Google Public DNS Now Supports DNS-Over-TLS • Hacker News Board

Re: Google Public DNS Now Supports DNS-Over-TLS

#11

Post by FrederickZh » Thu, Jan 10, 2019, 4:58 PM UTC

_nhynes_ wrote: post #3

Here's the stubby config if anyone is interested: # Google - address_data: 8.8.8.8 tls_auth_name: "dns.google" tls_pubkey_pinset: - digest: "sha256" value: nxmRHK4Oq08HNWWYZwakeCHmiKvsDsEaBPS3blQ+nSE= - address_data: 8.8.4.4 tls_auth_name: "dns.google" tls_pubkey_pinset: - digest: "sha256" value: nxmRHK4Oq08HNWWYZwakeCHmiKvsDsEaBPS3blQ+nSE= where the pinset is generated using openssl s_client -connect '8.8.8.8:853' 2…

Got no idea why but it seems actually two different certificates are used? Base64 digest of the other one is

  A8J84S7EER8rZJ/IQ6MsYW7heNY939jWL7IpOLrj+VM=

And I wonder whether we should actually add the digests into stubby configs? One of the certificates expires in February and other one expires in March. Does it mean that we have to update the configs then?

Re: Google Public DNS Now Supports DNS-Over-TLS

#12

Post by Proven » Thu, Jan 10, 2019, 5:00 PM UTC

londons_explore wrote: post #7

bewo001 wrote: post #6

Earlier quoted context omitted.

This is a DNS provided by Google, a company that earns money by analysing user data. If you want privacy, run your own DNS.

Google has specifically stated that logs from Google DNS are not retained long term, and will never be correlated from logs from other Google services. I trust those claims.

So in other words

1) Google can still be subpoenaed to share your logs with the government

2) The user's queries are hidden from those who can't analyze them effectively and still open to those who analyze them better than anyone

Cloudflare and 1.1.1.1 are much more sensible choices for the provider of this service

Re: Google Public DNS Now Supports DNS-Over-TLS

#13

Post by m_sahaf » Fri, Jan 11, 2019, 12:21 AM UTC

pedrocx486 wrote: post #9

Anyone has a good guide on setting up DNS-Over-TLS on Windows? I've only did something similar before on Debian and seems I'm quite dumb when it comes to doing this on Windows.

Use NSSM (the Non-Sucking Service Manager)[0] in combination with CoreDNS[1] and the configuration I posted.

[0] https://nssm.cc/

[1] https://coredns.io/

Re: Google Public DNS Now Supports DNS-Over-TLS

#14

Post by londons_explore » Fri, Jan 11, 2019, 11:08 AM UTC

_8j50 wrote: post #10

londons_explore wrote: post #7

Earlier quoted context omitted.

Google has specifically stated that logs from Google DNS are not retained long term, and will never be correlated from logs from other Google services. I trust those claims.

Why do you trust those claims? And why can't they change their mind?

I trust the claims because Googles business depends so heavily on PR. If Google leaks everyone's browsing history, they as a company will cease to exist.

Notice how there are lots of people claiming 'Google collects XYZ info', but no claims of 'Google zipped up XYZ info and sold it'. Every article about Google selling user data is in reality Google using the user data for it's advertising business, but explicitly not letting the partners see the data - as well as being legally protected private data, that data is also a competitive advantage they would lose if they handed it over.

Less public facing companies on the other hand I don't trust, because they don't have much to loose on the PR front. That miscellaneous credit card processor? Yeah - they'll probably be handing your data over to every credit check/profiling agency.

Re: Google Public DNS Now Supports DNS-Over-TLS

#15

Post by pedrocx486 » Sat, Jan 12, 2019, 3:29 PM UTC

m_sahaf wrote: post #13

pedrocx486 wrote: post #9

Anyone has a good guide on setting up DNS-Over-TLS on Windows? I've only did something similar before on Debian and seems I'm quite dumb when it comes to doing this on Windows.

Use NSSM (the Non-Sucking Service Manager)[0] in combination with CoreDNS[1] and the configuration I posted. [0] https://nssm.cc/ [1] https://coredns.io/

Really nice! Thank you!