2

There's a (private, password-protected) WiFi network (not under my control) which at first did not work* for my laptop - until I disabled the option that caused it to use google's DNS server.
[*] not working means that the laptop was connected to the LAN, but had no internet access.

What are the security/privacy implications, if any, of using one or the other? Is it a sign that something fishy is going on if 8.8.8.8 is not working?

2

Why might a custom DNS server not work

There are many reasons that specifying the DNS servers may block you from using the connection:

  • The network may be protecting all DNS queries to protect from tracking or interception, in which case they may drop queries that would not be protected.

  • There may be some form of authentication taking place, which may involve being redirected using DNS, which may not happen if you use an external DNS provider

  • They may have blocked external DNS to prevent tools like iodine being used to get around captive portals.

  • There may be a content filter being used, which may use DNS to see which sites are being used, which requires users not use external DNS so it can watch their traffic.

  • An attacker may be intercepting DNS traffic, and blocking external DNS to make sure they get all of the traffic

What are the effects of using the network provided DNS server

If you use the provided DNS and do not use DNSSEC, then the following may happen:

  • Tracking of visited sites
  • Blocking of sites
  • Redirecting of sites

As the network or an adversary can provide a DNS server that they control, or that will work with them to record and/or modify responses that are sent to your machine.

This can be mitigated by using DNSSEC to prevent spoofing of DNS responses, and HTTPS to prevent the network modifying the pages you visit after DNS resolution has taken place.

2

Well, I can imagine legitimate reasons why a network administrator would want to block access to Google's DNS. After all, you're basically telling Google about every host you're connecting to. To Google, that's very valuable information since without it, they'll be tracking you on the WWW only. By using their DNS as well, you're giving them everything there is to know about your movements on the internet.

On the other hand, a locally administered DNS can in principle do lots of other sinister things, for example redirect you (visibly or invisibly).

In the end, you simply have to think about who operates the network, what their interests may be and how you can trust them. Or just ask.

  • While it is true that Google benefits from the DNS data, it is an exaggeration to claim that merely knowing the domain name "gives them everything there is to know about your movements on the internet". – jpa Sep 30 '18 at 19:47
  • 1
    "The domain name"? Of what, that's what is relevant here. You're giving them "the" domain name of everything you exchange an IP packet with. Along with the time and the context from WWW-based tracking, that damn well is everything there is to know, about movement. The only bit missing is the actual content of your communication. – Victor Mataré Sep 30 '18 at 23:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.