Comment by mike_d
7 years ago
> The author seem to be missing one of the big reasons ridiculously low TTLs are used: it lets passive eavesdroppers discover a good approximation of your browsing history.
I operate DNS for hundreds of thousands of domains. I've tried to reassemble browsing history from DNS logs, and I can tell you it is damn near impossible. You have DNS caches in the browser, the OS, broadband routers, and ISPs/public resolvers to account for - and half of them don't respect TTLs anyways.
The reason people set low TTLs is they don't want to wait around for things to expire when they want to make a change. DNS operators encourage low TTLs because it appears broken to the user when they make a change and "it doesn't work" for anywhere from a few hours to a few days.
> I operate DNS for hundreds of thousands of domains. I've tried to reassemble browsing history from DNS logs
Why? :)
To make sure others can't do the same.
The problem is that your ISP can log and mine your DNS requests, regardless of the servers you use. They definitely do this and one can only assume they then sell it after some sort of processing.
I’ve worked for a few, in Europe mind you, but I can say with certainty we did not do this.
It would be naive to think none do of course.
The comment you're replying specifies caching at the browser, OS, and router level. Not one of three would show up as DNS refreshes with the ISP because the DNS is not being refreshed.
Don't browsers and operating systems mostly respect ttls?
So if some things are cached, you won't get a complete picture, but the picture you get might be enough.
2 replies →