Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1.1.1.1: Fast, privacy-first consumer DNS service

blog.cloudflare.com

Post reply on HN
Print view View original

341–350 of 695 posts

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#341

Post by vinniejames »

jedisct1 wrote: post #276
vinniejames wrote: post #267

How does this service, with DNS-over-HTTPS or DNS-over-TLS, compare to something like DNS Crypt? https://www.opendns.com/about/innovations/dnscrypt/

https://dnscrypt.info/faq/

I more curious from a practical perspective, the FAQ appers to cliam DNScrypt gives you most/all of what the others do, with easy setup.

The caveat that a "good amount of servers support the protocol" isn't very clear, how many is a "good amount"? Does that hold true now? Unsupported servers appear to fall back to traditional DNS resolution, oer the diagram; is this not the case with the HTTP/TLS implementations?

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#344

Post by hartator »

I would love using better DNS resolvers like this than crappy ISP provided ones.

My only complain is when you connect to public wifi that requires to display some wifi capture page, acceptance of ToS, to sign in with your room number, airliner wifi, etc. Usually they break when you don't use their automated provided DNS servers. Requiring you to remove your preferred DNS entries, waiting for the wifi popup to open, do the required thing, and put back your preferred DNS servers. I end up just keeping the defaults, and that's a shame.

Wish they were a good solution. Any tips?

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#345

Post by hartator »

cthalupa wrote: post #326
hartator wrote: post #320

Earlier quoted context omitted.

If you are on ethernet, I am able to get 1-2ms pings. On same AT&T Fiber Gigabit. Wifi ruins both bandwidth and latency for me.

You should invest in some better wifi gear, it sounds like! On a Unifi nano hd, with moderate signal, my latency only goes up 1ms. Getting ~3.5 ms on wifi to 1.1.1.1, ~2.5ms ethernet

That's impressive. My AT&T wifi router caps bandwidth at 300mb/s (instead of 1gbs on ethernet) and add 10-20 ms to latency. And this is standing next to it and using 5ghz.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#346

Post by thisacctforreal »

majewsky wrote: post #331
Operyl wrote: post #303

Earlier quoted context omitted.

You just solved your own question. Cloudflare creates an opensource client that users install locally.

Where's the button to install your own DNS resolver on iOS? Or non-rooted Android, for that matter.

Someone shared this lovely iOS app yesterday:

DNSCloak • DNSCrypt DoH client by Sergey Smirnov https://itunes.apple.com/ca/app/dnscloak-dnscrypt-doh-client...

It supports DNSCrypt, DNSSEC and DNS-over-HTTPS, the IAP are for tips :)

It works via running a VPN server on your device.

To change your normal plaintext DNS resolver just tap the circle-i on your WiFi network.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#347

Post by hartator »

chrissnell wrote: post #330
hartator wrote: post #320

Earlier quoted context omitted.

If you are on ethernet, I am able to get 1-2ms pings. On same AT&T Fiber Gigabit. Wifi ruins both bandwidth and latency for me.

I'm on Ethernet and fiber all the way. This may have to do more with how AT&T has constructed their fiber in this region. Where do you live? https://chrissnell.com/hn/traceroute-1.1.1.1.png

Austin, TX.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#348

Post by adityapatadia »

hartator wrote: post #344

I would love using better DNS resolvers like this than crappy ISP provided ones. My only complain is when you connect to public wifi that requires to display some wifi capture page, acceptance of ToS, to sign in with your room number, airliner wifi, etc. Usually they break when you don't use their automated provided DNS servers. Requiring you to remove your preferred DNS entries, waiting for the wifi popup to open, d…

Put this DNS in your home router and not directly in your PC. Now your PC will fetch DNS at your home from this fast DNS and on pubic wifi, it will use theirs.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#349

Post by tony101 »

lallysingh wrote: post #319
chiefalchemist wrote: post #315

Three novice questions, please: 1) A VPN gives you privacy but this prevents your ISP from even knowing you're using a VPN, correct? 2) This is a change you make to your wifi router, correct? 3) What is you're not on wifi, or you're using public wifi, is it possible to still benefit from this? Thanks in advance. I'll wait for my answers off the air :)

1) These requests are all in the clear, so your isp can read them and see which hosts you're asking for. VPNs provide better privacy (assuming you choose a private one). 2) yup 3) often. You can set it on your computer, but some public WiFi systems will block it.

To add to #1, your ISP can also see that you're using OpenVPN or another VPN protocol.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#350

Post by prdonahue »

RKearney wrote: post #342

How was Cloudflare able to get a wildcard certificate with IP Address SANs added to it? How do I obtain one from DigiCert because I don't see the option on their site.

Fun fact: they had never issued an IPv6 SAN before (which Safari fails to validate due to a bug).

Try browsing to https://[2606:4700:4700::1111] with desktop Safari. (It's a known issue and we're working with Apple to get it fixed.)

Post reply on HN