Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS over HTTPS

github.com

Post reply on HN
Print view View original

161–170 of 195 posts

Re: DNS over HTTPS

#161

Post by DavideNL »

nly wrote: post #121

I've been pushing all my DNS traffic over a VPN, transparently, for the whole house, for years now (by setting the VPN remote IP as the upstream resolver on my router). It seems the only advantage of DNS-over-HTTPS is that it does DNS over TLS on port 443, which is harder for militant netadmins to block. It's definitely a solution to a niche problem, but if we really want to encrypt DNS at scale then we could do it e…

When you run DNS requests over VPN, you are sharing your "browsing history" with (at least) 1 other third party: whoever runs the VPN server, and whoever runs the (public) DNS server.

Your ISP can see the IPs you connect to regardless of whether you use your ISPs DNS server or not (unless of course you tunnel ALL traffic of all clients through the vpn as well.)

Re: DNS over HTTPS

#163

Post by tedunangst »

gsich wrote: post #157
lyk wrote: post #147

Earlier quoted context omitted.

Not sure if you're trolling, but the network is being accessed by bypassing the captive portal. The network is being accessed in a way that isn't permitted.

And how should I know that there is a captive portal? I connect (connection is established after receiving IP address!) and use iodine (or similar).

I'm sure the jury will be delighted to hear your explanation.

Re: DNS over HTTPS

#165

Post by gsich »

tedunangst wrote: post #163
gsich wrote: post #157

Earlier quoted context omitted.

And how should I know that there is a captive portal? I connect (connection is established after receiving IP address!) and use iodine (or similar).

I'm sure the jury will be delighted to hear your explanation.

Why should this go to court? I'm not sure if you have understood what this thread was about.

Re: DNS over HTTPS

#166

Post by aplorbust »

mosselman wrote: post #82

“...for privacy...” and “Google runs one...” Strikes me as funny. Interesting concept apart from this detail though. Are there any servers that aren’t owned by advertisers and the like?

https://stat.ripe.net/data/dns-chain/data.json?resource=exam...

https://dns-lg.sidnlabs.nl/example.com/A

Re: DNS over HTTPS

#167

Post by aplorbust »

kuschku wrote: post #20

So what use does this have? DNSSEC already gives us validation of the records, and thanks to SNI, this doesn't give us any privacy. It is more complex, more centralized, and ends up slower than using actual DNS, and doesn't seem to provide any benefits. Am I missing something?

"... thanks to SNI, this doesn't give us any privacy."

Assumption: All sites use SNI or will use SNI.

True?

Experiment: List all domains posted to HN (pages 1-20) that require https on any given day. Try accessing each one without SNI.

Result: Most do not require SNI.

Re: DNS over HTTPS

#168

Post by [deleted] »

pbhjpbhj wrote: post #77
userbinator wrote: post #70

Earlier quoted context omitted.

I don't use it either, and I agree with the poster on that stackexchange link about it sounding like manager/marketing-speak, but when I see it, it makes me pause for a second to think about what really means (perhaps that's the point) --- I had this exchange with a coworker not long ago: CW: ...and this way it'll be more performant too. Me: Performant? As in faster? CW: Yes. Me (to self): Then why didn't you just sa…

Performant to me implies performing better against the relevant metrics. So faster, maybe, but perhaps smaller and more energy efficient too. If the context of the metrics is already understood then it seems quite a cromulent word.

[deleted]

Re: DNS over HTTPS

#169

Post by squeaky-clean »

gsich wrote: post #144
remedan wrote: post #130

Earlier quoted context omitted.

You're still circumventing security measures to use somebody else's hardware in a way they clearly don't want you to. That's illegal in most cases.

Who is the "someone else" in your case? Where does the someone else's hardware come from? OP mentioned this to get rid off e.g captive portals. Iodine requires a client and a server. Both belong to you, what is the problem here? That I use a network to transmit packets? We are not talking about installing iodine on someone else's computer!

> That I use a network to transmit packets?

Maybe I'm not understanding this correctly, but if a coffee shop has wifi and you need to enter info into a captive portal before you can use their network, by circumventing it, the "Someone else" is the coffee shop owner, and the hardware is their router.

"Please get off my router if you don't agree to my conditions". "Nah I'm just using DNS, it's fine" probably is not an admissible excuse.

Re: DNS over HTTPS

#170

Post by greiskul »

v_lisivka wrote: post #102
Angostura wrote: post #88

Earlier quoted context omitted.

I think the word that was being grasped for is 'faster'. It suffers in that doesn't sound very technical.

GPU can perform more operations than CPU, but GPU is slower than CPU, not faster.

Yes, throughput vs latency is a very important distinction. An airplane is always faster then a train, but if what you are measuring is throughput, a train can be more performant. It depends on the context, but that's fine. There is no such thing as a made-up word if the word has a meaning, and is regularly used by a group of people.
Post reply on HN