by
bear » Wed Oct 08, 2014 5:43 pm
Okay, this is just about the angriest Sonic.net has ever made me.
Filtering is
A. done with prior, informed, consent. You never told me you were going to do this and you never asked my permission.
B. clearly identifies in channel who is doing the filtering and what is blocked. The page you put up gave no indication of who was doing the blocking or what reason prompted them to block that particular page.
C. provides an easy way to reach the filtered content. Yeah, there was no "go there anyway" link on that page either.
What you did here was implement a MITM attack by spoofing DNS. This is exactly the attack that DNSSEC was supposed to protect us from. And your "opt-out" servers are crippled; they do not implement DNSSEC. So, is it really the case that we either accept your attack or abandon our protections against everybody else's attacks? Oh, no, wait, there's a third option, isn't there.... but it doesn't involve continuing to do business with Sonic.net.
I've had the "mousetrap page" popping up for months, and been annoyed by it and assumed it was some overeager plugin that had defaulted to "ON", spent an hour here and there trying to figure out which one and turn it OFF, and then given up and gone to the sites anyway using my phone, which is a total pain in the ass because phones have no privacy whatsoever. I mean, hell, my browser runs in a chroot jail on a Linux box with up-to-date software, and has absolutely no access to any passwords or email; I don't expect any malware site out there to give me a problem. Moreover, if somebody does get one of my passwords, she will find that it is used absolutely nowhere else. My phone, on the other hand, I cannot defend. Every time I enter a password on my phone, I assume that it is compromised and change that password the instant I can get back to the site on my desktop box.
But that's beside the point. I have NEVER -- not ONCE -- found a real malware/phishing site at the other end. I have found the same forums I'd been using. I have found the same webcomics I'd been reading. I have found the same financial services and analysis businesses. I have found the same blogs I'd been reading. This so-called service, as far as I have seen, is one hundred percent false alarms, and allows trolls and bad actors to censor anybody they don't like by reporting their site as malware or phishing. As far as I can tell, the only sites that are getting blocked are people who pissed off some butthurt internet troll and businesses who have unscrupulous competitors.
And, come on, be serious. An obvious spoof page appears in your browser, with no identifying information and (because DNS is now obviously spoofed) absolutely no indication of where the web form on it will report it to, and it asks for your email address and gives you a form to tell them why you think you ought to be able to access the site? In the first place no sane security-conscious person will EVER fill out that form unless trying to track down the attacker as I did last night, and in the second place, That looks exactly like a puppy box, doesn't it? Give 'em a place to yap so they get the yapping out of their system and don't go to somebody who might actually catch the attacker.
So, finally, last night, I decided it was time to KILL this thing whatever it was, and one by one I uninstalled every last browser plugin -- which are mostly security things like HTTPS-everywhere and Adblock. And it continued happening. Holy crap, I thought -- it's a genuine MITM attack, it is behaving exactly the way I'd expect censorship-for-hire to behave by blocking sites someone has a financial motive to block, and somebody has subverted the DNSSEC servers at Sonic to do it! At that point, I was thinking, okay, time to pull out all the stops, this is TOTAL WAR. And I dug in, tracing logs and querying DNS in different places to identify differences, until finally, two hours later, I discovered that the spoof page doesn't just LOOK like it's coming from Sonic.net due to the spoofing... No, it's ACTUALLY coming from Sonic.net! From the very same DNSSEC servers, in fact! At that point I was mad enough to chew horseshoes and spit nails.
I have been a Sonic.net customer for twenty years. But this is a complete betrayal of trust. This is not filtering, this is censorship. You guys never asked my permission or got my consent to do this. You never even admitted to me that you were doing it until I ****ing tracked the attack down MYSELF, and called you on it! And now with your crippled "opt-out" offer you're making DNSSEC unavailable to me unless I allow random internet trolls and scammers to censor the sites I'm allowed to read by reporting them as malware sites?
What the hell, dudes? Who are you and what have you done to the honorable people I used to deal with?
