519
Some Google Home Speakers downloading massive amounts of data in the background (9to5google.com)
submitted 1 week ago by to c/technology@lemmy.world
99 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 34 points 1 week ago (23 children)

I'm surprised it didn't just have google's DNS hardcoded to bypass your pihole.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 23 child comments
    •
  • [–] 16 points 1 week ago (3 children)

    They do, but thankfully with pfSense you can do DNS overrides with firewall rules to force all network devices to use local DNS, blocking everything else.

    https://dominetec.com.br/en/redirect-all-dns-requests-to-pfsense-router

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 38 points 1 week ago* (11 children)

    That ought to be illegal.

    (No, seriously: disobeying DNS the owner set by DHCP ought to count as "exceeding authorized access" under the CFAA.)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 31 points 1 week ago

    Unfortunately the monkey's paw would curl here and using DNS other than that provided by your ISP would become illegal.

    (I know there's a difference between your devices using their network to access the internet and your "purchased" (licensed software running on) your device using your network to access the internet - but the monkey doesn't care)

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 1 week ago (2 children)

    Counter point on that, that might affect the legality of DNS over HTTPS

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 7 points 1 week ago (1 child)

    No, because the law cares about intent, not technical details. Having my property do DNS over HTTPS because that's what I, the owner, wanted is fine; having my property do DNS over HTTPS because that's what some non-owner entity wanted against my will as the owner is not.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 7 points 1 week ago (6 children)

    RFC 2132 says DHCP option 6 provides "a list of Domain Name System name servers available to the client". That's a MAY use, not a MUST use. You are welcome to block DNS requests to outside servers if you prefer.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 4 points 1 week ago* (5 children)

    RFCs are subordinate to laws. If I, the device and network owner, want my device to use the DNS I set and the device does differently, I want the rogue corp prosecuted and IDGAF what some goddamn RFC says!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 8 points 1 week ago (4 children)

    I don't think you'd be able to find a court receptive to that argument.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 1 week ago (3 children)

    Every court that disagrees is tyrannical and needs to be fucking abolished.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 1 week ago (2 children)

    All of that because you don't understand how tech works?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 1 week ago (1 child)

    I understand perfectly well how tech works. I also understand how property rights work -- or at least, how they're supposed to work.

    The real question is, why does a person asserting their right not to be abused by corporations apparently offend your sensibilities so much that you have to tell bullshit lies in some desperate, pathetic attempt to smear me?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 5 points 1 week ago (4 children)

    I redirect all out going dns requests to my self hosted DNS server.

    Only one I can't block is DoH. DoT is easily blocked and my firewall picks up on it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 1 week ago (3 children)

    Could you block DoH entirely on the network level and cause it to fallback? I guess you'd have to have a list of common DoH IP addresses to block.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 4 points 1 week ago (2 children)

    You have the destination IP to work with, thats it. Otherwise it just looks like any other HTTPS traffic.

    I guess if you uplpaded your own root CA cert tgen you could man-in-the-middle for deeper packet inspection.
    Or, i guess, try using eMudhra's compromised private keys and hope the clients havent been updated yet

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 1 week ago (1 child)

    Right, I guess as more DoH servers become available, it'll be harder to track, but you could intercept and blackhole any HTTPS traffic to one.one.one.one and other popular servers to have them fallback.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •