Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There is this site un**-us.com which supposedly allows you to bypass ISP rules such as content restriction on a particular area. Now , it is well known that routing your traffic through a web proxy yields the same result. But, here this site uses DNS server to unblock you. I do not understand how that is possible. How can having a different DNS server exhibit the same behavior of that of a proxy IP ?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

Some very short sighted content-filtering systems rely upon DNS. The advantage is that its very cheap to build such a content-filtering service, and consumers are ignorant to the benefit of such a system.

Clearly this is easy to bypass, 8.8.8.8 and 8.8.4.4 are both DNS servers that will provide a uncensored resolution.

share|improve this answer
    
I assume they are google's DNS servers ? This is interesting. This would also mean that the site I've mentioned does not "do anything" right ? since I can always change my DNS to 8.8.8.8. But how do you say that it is very cheap when compared to say, checking the IP address for geographic location ? p.s. I dont have enough Reps, could you please flag the below comment by user12102 –  sudhacker Aug 9 '12 at 17:24
1  
@user12102 yeah I'll flag that post, no problem. Yeah those are Google's DNS server. Its cheap to impalement a DNS blacklist, by just modifying BIND's configs, you don't even have to write any software for this. Having a proxy server and then forcing people to use this proxy server is complex to install and more difficult to write. –  Rook Aug 9 '12 at 17:31
1  
@Rook "Cheap to impalement a DNS blacklist"? You're going to run it through with a halberd, or something? ;-) –  Iszi Aug 9 '12 at 17:35
    
Any ISP can break the Google Public DNS workaround by 1. transparently MITMing those IP addresses and 2. instructing tech support to disclaim DNSSEC support entirely. –  tepples Dec 13 at 18:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.