Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1.1.1.1: Fast, privacy-first consumer DNS service

blog.cloudflare.com

Post reply on HN
Print view View original

41–50 of 695 posts

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#41

Post by heisenbit »

otoburb wrote: post #14
ajross wrote: post #3

This is the Cloudflare resolver, right? What's the "privacy-first" part about? It's just another third party DNS host. They haven't changed the protocol to be uninspectable and AFAIK haven't made any guarantees about logging or whatnot that would enhance privacy vs. using whatever you are now. This just means you're trusting Cloudflare instead of Comcast or Google or whoever.

Cloudflare is making a public pronouncement that they're not going to sell your DNS data nor track your IP address, with the implication that they will also not use the usage data to upsell you services. That's about the only additional "privacy" edge they offer. In the same breath, they insinuate that Google both sells and uses DNS usage from their 8.8.8.8 and 8.8.4.4 resolvers.

They are NOT saying Google is lying and collecting the data. They are saying the business model of Google inherently provides such incentive.

Cloudflare is somewhat right: Means, Motive and Opportunity - but for a conviction you have to prove someone acted on the Opportunity. The Motive of Google is tampered with severe risk for loosing trust.

Cloudflare can make an argument they are fundamentally better positioned and that is all they do. As with all US based operations the NSA may cook up some convincing counterarguments and we may never know.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#42

Post by rocqua »

milankragujevic wrote: post #24

uhm how can you get an ssl cert for an IP?

Apparently, you need to provide it as a Subject Alternative Name (SAN).

This is the entry for the cert used:

    DNS Name=*.cloudflare-dns.com
    IP Address=1.1.1.1
    IP Address=1.0.0.1
    DNS Name=cloudflare-dns.com
    IP Address=2606:4700:4700:0000:0000:0000:0000:1111
    IP Address=2606:4700:4700:0000:0000:0000:0000:1001

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#45

Post by vimda »

dingaling wrote: post #34
vimda wrote: post #11

Earlier quoted context omitted.

Did you read the page? They're supporting DNS over TLS and DNS over HTTPS - both changes to the protocol to make in uninspectable. They've also said they're not logging IP info and they're getting independent auditors in to confirm what they're saying. Sounds trustworthy to me

Both encrypted extensions are of course inspectable at the end-point, which is the privacy model being discussed. What is intriguing to me is why Cloudflare are offering this. Perhaps it is to provide data on traffic that is 'invisible' to them, as in it doesn't currently touch their networks. Possibly as a sales-lead generator. Or is the plan to become dominant and then use DNS blackholing to shutdown malware that i…

Im probably being naive, but maybe altruism? At least if you buy into their making the internet better rhetoric

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#46

Post by Twisol »

heisenbit wrote: post #41
otoburb wrote: post #14

Earlier quoted context omitted.

Cloudflare is making a public pronouncement that they're not going to sell your DNS data nor track your IP address, with the implication that they will also not use the usage data to upsell you services. That's about the only additional "privacy" edge they offer. In the same breath, they insinuate that Google both sells and uses DNS usage from their 8.8.8.8 and 8.8.4.4 resolvers.

They are NOT saying Google is lying and collecting the data. They are saying the business model of Google inherently provides such incentive. Cloudflare is somewhat right: Means, Motive and Opportunity - but for a conviction you have to prove someone acted on the Opportunity. The Motive of Google is tampered with severe risk for loosing trust. Cloudflare can make an argument they are fundamentally better positioned a…

It's clear what you meant, but for whatever it's worth, I think the word you wanted was "tempered", not "tampered".

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#47

Post by therealmarv »

eeZah7Ux wrote: post #27

Any reason why DNS over TLS is preferred over DNSCurve?

I'm guessing less "sophisticated reinvention" and usage of existing TLS connection technology. You can use both (even at the same time) with DNScrypt-proxy V2 https://github.com/jedisct1/dnscrypt-proxy ;)

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#48

Post by dictum »

shimms wrote: post #9
ajross wrote: post #3

This is the Cloudflare resolver, right? What's the "privacy-first" part about? It's just another third party DNS host. They haven't changed the protocol to be uninspectable and AFAIK haven't made any guarantees about logging or whatnot that would enhance privacy vs. using whatever you are now. This just means you're trusting Cloudflare instead of Comcast or Google or whoever.

Yes they have: "Privacy First: Guaranteed. We will never sell your data or use it to target ads. Period. We will never log your IP address (the way other companies identify you). And we’re not just saying that. We’ve retained KPMG to audit our systems annually to ensure that we're doing what we say. Frankly, we don’t want to know what you do on the Internet—it’s none of our business—and we’ve taken the technical step…

> Frankly, we don’t want to know what you do on the Internet—it’s none of our business

In the DNS resolver space, what is their business?

Post reply on HN