It’s even explained on their site: https://cybersecurity.att.com/blogs/security-essentials/what...
Justification: to keep you safe!1
The most they can do now is spy on your DNS and redirect unresolved domains to some ad-filled page.
> The most they can do now is spy on your DNS and redirect unresolved domains to some ad-filled page.
But this isn't really true either. There's a lot more that can be done with a packet stream than spy on DNS, even if the actual payload traffic is encrypted. A combination of DNS, SNI, IPs, and packet sizes and transmission patterns can allow fairly granular classification of traffic by type, and specific connections can then be traffic-shaped, e.g. by explicit throttling to some target bitrate or by applying differential QoS to them.
Just from DNS, your ISP can:
1. Infer shopping habbits.
2. Infer which communication services you use (flag users hitting signal.org)
3. Infer when you install, update, or open programs based on telemetry DNS, potentially the versions being run, and how long they run for.
4. Infer when you're most active, infer sleeping habits.
5. Infer probability of health problems if you're hitting more medical sites.
6. Infer political alliance from news sites you visit.
And much more.
Since US congress dropped the rules preventing ISPs selling this data this might be the most insidious thing your ISP can do today.
If you believe that a VPN provider is less likely to spy due to it being the incentive for a paying customer, then a VPN with a no-log DNS option is a huge privacy win. I would argue DoH with NextDNS by itself does more for your privacy than any VPN does with IP masking.
I do not believe that Google is not doing something with the DNS data.
Data is a commodity after-all.
Cloudflare if they use their DNS data, is likely to use it to improve their network and security products. Google likely uses it to sell intrusive ads.
I know which one I'm more comfortable with.
Seriously? Just like that? You can pretend that you are a random site.com and get a SSL lock icon in 2023 if you are big enough?
DNS-01 attacks are by default similarly vulnerable to MitM between the issuer and your DNS server, which can be mitigated by setting up DNSSEC.
[0]: https://datatracker.ietf.org/doc/html/rfc8657
[1]: https://community.letsencrypt.org/t/prod-support-for-rfc8657...
You would have to be forced to install an extra root certificate that allows the ISP to MITM your traffic, or have a CA turn rogue and start issuing certificates for other people (e.g. DigiNotar). Both of these attacks would be detected by the Certificate Transparency system, so everyone would know. And for very big domains (google/facebook) browsers pre-bundle the certs they expect to see and refuse to honour any other cert, this is known as static key pinning.
Nation states would be more likely to just tap up Cloudflare to spy on the traffic since a huge % of the internet goes directly to them and is unencrypted at that point.
You can tell it's not true, because if MITM certs signed by trusted root CAs were being issued, they'd appear in Certificate Transparency logs.
Although mis-issued certificates have happened [1] it is very rare, and convincing a root CA to intentionally issue you such a certificate would be very, very far from trivial.
[1] https://www.computerworld.com/article/2714719/rogue-google-s...
It used to be relatively straightforward (you could buy security appliances that had them) but that was quite a long time ago, things have tightened up considerably since then.
So if an ISP wants to do this, the only other option is a mandatory proxy.
At last count, the number I heard of was north of 300. All it takes is one of them being semi shady and being willing to sell or cross sign root certs for someone else, like an ISP. And surprising number of those 300+ are pretty shady.
This is one of the methods used in the Great Firewall of China. Or Russia. Or a number of other countries. And most of those countries have smaller annual budgets than AT&T.
Of course, that's also why a lot of people in China use VPNs.
Just like any sufficiently well funded company or country can go to certain businesses in Israel and get professional zero day/no touch malware that they can drop on any unsuspecting target. And Israel is not the only country selling that kind of technology.
So, I need to protect myself against my ISP.
And their name? AT&T.