headers
SJ Kissane | 13 Jan 07:06
Picon

Re: DNS prefetching

Hi

I think DNS prefetching should be less of a concern than HTTP prefetching, given DNS caching.
If your ISP's/network's DNS server is caching, and the link is to a site with a sensible TTL, then
the extra network impact of DNS prefetching should be marginal, especially for popular pages.
Also, the size of the data being transferred with DNS is smaller, and the efficiency is better.

Now, one security concern, is if a web page has a huge number of links, all to different host names.
It might be sensible to set a limit, e.g. on any web page, I will prefetch the first 20 hostnames
I see, but stop there. Otherwise, I could insert into a HTML page hidden links to h1.example.com,
h2.example.com, .... up to h1000000.example.com, and then have your web browser blindly issue
1,000,000 DNS queries. Another security requirement would be to have a sensible pause between
each lookup, or else I could use that nasty HTML page to flood your DNS server.

Cheers
Simon

2009/1/13 Mark Nottingham <mnot <at> mnot.net>
seems to be catching on:
 https://addons.mozilla.org/en-US/firefox/addon/8923
and this
 http://plasmasturm.org/log/528/
implies that Google's new Chrome browser does it.

I'm curious to know what the IETF community thinks of this. The Web caching community experimented with HTTP prefetching for a while (and I believe that some browsers also dabble with it), but we were burnt by unintended side effects (e.g., taking sites down with the extra traffic, burning up costly bandwidth in non-US locations).

Also, are there any security implications here, considering that DNS-based attacks often rely upon timing?

Cheers,

--
Mark Nottingham     http://www.mnot.net/

_______________________________________________
Apps-Discuss mailing list
Apps-Discuss <at> ietf.org
https://www.ietf.org/mailman/listinfo/apps-discuss

_______________________________________________
Apps-Discuss mailing list
Apps-Discuss <at> ietf.org
https://www.ietf.org/mailman/listinfo/apps-discuss
Permalink | Reply |
headers
Carsten Bormann | 13 Jan 12:16
Favicon
Gravatar

Re: DNS prefetching

On Jan 13, 2009, at 07:06, SJ Kissane wrote:

> security concern

Another line for the security considerations section:
DNS prefetching might give away domain names that the user of a page  
did not intend to actually use.
(Probably most relevant with HTTPS.)

Gruesse, Carsten
Permalink | Reply |
headers
Barry Leiba | 13 Jan 13:43
Picon
Favicon

Re: DNS prefetching

Carsten says...
> Another line for the security considerations section:
> DNS prefetching might give away domain names that the user of a page did not
> intend to actually use.

But it only "gives them away" to your own DNS server.  That's worth noting, but 
it's a minor issue.

Barry

--
Barry Leiba, Senior Technical Staff  (leiba <at> watson.ibm.com)
Internet Messaging Technology, IBM Research
http://www.research.ibm.com/people/l/leiba
http://www.research.ibm.com/spam
Permalink | Reply |
headers
Carsten Bormann | 23 Jan 12:29
Favicon
Gravatar

Re: DNS prefetching

On Jan 13 2009, at 13:43, Barry Leiba wrote:

> But it only "gives them away" to your own DNS server.

That is only true if the RR is in the cache of that server.
(Also, "your own" DNS server may not be in your trust domain at all.)

A minor issue in most cases indeed, but still worth noting.

Gruesse, Carsten
Permalink | Reply |

Gmane