cross-posted from: https://links.hackliberty.org/post/2005038

I know this is an outrageously bad idea, I don’t need convincing. I am just looking for some more information and discussion on what exactly the exposure and surveillance risk is.

I’m asking both for my own education (I am still very green to networking), and to better explain to people in my life if and why they should care.

  1. Is it true that traffic can be tracked and logged by ISP through DNS lookups, as these routers are preconfigured to use their internal dns service?

  2. If this is changed (like base.dns.mullvad.net), how much does this actually mitigate the risk here?

  3. What about when a VPN (mullvad) is also being used at all times? Would it then be “overly paranoid” to fear this untrusted box all the traffic goes through?

I personally take a conservative approach to things like this and assume it’s an unacceptable risk, but I don’t really understand what the truth is.

Thank you in advance for your time and thoughts.

EDIT: I’m asking about US and US adjacent areas

  • h3ndrik@feddit.deEnglish
    4·
    3 days ago

    Sure. Most of the actual traffic is encrypted by https these days. So they can’t look inside. But they can see to what IP you send these encrypted packets and from where packets come to you.

    With DNS they can see what domains you typed in and your computer looks up. Just the part to the .com or something and nothing after. And sure, they’re preconfiguring their DNS server. Because they’re an internet service provider and you pay them to provide services like domain name lookup to you. They’re certainly not going to preconfigure a server of their competitors and funnel your data to them.

    With something like Mullvad, if you configure that correctly (!) also your DNS requests go through an encrypted tunnel. Now your ISP can only see you connect to some Mullvad server. And now Mullvad provides DNS to you and they’re now the ones who can see what kind of domains you look up.

    You can often just change your DNS settings. Either in the devices or for all your network in the router. But mind that plain DNS on port 53 is unencrypted. You’re connecting to a different setver then, but theoretically they could snoop on you if it’s an unencrypted connection.

    Isn’t there some ISP in the US that is kinda trustworthy? I mean Mullvad or all the other VPN services are companies, too. Depending on your use-case and threat scenario, you might want to choose a different ISP if you’re afraid of them… But I’m not an expert on American companies. And I also use third-party DNS servers. I own my Wifi router and I set the DNS to opennic.org and also configured an AdBlocker.