this post was submitted on 17 Jan 2025
708 points (98.1% liked)
Technology
60631 readers
3984 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It would likely be impossible to redirect google.com without either sparking a cyberwar or building something like the great firewall of China, quite possibly both.
Blocking is somewhat possible, but to redirect, they would have to forge google certificates and possibly also fork Chrome and convince users to replace their browser, since last I checked, google hard-coded it's own public keys into Chrome.
Technical details
I say blocking in somewhat possible, because governments can usually just ask DNS providers to not resolve a domain or internet providers to block IPs.The issue is, google runs one of the largest DNS services in the world, so what happens if google says no? The block would at best be partial, at worst it could cause instability in the DNS system itself.
What about blocking IPs? Well, google data centers run a good portion of the internet, likely including critical services. Companies use google services for important systems. Block google data centers and you will have outages that will make crowd-strike look like a tiny glitch and last for months.
Could we redirect the google DNS IPs to a different, EU controlled server? Yes, but such attempts has cause issues beyond the borders of the country attempting it in the past. It would at least require careful preparations.
As for forging certificates, EU does control multiple Certificate authorities. But forging a certificate breaks the cardinal rule for being a trusted CA. Such CA would likely be immediately distrusted by all browsers. And foreig governments couldn't ignore this either. After all, googles domains are not just used for search. Countless google services that need to remain secure could potentially be compromised by the forged certificate. In addition, as I mentioned, google added hard-coded checks into Chrome to prevent a forged certificate from working for it's domains.
Nah. Demanding the ISPs to block traffic to Google domains would be quite effective.
This isn't like the great firewall of chine where you want to prevent absolutely all traffic. If you make it inconvenient to use, because CSS breaks or a js library doesn't load or images breaslk, its already a huge step into pushing it out of the market.
Enterprise market would be much harder, a loooot of EU companies rely on Google's services, platforms and apps, and migrating away would take a lot of time and money.
Filter it based on what? Between ESNI and DNS over HTTPS, it shouldn't be possible to know, which domain the traffic belongs to. Am I missing something?
Edit: Ah, I guess DNS over HTTPS isn't enabled by default yet.
China blocks ESNI and DoH. You have to find a DoH server that is not well known and have to fake the host name.
But if you actually do that, lol
Just filter out googles ASN and ip's. And stop peering with them on BGP. Simples
Im not supporting this by the way. I think the internet should be free and open, without governments blocking what I can access.
The onpy free internet will be tor. The normie internet has been too naughty and spawned shitty giants who think they can treat us like cattle. Break the critical mass and network effects, kill the blitzscale cheaters trying to enslave us. We do not need them, they need us.
Just block payments from advertisers by revoking their business licence.
Yes, I mentioned that in a comment deeper down. And even before that, just fine them. Chances are they will pay and if not, you can probably seize some bank accounts.
I am not trying to say Google can afford to completely defy the EU, just found it interesting how hard it is to block just google search specifically.
PS: Also mentioned in a burried comment, there actually is a way for ISPs to block google, since DNS over HTTPS is not enabled by default yet in browsers I think. I forgot this since I enabled encrypted DNS like 8+ years ago for myself and just assumed people also have it by now.
You block the DNS ups as well I think. Browsers should have more than one DNS address anyway in case one go down
The backup is usually a different server from the same DNS provider. E.g. google has 8.8.8.8 as primary and 8.8.4.4 as secondary. Plus the backup doesn't even always work on Windows.
Also note, it is not browsers but operating systems that do primary DNS. Browsers may use DNS over HTTPS for security and privacy instead of the one in the OS, but that usually requires the OS DNS to resolve the address of the DNS over HTTPS server, since it is considered a security feature built on top of classic DNS instead of replacement.
PS: Don't get me wrong, EU could definitely block google.com sooner or later. It just wouldn't be as easy as usual. The real risk is if Alphabet stops offering all of its services, chaos ensues. Companies unable to access their google spreadsheets. Services and data hosted on google cloud lost. People protesting lack of youtube...
And even if Alphabet doesn't do that, I expect a lot of issues just with google being unavailable and most people not even knowing there are other search engines. It's really going to be last resort to try blocking google, I expect fines or some such.
I think that if EU was to retaliate against any of the big tech players (which isn’t going to happen imho since eu institutions don’t really display the affinity for swift and decisive justice it would require) it would make more sense to start blocking the advertising and/or data collection. Like a continent-wide pi hole. Still getting the message across while not impacting the users as much. At least not immediately. That said, the gatekeeper platforms should be prohibited from providing services like DNS resolving which are critical for the operation of other services than just theirs.
They probably also could just prevent EU companies and branches from buying google ads directly. Vast majority of ads is geo-located, so there would be almost no ads to show in the EU.
There's probably a way to redirect without validation. Only respond to port 80 if needed, then redirecr. Sure the browser might complain a little but it's not as bad as invalid cert.
Maybe for some rando site, Google and any half competent site has HSTS enabled, meaning a browser won't even try to connect with insecure HTTP, nor allow user to bypass the security error, as long as the HSTS header is remembered by the browser (the site was visited recently, set to 1 year for google).
In addition, google will also be on HSTS preload lists, so it won't work even if you never visited the site.
That makes me realize, what kind of country doesn't cobtrol it's dns space's encryption certificates. That's a major oversight.
What? What do you mean "DNS space"? Classic DNS does not have any security, no encryption and no signatures.
DNSSEC, which adds signatures, is based on TLDs, not any geography or country. And it is not yet enabled for most domains, though I guess it would be for google. But obviously EU does not control .com.
And if you mean TLS certificates, those are a bit complicated and I already explained why forging those would be problematic and not work on Chrome, though it could be done.
Yes I mean tls certs as those control what dns records are considered valid. The Eu should control which tls are considered valid within its territory and that should be considetedpart of their security apparatus. It's crazy irresponsible to have left that up to unaccountable private foreign entities. This is what would make it difficult to control their own independant version of the dns namespace.
No. At the end of the day, I control which certificates I consider valid. Browsers just choose the defaults. There is no way I quietly let some government usurp that power, considering how easy to abuse it is.
No they don't. That is not what TLS really does. But I guess close enough.
Ok but my grandma can't
Even more reason to have relatively neutral organizations transparently curate the list of trusted CAs. While I am sure governments also closely monitor the process and would step in if they deemed it a threat.
Google is a threat. They should know they can be subverted if they continue in their ways with the questionably ethical human experimentation (for instance, undisclosed A/B testing including full context)
What does that have to do with TLS?
One of the reasons to create a domestic redirect of google.com
So we come full circle. The government having the ability to impersonate a site is exactly what I believe must not happen.
If the EU wants to create search.eu or any other search site, more power to them. I certainly wouldn't use it, but hey, if you want to trust them, you can.
If they want to block google search... Eeeeh... I guess that is fine?
But they shouldn't be able to create a fake certificate for google.com or any site for that matter, not only allowing them to impersonate the site, but also intercept encrypted traffic between users and that site.
So no. Governments should not control the TLS infrastructure.
TLS certificate infrastructure is a major national security concern. Sure, for religious reasons it can be controlled by a private entity but the governement is certaily already pullibg all the strings there. The problem in the EU is this control is in America now. So they need to wake up and have their own. Then the can enforce a google ban and seamless redirect to search.eu or whatever. The important thing is to both block google while not breaking the search button on everything that foolishly hardcoded google.com in the code.
You obviously have no idea what you are talking about. America does not have any more or less of an ability to forge certificates compared to Europe.
Not wanting to live in a surveillance state is not religious, it's common fucking sense.
There is 0% possibility the US gov cannot publish a certificate in all major browser that could usurp any dns from a registrar in a country under US dominance.
Just because they haven't used that card uet doesn't mean they can't. The clearnet is already a surveillance cesspit. There is no escaping state forces anywhere on it.
It's just the europeans being complacent about leaving this capability to the americans. For now they depend un US cyber command for it, and they won't do it to google for the sole benefit of europeans.
There is 0% possibility the US gov could do it covertly.
Sure, they could force it overtly but the rest of the world would have forks of Browsers like 15 minutes after it went through.
Besides, there is no need to go after the browsers. If you want a fake cert for a few days, EU has trusted certificate authorities just like the US that can issue a cert for any website (CAs are usually not restricted to specific TLDs). The CA would just get removed from browsers within days, same as browsers being replaced.
PS: Btw, iTrusChina is also a trusted CA. If the US is not concerned about their main adversary, China, forging certificates, why should EU be worried about an ally doing so?