{"action":"created","issue":{"url":"https://api.github.com/repos/henrypp/chromium/issues/47","repository_url":"https://api.github.com/repos/henrypp/chromium","labels_url":"https://api.github.com/repos/henrypp/chromium/issues/47/labels{/name}","comments_url":"https://api.github.com/repos/henrypp/chromium/issues/47/comments","events_url":"https://api.github.com/repos/henrypp/chromium/issues/47/events","html_url":"https://github.com/henrypp/chromium/issues/47","id":357954681,"node_id":"MDU6SXNzdWUzNTc5NTQ2ODE=","number":47,"title":"Req: No \"DNS Proof Fetching\" version","user":{"login":"rugabunda","id":38260267,"node_id":"MDQ6VXNlcjM4MjYwMjY3","avatar_url":"https://avatars2.githubusercontent.com/u/38260267?v=4","gravatar_id":"","url":"https://api.github.com/users/rugabunda","html_url":"https://github.com/rugabunda","followers_url":"https://api.github.com/users/rugabunda/followers","following_url":"https://api.github.com/users/rugabunda/following{/other_user}","gists_url":"https://api.github.com/users/rugabunda/gists{/gist_id}","starred_url":"https://api.github.com/users/rugabunda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rugabunda/subscriptions","organizations_url":"https://api.github.com/users/rugabunda/orgs","repos_url":"https://api.github.com/users/rugabunda/repos","events_url":"https://api.github.com/users/rugabunda/events{/privacy}","received_events_url":"https://api.github.com/users/rugabunda/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-09-07T07:40:08Z","updated_at":"2018-09-10T00:30:32Z","closed_at":null,"author_association":"NONE","body":"Chromium has finally implemented **DNS Proof Fetching** which comes with many privacy concerns. The new DNS queries begin after the installing the latest Chromium v69.0.3497.81-r576753-win64 (stable). This in a nutshell basically sends a clone of every dns request to every https domain & subdomain to Google in realtime.  Please review the privacy concerns and consider releasing a version of chromium which removes the new Certificate Transparancy DNS-based protocol.\r\n\r\nPrivacy implications of Certificate Transparency’s DNS-based protocol \r\nhttps://docs.google.com/document/d/1DY2OsrSJDzlRHY68EX1OwQ3sBIbvMrapQxvANrOE8zM/edit#\r\nhttps://www.agwa.name/blog/post/how_will_certificate_transparency_logs_be_audited_in_practice\r\nhttps://www.symantec.com/connect/blogs/privacy-redaction-and-certificate-transparency\r\nhttps://groups.google.com/forum/#!topic/certificate-transparency-chrome/X1ja-E8FsUI\r\n\r\nPrivacy Concerns:\r\n1. **Requesting an inclusion proof leaks each and every https visited domain to the client software supplier in realtime, that being Google, even for Chromium users; This gives Google droves of data once only accessible to the users ISP, and consolidates further Googles monopoly on user/population data, statistics, & demographics.\r\n2. Cross-resolver leakage (Leaking after enabling/disabling VPN/TOR, or switching DNS services)\r\n3. Leakage of client information via edns-client-subnet\r\n4. Disclosure of actual visited hosts vs only resolved hosts\r\n5. Resolver Disclosure for hosts whose address was not obtained via DNS lookup [direct connection via ip]\r\n6. Local authoritative resolver leakage**\r\n\r\nAccording to symantec: \r\n\r\n> In my previous blog, I discussed the need to balance the benefits of logging certificates publicly with the need of many customers to prevent logging of internal domain names they consider private.\r\n> \r\n> The Internet Engineering Task Force (IETF) also recognized the importance of this, and has made solid progress in support for name redaction in the latest version of the Certificate Transparency (CT) specification. Based on this progress, Symantec will soon be adding a “redaction” option for customers to exclude publishing of sub-domain information when requesting certificates. With this feature, customers will be able to get the full benefits of monitoring certificates issued by Symantec and also get the privacy protection they need.\r\n> \r\n> Google – whose browser is currently the only major one to support Certificate Transparency - has not yet announced when or whether Chrome will accommodate redaction. As a result, it is possible that Chrome will show an “untrusted” warning if it encounters certificates where customers have chosen to log their certificates with redacted sub-domain information. Therefore, customers who have internal, browser-based applications, where privacy of certificate domain information is important, may want to consider using an alternate browser or one of our Private CA options.\r\n> \r\n\r\nThank you!\r\n"},"comment":{"url":"https://api.github.com/repos/henrypp/chromium/issues/comments/419756725","html_url":"https://github.com/henrypp/chromium/issues/47#issuecomment-419756725","issue_url":"https://api.github.com/repos/henrypp/chromium/issues/47","id":419756725,"node_id":"MDEyOklzc3VlQ29tbWVudDQxOTc1NjcyNQ==","user":{"login":"rugabunda","id":38260267,"node_id":"MDQ6VXNlcjM4MjYwMjY3","avatar_url":"https://avatars2.githubusercontent.com/u/38260267?v=4","gravatar_id":"","url":"https://api.github.com/users/rugabunda","html_url":"https://github.com/rugabunda","followers_url":"https://api.github.com/users/rugabunda/followers","following_url":"https://api.github.com/users/rugabunda/following{/other_user}","gists_url":"https://api.github.com/users/rugabunda/gists{/gist_id}","starred_url":"https://api.github.com/users/rugabunda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rugabunda/subscriptions","organizations_url":"https://api.github.com/users/rugabunda/orgs","repos_url":"https://api.github.com/users/rugabunda/repos","events_url":"https://api.github.com/users/rugabunda/events{/privacy}","received_events_url":"https://api.github.com/users/rugabunda/received_events","type":"User","site_admin":false},"created_at":"2018-09-10T00:30:32Z","updated_at":"2018-09-10T00:30:32Z","author_association":"NONE","body":"This is the exact version of Chromium I am using, this is what I am seeing.\r\n\r\n[](https://image.ibb.co/mdLAC9/Chrome_Pretech.png)\r\n[dnsmasq.log](https://github.com/henrypp/chromium/files/2364803/dnsmasq.log)\r\n\r\n\r\n"}}
{"actor":{"display_login":"rugabunda"}}