Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1.1.1.1: Fast, privacy-first consumer DNS service

blog.cloudflare.com

Post reply on HN
Print view View original

131–140 of 695 posts

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#131

Post by olfactory »

jjoonathan wrote: post #29
nubela wrote: post #19

$ ping 1.1.1.1 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=47 time=214.866 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=47 time=173.416 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=45 time=256.007 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=45 time=196.638 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=45 time=294.694 ms 64 bytes from 1.1.1.1: icmp_seq=5 ttl=45 time=314.883 ms 64 bytes from 1.1.1.1: ic…

Sorry man :( Things are a bit quicker in the US: 64 bytes from 1.1.1.1: icmp_seq=1 ttl=60 time=0.421 ms 64 bytes from 8.8.8.8: icmp_seq=1 ttl=58 time=0.645 ms

Just curious if that is from a residential internet connection.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#132

Post by zackbloom »

dingaling wrote: post #34
vimda wrote: post #11

Earlier quoted context omitted.

Did you read the page? They're supporting DNS over TLS and DNS over HTTPS - both changes to the protocol to make in uninspectable. They've also said they're not logging IP info and they're getting independent auditors in to confirm what they're saying. Sounds trustworthy to me

Both encrypted extensions are of course inspectable at the end-point, which is the privacy model being discussed. What is intriguing to me is why Cloudflare are offering this. Perhaps it is to provide data on traffic that is 'invisible' to them, as in it doesn't currently touch their networks. Possibly as a sales-lead generator. Or is the plan to become dominant and then use DNS blackholing to shutdown malware that i…

The goal is to make the sites that use Cloudflare ridiculously fast by putting the authoritative and recursive DNS on the same machine (for clients who use 1.1.1.1).

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#133

Post by antoncohen »

Someone1234 wrote: post #111
antoncohen wrote: post #64

When I've seen DNS-over-HTTPS in the past I've always thought it odd that it's setup with a DNS name for the HTTPS address, requiring a plain DNS lookup before it starts using HTTPS. I assumed this was done because they didn't have a valid TLS cert for the IP address. But 1.1.1.1 actually has a valid TLS cert, yet their setup instructions say to use the DNS name cloudflare-dns.com instead of the IP. https://developer…

I suppose I see your point, but since DNS-over-HTTPS only supports HTTPS (not HTTP) and therefore requires a valid certificate for the requested resolver, there's no risk of the protocol being downgraded to HTTP or easily spoofed. So what do you see as the threat profile?

That is a good point, though I wasn't thinking about it from a security perspective. I was more imagining an ISP or nation that is trying to control content by blocking/faking DNS queries. They could block the first DNS query if DNS-over-HTTPS doesn't use an IP for the resolver.

Of course an ISP or nation could block/reroute the IP 1.1.1.1 too, so maybe it doesn't matter. Neither way would allow MITM, I was just thinking about ways oppressive ISPs/nations could stop DNS-over-HTTPS from working.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#134

Post by aexaey »

DyslexicAtheist wrote: post #116

TIL you can also use 1.1 and it will expand to 1.0.0.1 $> ping 1.1 PING 1.1 (1.0.0.1) 56(84) bytes of data. 64 bytes from 1.0.0.1: icmp_seq=1 ttl=55 time=28.3 ms 64 bytes from 1.0.0.1: icmp_seq=2 ttl=55 time=33.0 ms 64 bytes from 1.0.0.1: icmp_seq=3 ttl=55 time=43.6 ms 64 bytes from 1.0.0.1: icmp_seq=4 ttl=55 time=41.7 ms 64 bytes from 1.0.0.1: icmp_seq=5 ttl=55 time=56.5 ms 64 bytes from 1.0.0.1: icmp_seq=6 ttl=55 t…

  1.2 -> 1.0.0.2
  1.2.3 -> 1.2.0.3
But then, much of software would fail here - Firefox/Chrome for example would both threat that as bareword and redirect to search page.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#135

Post by chisleu »

tux3 wrote: post #122
DyslexicAtheist wrote: post #116

TIL you can also use 1.1 and it will expand to 1.0.0.1 $> ping 1.1 PING 1.1 (1.0.0.1) 56(84) bytes of data. 64 bytes from 1.0.0.1: icmp_seq=1 ttl=55 time=28.3 ms 64 bytes from 1.0.0.1: icmp_seq=2 ttl=55 time=33.0 ms 64 bytes from 1.0.0.1: icmp_seq=3 ttl=55 time=43.6 ms 64 bytes from 1.0.0.1: icmp_seq=4 ttl=55 time=41.7 ms 64 bytes from 1.0.0.1: icmp_seq=5 ttl=55 time=56.5 ms 64 bytes from 1.0.0.1: icmp_seq=6 ttl=55 t…

You can also use the decimal value of the IP, without the dots: https://16843009

You can also sing that number to the tune of the famous 8675309 song with very little robato.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#137

Post by detaro »

DyslexicAtheist wrote: post #129

so is a DHCP server address of 1.1.1.1 still perfectly valid for wireless local area networks? see: http://www.revolutionwifi.net/revolutionwifi/2011/03/explain...

As that article mentions, it wasn't "perfectly valid" even back then, it just didn't hurt. If I understand the specific implementation mentioned there correctly, it'll still work if the interception is done right (only catching DHCP and redirecting it to where it should go, leaving everything else untouched)

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#138

Post by bitxbitxbitcoin »

matwood wrote: post #102
yjftsjthsd-h wrote: post #21

Earlier quoted context omitted.

Logging: https://www.quad9.net/privacy/

Anonymized logging to improve the service and security. Is this different from Cloudflare?

Cloudflare is saying they won't log and will have audits by KPMG yearly to prove as such. Not logging and logging anonymized data are different approaches.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#139

Post by tialaramex »

rmsaksida wrote: post #88
icebergonfire wrote: post #54

I am getting ERR_CERT_AUTHORITY_INVALID because my ISP-provided router is intercepting the connection and trying to show me a "helpful" configuration wizard. No Cloudflare DNS for me. To be explicit: This is not Cloudflare's fault and we should blame the manufacturer of the router, or the ISP for deploying their custom "friendly" settings. But it is what it is.

Same problem here. It would be nice if Cloudflare created an alias to 1.1.1.1, because I can't access it at all. Edit: 1.0.0.1 also takes me to the router configuration screen. And there's no configuration setting for it. :(

Yup, these ranges are poisonous, which is why APNIC kept them, so this is effectively to be expected. It would actually be extraordinary if, since the range was determined to be poisonous and so mustn't be delegated this had magically fixed itself. So I was sort-of expecting to see some comments in the last thread about 1.1.1.1 like yours.

The "good" news is that this isn't being used for anything you really need - imagine if 1.1.1.1 had been delegated and now it was the resolution for www.facebook.com or indeed news.ycombinator.com ...

The bad news is that idiots do not learn from their mistakes, that's Dunning Kruger, the people who built your device don't understand why this was the Wrong Thing™ and won't now seek to do better in future. If we're lucky they'll go out of business, but that's the best we can hope for.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#140

Post by wtmt »

Twisol wrote: post #46
heisenbit wrote: post #41

Earlier quoted context omitted.

They are NOT saying Google is lying and collecting the data. They are saying the business model of Google inherently provides such incentive. Cloudflare is somewhat right: Means, Motive and Opportunity - but for a conviction you have to prove someone acted on the Opportunity. The Motive of Google is tampered with severe risk for loosing trust. Cloudflare can make an argument they are fundamentally better positioned a…

It's clear what you meant, but for whatever it's worth, I think the word you wanted was "tempered", not "tampered".

For what it’s worth, you missed to point out “loosing” vs. “losing” in that comment (where it talks about “loosing trust”). :)
Post reply on HN