget about watching movies from your local server using the VLC app as well. Ridiculous.

Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by moonbug on Saturday December 05, 2020 @09:08AM (#25314647)
makes it utterly useless in an IPv6+NAT64 environment, incidentally.
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by tguvot on Saturday December 05, 2020 @12:36PM (#25316398)
You can go to settings > installed application and lunch VLC or anything else directly from there
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by GekkePrutser on Saturday December 05, 2020 @08:19PM (#25320052)
I'm pretty sure the last time my internet was down I couldn't get into anything but the wifi settings. But I'll try it next time, thanks for the tip!
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by tguvot on Saturday December 05, 2020 @08:57PM (#25320299)
You can go back from network settings back to settings or something like this. just poke around. Discovered it when comcast went down for 4 days and wanted to run kodi on firetv
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by hda2 on Saturday December 05, 2020 @09:27PM (#25320479)
Amazon also tends to hide options until you "try" connecting to your network. My device refused to work without internet until I "tried" connecting to my network using an incorrect password. When I did that and the device failed, an option to skip network setup appeared. In small font at the bottom of the screen, of course.
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by throwaway201103 on Saturday December 05, 2020 @12:18PM (#25316228)
Then you return the device as defective and demand a refund. What you chose to pay for is up to you.
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by sp332 on Saturday December 05, 2020 @11:33AM (#25315755)
I still prefer DoH giving "exclusive" access to resolvers, because the alternative is sending that data in plaintext for everyone along the path to read?
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by folmar on Saturday December 05, 2020 @02:38PM (#25317601)
If your ISP is large enough it is only sent to ISP's name server which probably has everything you need cached, and if it isn't it might blend in with other queries. And your ISP can sniff SNI or guess target domains from target IPs already.
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by judge2020 on Saturday December 05, 2020 @07:40PM (#25319848)
Which is also being worked on via esni (now ECH for encrypted client hello) - https://crbug.com/boringssl/275
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by dralley on Saturday December 05, 2020 @04:39PM (#25318660)
> The DNS-over-HTTPS model favors those who run the servers (because they get exclusive access to monetizable end user name resolution data)

Hold up. You are claiming that the fact that DoH prevents DNS requests from being visible in cleartext network traffic is a bad thing?

...what? In a world where the choice is between one party (the DNS provider) having access to my DNS requests and everyone on the network including my DNS provider having access to my DNS requests, I'll choose "DNS provider having exclusive access" every single time.

Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by dec0dedab0de on Saturday December 05, 2020 @06:12PM (#25319357)
Hold up. You are claiming that the fact that DoH prevents DNS requests from being visible in cleartext network traffic is a bad thing?

It is when its my network. If they cared about people sniffing they would use DNSSEC, but still use the network DNS server. DNS over HTTPS is just a way for shady companies to hide what they're doing.

Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by _-___________-_ on Saturday December 05, 2020 @08:40PM (#25320184)
DNSSEC provides authenticity, not confidentiality.
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by theamk on Sunday December 06, 2020 @03:11PM (#25326253)
Uh, DNSSEC is only signatures, it has no encryption.
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by pickledcods on Saturday December 05, 2020 @11:26AM (#25315703)
I believe that Google pushed DoH to track your cross-site browsing. TLS hides your URL, and blockers can break adsense tracking and/or any other call-home backlinks.

Using DoH, especially one served by an advert company is just signing up to be their open book.

Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by sp332 on Saturday December 05, 2020 @01:56PM (#25317213)
Chrome didn't change the resolver, though. It just enables DoH if it's on a whitelist of known DoH-capable resolvers. It doesn't send your data to Google unless you already used Google's DNS.