When I setup pihole, the google home speakers I had were making dns requests something like 20k times a day. More than pretty much every other device on my network.
Realistically it doesn’t need to request the DNS record every time. It’s probably retrying over and over because you blocked it, otherwise it would just cache the result for a while.
I remember some huge number of blocked requests when I set up my pihole, but eventually they calmed down as devices gave up their retrying.
You have the destination IP to work with, thats it. Otherwise it just looks like any other HTTPS traffic.
I guess if you uplpaded your own root CA cert tgen you could man-in-the-middle for deeper packet inspection.
Or, i guess, try using eMudhra’s compromised private keys and hope the clients havent been updated yet
Right, I guess as more DoH servers become available, it’ll be harder to track, but you could intercept and blackhole any HTTPS traffic to one.one.one.one and other popular servers to have them fallback.
They do, but thankfully with pfSense you can do DNS overrides with firewall rules to force all network devices to use local DNS, blocking everything else.
Unfortunately the monkey’s paw would curl here and using DNS other than that provided by your ISP would become illegal.
(I know there’s a difference between your devices using their network to access the internet and your “purchased” (licensed software running on) your device using your network to access the internet - but the monkey doesn’t care)
RFC 2132 says DHCP option 6 provides “a list of Domain Name System name servers available to the client”. That’s a MAY use, not a MUST use. You are welcome to block DNS requests to outside servers if you prefer.
RFCs are subordinate to laws. If I, the device and network owner, want my device to use the DNS I set and the device does differently, I want the rogue corp prosecuted and IDGAF what some goddamn RFC says!
No, because the law cares about intent, not technical details. Having my property do DNS over HTTPS because that’s what I, the owner, wanted is fine; having my property do DNS over HTTPS because that’s what some non-owner entity wanted against my will as the owner is not.
Similar for my Google nest, it’s the #1 host in number of daily requests in my network, around one every 500ms
Now it’s on it’s own vlan so there’s nothing that they can report on my network, but it’s really concerning that a thermostat calls home this often. It should be enough to do it once an hour to check the outside temperature and only if it’s enabled.v
Whenever a device needs to connect to a web domain, the first thing it has to do is retrieve that domains IP address. Thats a DNS request.
While I don’t remember which domains exactly (this was 5+ years ago when I last checked); just the fact that it’s reaching out to external connections 20k+ times a day is concerning.
For context; my entire network has made 28k dns requests in the last 24hrs. Thats 3 mobile phones that are in use constantly, three PCs, and a handful of IOT devices like smart bulbs/switches.
20k from one device is A LOT.
It’s primarily an idle device that’s awaiting a voice command. Supposedly it’s processing audio locally to find the wake word ‘ok google’ and only then uploading the audio to be processed as a voice command on googles servers. So what’s it uploading/connecting to 20k times a day while it’s suposed to be idle…?
Because its recording every single word you say waiting for the trigger word to send the black van to your house (the trigger word is opposite of “lick dear leaders boots”).
Same experience here. DNS server was omething like goooooooogle.com for me.
Blocking them made the devices malfunction, I believe the speakers werent fully aware of each other anymore, so speaker groups got messed up in all sorts of ways.
When I setup pihole, the google home speakers I had were making dns requests something like 20k times a day. More than pretty much every other device on my network.
I removed them all after that.
Realistically it doesn’t need to request the DNS record every time. It’s probably retrying over and over because you blocked it, otherwise it would just cache the result for a while.
I remember some huge number of blocked requests when I set up my pihole, but eventually they calmed down as devices gave up their retrying.
I’m surprised it didn’t just have google’s DNS hardcoded to bypass your pihole.
Chromecasts do that. I had to intercept port 53 on the router to fix it.
I redirect all out going dns requests to my self hosted DNS server.
Only one I can’t block is DoH. DoT is easily blocked and my firewall picks up on it.
Could you block DoH entirely on the network level and cause it to fallback? I guess you’d have to have a list of common DoH IP addresses to block.
You have the destination IP to work with, thats it. Otherwise it just looks like any other HTTPS traffic.
I guess if you uplpaded your own root CA cert tgen you could man-in-the-middle for deeper packet inspection.
Or, i guess, try using eMudhra’s compromised private keys and hope the clients havent been updated yet
Right, I guess as more DoH servers become available, it’ll be harder to track, but you could intercept and blackhole any HTTPS traffic to
one.one.one.oneand other popular servers to have them fallback.They do, but thankfully with pfSense you can do DNS overrides with firewall rules to force all network devices to use local DNS, blocking everything else.
https://dominetec.com.br/en/redirect-all-dns-requests-to-pfsense-router
next move is theirs… knight to queen’s dns-over-https
That’ll get blocked too.
That ought to be illegal.
(No, seriously: disobeying DNS the owner set by DHCP ought to count as “exceeding authorized access” under the CFAA.)
Unfortunately the monkey’s paw would curl here and using DNS other than that provided by your ISP would become illegal.
(I know there’s a difference between your devices using their network to access the internet and your “purchased” (licensed software running on) your device using your network to access the internet - but the monkey doesn’t care)
RFC 2132 says DHCP option 6 provides “a list of Domain Name System name servers available to the client”. That’s a MAY use, not a MUST use. You are welcome to block DNS requests to outside servers if you prefer.
RFCs are subordinate to laws. If I, the device and network owner, want my device to use the DNS I set and the device does differently, I want the rogue corp prosecuted and IDGAF what some goddamn RFC says!
I don’t think you’d be able to find a court receptive to that argument.
Every court that disagrees is tyrannical and needs to be fucking abolished.
Counter point on that, that might affect the legality of DNS over HTTPS
No, because the law cares about intent, not technical details. Having my property do DNS over HTTPS because that’s what I, the owner, wanted is fine; having my property do DNS over HTTPS because that’s what some non-owner entity wanted against my will as the owner is not.
Rather: they are free to do protocol negotiation with the DNS server I supply. If it speaks DoH, go for it.
Same for Roku, and worse now that they were bought out. Sorry grandma, the Roku is getting cut off. Lol
Similar for my Google nest, it’s the #1 host in number of daily requests in my network, around one every 500ms
Now it’s on it’s own vlan so there’s nothing that they can report on my network, but it’s really concerning that a thermostat calls home this often. It should be enough to do it once an hour to check the outside temperature and only if it’s enabled.v
What does that mean exactly? Like it’s trying to connect to where? Why?
Whenever a device needs to connect to a web domain, the first thing it has to do is retrieve that domains IP address. Thats a DNS request.
While I don’t remember which domains exactly (this was 5+ years ago when I last checked); just the fact that it’s reaching out to external connections 20k+ times a day is concerning.
For context; my entire network has made 28k dns requests in the last 24hrs. Thats 3 mobile phones that are in use constantly, three PCs, and a handful of IOT devices like smart bulbs/switches.
20k from one device is A LOT.
It’s primarily an idle device that’s awaiting a voice command. Supposedly it’s processing audio locally to find the wake word ‘ok google’ and only then uploading the audio to be processed as a voice command on googles servers. So what’s it uploading/connecting to 20k times a day while it’s suposed to be idle…?
I don’t know exactly. That’s the problem.
Because its recording every single word you say waiting for the trigger word to send the black van to your house (the trigger word is opposite of “lick dear leaders boots”).
All of these devices are spyware.
Same experience here. DNS server was omething like goooooooogle.com for me.
Blocking them made the devices malfunction, I believe the speakers werent fully aware of each other anymore, so speaker groups got messed up in all sorts of ways.
I use Bluesound speakers and modules now.
To be fair, IoT devices should be making exactly zero DNS requests, unless maybe you set up a proper domain name for your Home Assistant server.