Hacker News new | ask | show | jobs
by 1vuio0pswjnm7 2132 days ago
Why does Chrome (Google) need to know whether DNS is being intercepted? What actions does Google take based on the answer?

Note that under this crude test of sending queries for unregistered domains, a user who administers their own DNS could be indistingushiable from "DNS interception" by an ISP or other third party.

I administer my own DNS. I do not use third party DNS. These random queries would just hit my own DNS servers, not the root servers.
2 comments
jve 2132 days ago
From article:

> Users on such networks might be shown the “did you mean” infobar on every single-term search. To work around this, Chromium needs to know if it can trust the network to provide non-intercepted DNS responses.

Don't know if this is the sole reason.

link
1vuio0pswjnm7 2132 days ago
I think you are right.

Reminds me of the story behind "Google Public DNS". Back in 2008/2009, OpenDNS was hijacking "queries" (NXDOMAIN) typed in the address bar to their own search page ("OpenDNS Guide", or some such) on an opendns.com subdomain. In response, Google launched its own open resolver.^1 (OpenDNS was later acquired by Cisco)

1. http://umbrella.cisco.com/blog/opendns-google-dns

link
Taek 2132 days ago
In my mind it's a good enough reason to justify trying to fix it.
link
ogurechny 2132 days ago
No, the point is that in combined address and search bar you don't know whether something is a (local) domain or a search query. You can recognize known TLDs, but that's it.

Guess what Google' priorities were when they approached that problem.

link
johncolanduoni 2132 days ago
Since these are root queries, wouldn’t your DNS server need to hit the root servers to ensure the TLDs don’t exist? Also your own DNS won’t be detected as DNS interception unless you replace NXDOMAINs with fake responses.
link
1vuio0pswjnm7 2132 days ago
If I am using a localhost cache I serve my own custom copy of root.zone. Currently I am not using a cache; I have split DNS with several authoritative servers and I pre-fetch DNS data in bulk from DOT/DOH servers.

If I serve fake responses does that turn off searching via the address bar?

Why doesn't Chromium just have a setting that allows a user to turn off the incessant queries for nonexistant names.

link