Subject: [dns-privacy] "Ars tests Internet surveillance—by spying on an NPR reporter"

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 16 Jun 2014 09:04:19 +0200

Very good paper about an analysis of what is actually leaked when Joe
User is under surveillance from a passive monitor:

http://arstechnica.com/security/2014/06/what-the-nsa-or-anyone-can-learn-about-you-from-internet-traffic/

As the "victim" said, "If you have even the foggiest idea of how
technology works and you think about what you are actually doing
online, you have probably realized some of this could happen to
you. But going through it myself, it was still kind of shocking in the
detail.”

Technically, you will probably learn nothing from it. But I was
surprised by the number of leaks even in encrypted protocols (Google
using the same cookie as a strong identifier on secure and non-secure
connections, Skype using unencrypted connections for some
activity). It is hard to plug all the leaks! DNS is not mentioned,
although it would have been a great example of unencrypted information
leak. Either the Ars reporter was not aware of its potential, ot he
simply got enough data without ressorting on DNS.

---

From: "Guangqing Deng" <[email-masked]>
Date: Tue, 17 Jun 2014 17:18:32 +0800

For DNS not being mentioned in this paper, it may be because there are no very serious privacy leaks about DNS by now.  

Guangqing Deng
CNNIC 
 
From: Stephane Bortzmeyer
Date: 2014-06-16 15:04
To: dns-privacy
Subject: [dns-privacy]"Ars tests Internet surveillance—by spying on an NPR reporter"
Very good paper about an analysis of what is actually leaked when Joe
User is under surveillance from a passive monitor:

 

_______________________________________________
dns-privacy mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dns-privacy

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 17 Jun 2014 12:44:43 +0200

On Tue, Jun 17, 2014 at 05:18:32PM +0800,
 Guangqing Deng <[email-masked]> wrote 
 a message of 89 lines which said:

>  For DNS not being mentioned in this paper, it may be because there
>  are no very serious privacy leaks about DNS by now.  

That's clearly false. See draft-bortzmeyer-dnsop-dns-privacy.