I can do this in like 5 seconds with my PiHole and not only am I not a network engineer,
Exactly and consider Cloudflare for instance, adding an “if domain block” is easy but then once you’ve thousands of servers running the same piece of software across the globe deploying updates and features becomes way slower and way harder. You’ve to consider tests, regressions, a way to properly store and sincronize the blocklists across nodes etc…
I’m not saying it can be done, because it can. But it will take longer and it will be a problem for someone. Besides you only have that point and click interface in your PiHole that allows you to do it in .02 because someone spend a few hours developing the feature. :)
Yes, it is likely that most providers running custom generic or custom stacks already have the functionally built in and also yes, adding an “if” is easy but then once you’ve thousands of servers running the same piece of software across the globe deploying updates and features becomes way slower and way harder. You’ve to consider tests, regressions, a way to properly store and sincronize the blocklists across nodes etc…
DNS is literally distributed by design
You know you can setup a single instance of PDNS or other resolver and by default they all work in a non-distributed way. You assuming to much, and again while it is likely that most providers running custom stacks already have the functionally built in, it isn’t a guarantee and once you’ve thousands of servers running the same piece of software across the globe deploying updates and features becomes way slower and way harder.
And blocking websites is trivial.
Nothing is trivial at scale. When we’re talking about Quad9, Cloudflare etc. were talking about hundreds of servers across the planet, highly distributed solutions that rely on multicast and other non-trivial techniques. If you’ve to change a system like that to add the ability to block something, trust me, it won’t take a few hours and a LOT of testing will be required before pushing into production.
Making a DNS server not respond to queries for a specific name is trivial for any DNS provider to implemen
It might not be that easy, you’re thinking about one single server running some kind of DNS server you’re familiar with. When we’re talking about Quad9, Cloudflare etc. were talking about hundreds of servers across the planet, highly distributed solutions that rely on multicast and other non-trivial techniques. If you’ve to change a system like that to add the ability to block something, trust me, it won’t take a few hours.
Because:
Quad9 blocks lookups of malicious host names from an up-to-the-minute list of threats. (…) If the system detects that the site you want to reach is known to be infected, you’ll automatically be blocked from entry – keeping your data and computer safe.
If you query their “unsecure” servers, it works:
dig spy.pet "@9.9.9.10" +short
104.26.1.165
172.67.74.73
104.26.0.165
I would never use a provider that has the means in place / likes to filter the DNS - you never know when a govt will ask them to kill a certain domain (even for the “unsecure” servers) or redirect things.
C’mon guys isn’t the “hot take” enough to see this was an half joke? This post from the OP doesn’t seem like what I said at all, if you open the profile you’ll also see that it becomes even more unlikely. But… we should all be aware that situations like those might happen and we might get them here at Lemmy.
First, that would be a very targeted attack and the typical bots won’t have provisions for a forced TOTP on the first login + account deletion after 5 days if no TOTP is setup.
Second you can make things harder, TOTP should be combines with other anti-burteforce measures, restrict the number of registration on an IP address, add delays here and there to make it annoying etc.
Oh well, who doesn’t. This thing with DNS is like the dark secret of the VPN industry because if you think about it all those VPN providers run their own DNS servers and tunnel the DNS traffic via their tunnel and when they don’t you know what happens - if the ISP can still redirect your DNS queries it will still get your traffic.
Either way, this is more of a people problem than a tech problem. You did right by telling her not to use so much social media and share less data, but it’s all about a mindset. It’s about the person that sees a cookie popup and goes in all options and disables everything. That never clicks on an offer for a “free service” and looks for the almost indivisible “skip setup” option.
Besides the convenience aspects I believe there’s something fundamentally wrong with people’s education when it comes to cybersecurity and privacy. People should think of applications, services and websites like strangers on a street: if a random person ask you where you are going will you tell him? No you won’t, then why would you share your location with any app by default? If someone on the street asks your for your address will you give it up? No! Then why would you provide your e-mail address to any website?
For a lot of people, encrypted and signed DNS, has around 75% of the benefits of a VPN without actually using a VPN.
This is often overlooked but the thing is that most ISPs / countries block websites, log user activity and run traffic interception by changing DNS queries to redirect people to a server they control. Just by using a DNS provider that is capable of DoH / DoT you’ll be safer (and yes, enable domain and certificate validations).
Using vpn to avoid Geo blocking and censorship I see as incredibly valid for those that need it.
So, no this might not even be a valid use-case for a lot of people.
For the first issue you may as well add the “yahoo trick” (from before SSL) and pre-hash your user’s password with a random string (provided by the back-end) once the before sending them.
The ideia is that once the person opens the login page your backend will generate a random string and save it for the session, also sends it to the frontend. Then when the user clicks login your frontend does sha512( sha512(password) + random_string ) and sends the results to the backend. Then the backend knows who’s session that is, retrieves the previously generated string from the database and does sha512( stored_password_hash + random_string ). This can be further improved by adding a TTL to the random string, make sure you delete them once the login is successful, force the frontend to refresh the login page on error and issue a new string (just don’t sent a refresh over XHR as it will can be picked by bots / make an attacker life easier.
Note 1: that the frontend first hashes the password and THEN concatenates the random string and hashed again - this has to be made this way because your server should only store hashed versions of your password.
Note 2: consider the implications of just doing SHA512, stronger algos like bcrypt, PBKDF2, and scrypt should always be used, I was just explaining what can be done and the process.
Note 3: consider the usability / accessibility / password managers when creating fields dynamically and with random IDs.
Issue #1 - bots bruteforcing login forms: add a 2FA in form of a TOTP? Simple to setup / create, doesn’t depend on 3rd party services and it is less extreme than a Yubikey while providing the same level of security. If you can enable that for all users you can add it straight to the login form after the password, this way bots won’t even know if a password they try is correct or not, you can refuse them all with a simple “email, password or 2FA code incorrect”.
Issue #2 - bots creating fake accounts: decoy email and password fields on your registration form helps reducing the number of fake accounts. Create your input for email and password with the id / name “email” and “password” and hide them with CSS. Then you create the real inputs with an id like “zipcode” or some other thing that would throw bots off. Server side you set that if the email and password inputs are submitted with anything else than an empty value it should return 401 and/or block the IP address. You can play a lot with this and add checks both client side and server side. To step up the game you can create all those fields dynamically in JS with random IDs based on some algorithm so the backend knows how to identify the real ones.
There are also a few self-hosted captcha options that can be as full featured as google’s or simply add a few font awesome icons and ask people to pick the right one.
Updates:
- As many said messing with the input type, name and ID may break password managers and kill accessibility. Depending in your use-case you may or may not want to use those techniques - note they’re very effective either way;
- You can also leverage 2FA to avoid fake accounts. Require users to setup 2FA when they’re creating an account - bots won’t be able to handle that and accounts won’t get created. You can also delay the process, like allow people to register as usual and on the first login force the 2FA setup, accounts who don’t set it up in, let’s say, 5 days get automatically deleted;
- Use the “yahoo trick” to render bots unable to login.
The question is: when a phone is turned off is it really turned off? The amount of software that needs to be running to manage Bluetooth leds to to believe they simply kill all applications (including the UI) and most services and leave the kernel and a few other things running. I might be wrong, but I would like to see some clarification on that.
Why would you pay them a premium if you’re just going to do it yourself anyways?
Because they can provide other assurances with their service even if I’ve to setup the PGP in my e-mail client. Like knowing the entre thing is actually managed with privacy in mind, like not logging more than they should etc.
I wasn’t even aware of those alleged falsehoods coming from Tutanota…
IMAP server that returns the PGP emails and requires your mail client to handle the decryption? Yes.
Essentially my point.
. However, that goes against a major selling point of the product which is that it manages all that encryption for you (like a password manager). Nobody in their right mind would use that.
Why not, if they actually do everything with open standards and by the book, why can’t they provide IMAP/SMTP access to everyone who wants BUT add the disclaimer that you’ve to use a PGP compatible e-mail client and configure it to deal with the encryption… but they don’t and that is a red flag. Most of their users are tech savvy people wouldn’t oppose setting that up.
There’s not currently a real time way to get that data, but it’s hardly “vendor lockin.”
You got there yourself, that’s one of the problems.
There’s something ironic to me about chewing Proton out for alleged vendor lock in while using iOS / Apple products.
I used iOS as an example, for Android you can get a bridge but that’s just going to be one more thing going for your battery.
Now, consider this, there’s a TON of situation where having a standard SMTP-capable provider is interesting. Maybe you’re running in iOS, maybe you want to have an ESP32 to send a few emails, or some custom software in your computer. All those use cases are impossible or require more coding and more non-standard solutions just because Proton decided to be the first provider ever not to use standard protocols.
What Proton is doing to e-mail is about the same that WhatsApp, Messenger and others did to messaging - instead of just using an open protocol like XMPP they opted for their closed thing in order to lock people into their apps. People in this community seem to be okay with this just because they sell the “privacy” cool-aid.
Yes, but you can reliable use their service with a generic email client, specially on iOS for instance. The bridge doesn’t even provide everything a IMAP server does and there’s isn’t a way to get get calendars and contacts.
That bridge and the fact they don’t use generic IMAP/SMTP/CardDav/CalDav is a form of vendor lock-in. Other providers are also capable of encrypting email with PGP on a open manner and still use those generic protocols.
If the owner of the standard notes will now be a proton, doesn’t that contradict this principle?
There’s no principle… Standard Notes was never about having an open solution or going against the big co. it was about creating something that could be monetized.
Let’s see what Proton does with this, but I personally believe they’ll just integrate it in Proton and further close things even more. The current subscription-based model, docker container and whatnot might disappear as well. Proton is a greedy company that doesn’t like interoperability and likes to add features designed in a way to keep people locked their Web UI and applications.
Standard Notes for self-hosting was already mostly dead due to the obnoxious subscription price, but it is a well designed App with good cross-platform support and I just wish the Joplin guy would take a clue on how to design UIs from them instead of whatever they’re doing now that is ugly and barely usable.
As I said before, you’ve to install this: https://github.com/JurajNyiri/HomeAssistant-Tapo-Control then go to Settings > Devices > Add and search for Tapo.
To be fair what really pissed me about Steam was the push into CS:2 without no regard for anyone (macOS?) or any machine that can’t run it… and a few other similar situations like the SimCity 4 version that is buggy and unreliable unlike the gog one that actually has all the required patches for modern hardware.