1.1.1.1: Fast, privacy-first consumer DNS service • Hacker News Board

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#351

Post by driverdan » Sun, Apr 01, 2018, 6:27 PM UTC

Here's how to use it with DNS-over-HTTPS on OS X / MacOS:

    brew install dnscrypt-proxy
    Change line 25 in /usr/local/etc/dnscrypt-proxy.toml to server_names = ['cloudflare']
    sudo brew services restart dnscrypt-proxy

Then change your DNS server to 127.0.0.1 (run Network pref panel, unlock, Advanced, DNS)

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#352

Post by hartator » Sun, Apr 01, 2018, 6:27 PM UTC

aexaey wrote: post #281

dieulot wrote: post #144

Earlier quoted context omitted.

The most useful case for this shortcut is 127.1 -> 127.0.0.1

0 , which is a shorthand for 0.0.0.0 is likely the most code-golf-y way to write localhost , as many [EDIT: Linux] systems alias 0.0.0.0 to 127.0.0.1: $ ping 0 PING 0 (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.032 ms Of course, don't expect this to work universally. A lot of software will try to be clever with input validation, and fail. Tangentially related: https://fosdem.or…

It's not fully true that 127.0.0.1 is the same as 0.0.0.0. For example, binding a webserver to 0.0.0.0 make it on the public network while 127.0.0.1 is strictly localhost.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#353

Post by adityapatadia » Sun, Apr 01, 2018, 6:30 PM UTC

https://dns.watch/ this is also good one. Proved to be better than Google for me.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#354

Post by bedros » Sun, Apr 01, 2018, 6:31 PM UTC

how would you setup https with DNS?

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#355

Post by deeebug » Sun, Apr 01, 2018, 6:32 PM UTC

anjbe wrote: post #294

Lately I’ve been thinking about some concerns about domain name privacy: • My ISP can spoof DNS responses. • My ISP can sniff DNS requests. • My ISP can sniff SNI. • My ISP can look up reverse DNS on the IPs I visit. DNS over TLS is nice—I just set up Unbound on my router to use 1.1.1.1@853 and 1.0.0.1@853 as forwarding zones. That eliminates the first bullet, at the cost of allowing CloudFlare to track my DNS reques…

What’s your threat model? The latency you’re going to introduce with TOR will make everyday browsing slow

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#356

Post by prdonahue » Sun, Apr 01, 2018, 6:32 PM UTC

gsich wrote: post #193

sofaofthedamned wrote: post #90

Earlier quoted context omitted.

Good to know, thank you!

Haven't tried this with Lets Encrypt, but would be nice if this worked there aswell.

They don't support this.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#357

Post by [deleted] » Sun, Apr 01, 2018, 6:32 PM UTC

[deleted]

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#358

Post by d33 » Sun, Apr 01, 2018, 6:33 PM UTC

hsivonen wrote: post #295

Operyl wrote: post #278

Earlier quoted context omitted.

If this were to become an issue, I guess Cloudflare could try to disable SNI.

The client sends SNI, so how could the server opt out?

Server could advertise no need to use SNI in advance. Or we could do SNI after actually establishing an encrypted session...

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#359

Post by jads » Sun, Apr 01, 2018, 6:34 PM UTC

adityapatadia wrote: post #348

hartator wrote: post #344

I would love using better DNS resolvers like this than crappy ISP provided ones. My only complain is when you connect to public wifi that requires to display some wifi capture page, acceptance of ToS, to sign in with your room number, airliner wifi, etc. Usually they break when you don't use their automated provided DNS servers. Requiring you to remove your preferred DNS entries, waiting for the wifi popup to open, d…

Put this DNS in your home router and not directly in your PC. Now your PC will fetch DNS at your home from this fast DNS and on pubic wifi, it will use theirs.

Some ISPs and their routers don't allow for the DNS settings to be changed, unfortunately. Still can be worked around, but sometimes the easiest solution is to just edit the DNS settings directly.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#360

Post by RKearney » Sun, Apr 01, 2018, 6:35 PM UTC

cmurf wrote: post #335

A big PITA for me right now with friends and family is changing DNS. They all have these Xfinity cable modem boxes that have integrated WiFi and Ethernet. It's not possible to change the DNS through the web interface. So I have to convince everyone to buy a separate AP or a 3rd party (but ISP approved) cable modem, and then what ensues is I'm now responsible for that device because Xfinity washes their hands entirely…

I'm not sure which modem you have, but the Cisco modem I used to use with the built-in WiFi just as you describe absolutely has the ability to go in and edit the DNS servers assigned by DHCP under Connection > Local IP Network.

I also have the remote access enabled for my family members so I can diagnose and make changes like this directly on their modem.