Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS servers that offer privacy and filtering

danielmiessler.com

Post reply on HN
Print view View original

21–30 of 95 posts

Re: DNS servers that offer privacy and filtering

#21

Post by prepend »

snazz wrote: post #13
sangaya wrote: post #10

https://pi-hole.net/ is a project to consider for home and small business networks that you're looking to protect via DNS without sending all your requests to a third party.

Your requests are still forwarded to a third party with a Pi-hole. They are sometimes cached and sites you have blocked do not resolve, but choosing a DNS provider is still required.

Only non-cached requests go to a third party. And I don’t think there’s an easy way to prevent this unless you get a hold of all the zone files and copy in bulk.

What’s nice about pi-hole is that you get one request to sites like google.com until the record expires in the cache. If you use 8.8.8.8 as your dns you might end up requesting the same domain name a bunch of times depending on how your client caches and the caching is at 8.8.8.8. So dns will see lots of requests to the same domain.

Re: DNS servers that offer privacy and filtering

#22

Post by 300bps »

skrause wrote: post #9

The best tip is in the sidebar on that page: > 1.0.0.1 abbreviates to 1.1, so you can literally test by typing "ping 1.1"

IP addresses are fundamentally 32 bit numbers. The a.b.c.d format is just for ease of use on humans and as the tip in the sidebar shows has its own shortcuts. But there are several formats that most operating systems support such as decimal, binary, hex, octal:

https://www.abuseipdb.com/tools/ip-address-converter?ip=1.1....

Re: DNS servers that offer privacy and filtering

#23

Post by kryogen1c »

snazz wrote: post #13
sangaya wrote: post #10

https://pi-hole.net/ is a project to consider for home and small business networks that you're looking to protect via DNS without sending all your requests to a third party.

Your requests are still forwarded to a third party with a Pi-hole. They are sometimes cached and sites you have blocked do not resolve, but choosing a DNS provider is still required.

Shout out to OpenDNS, who my company uses and whom I made a free account with.

Re: DNS servers that offer privacy and filtering

#24

Post by kakarot »

kingo55 wrote: post #15
krylon wrote: post #2

I know this is not for everyone, but I strongly prefer to run my own recursive resolver at home. Performance is great, plus I get regular DNS for the machines on my home network. Also, it was a fun little project. :)

More people should do this. I recently switched my home network DNS forwarder from Bind to DNS Crypt Proxy ( https://github.com/jedisct1/dnscrypt-proxy ). You can get ad/content filtering lists along with some little privacy enhancements like DNS Crypt and DNS over HTTPS support for encrypted DNS queries to supported services, like CloudFlare.

Even with DNS/HTTPS and such, wouldn't using a home DNS resolver with a VPN on both ends of the connection still make you a little more vulnerable to network analysis and timing attacks since your DNS requests are guaranteed to go through a specific IP which only serves you?

Re: DNS servers that offer privacy and filtering

#27

Post by bluejekyll »

tinus_hn wrote: post #20
johnchristopher wrote: post #11

Earlier quoted context omitted.

So, what should we ping for testing Internet connectivity ?

You are better off using traceroute to one of these addresses, you should at least get some route outside of your own network.

Traceroute uses ICMP as well, and may send more packets then ping. It works by setting the TTL on the ICMP packet, which is the number of route hops to traverse before the packet is dropped. Routers are supposed to ( this can be disabled, and is why you get * * * sometimes) respond with a TTL expired. So it starts with a TTL of 1, and then increments by 1 after each hop is discovered (or no response in some timeout).

Re: DNS servers that offer privacy and filtering

#29

Post by dx034 »

prepend wrote: post #21
snazz wrote: post #13

Earlier quoted context omitted.

Your requests are still forwarded to a third party with a Pi-hole. They are sometimes cached and sites you have blocked do not resolve, but choosing a DNS provider is still required.

Only non-cached requests go to a third party. And I don’t think there’s an easy way to prevent this unless you get a hold of all the zone files and copy in bulk. What’s nice about pi-hole is that you get one request to sites like google.com until the record expires in the cache. If you use 8.8.8.8 as your dns you might end up requesting the same domain name a bunch of times depending on how your client caches and the…

In a network of just a few computers, are there really that many cached requests? Local DNS caches will already cache short term and TTL of most domains is probably too short to get much caching beyond that.

Re: DNS servers that offer privacy and filtering

#30

Post by throwaway9d0291 »

flox25 wrote: post #28

So the author is a security expert who recommends two companies that are notorious for their security flaws (Norton, Cisco), two companies that track your DNS queries for profiling (Google, Cloudflare) and IBM... Yeah, this sounds totally legit...

> two companies that track your DNS queries for profiling (Google, Cloudflare)

Can you elaborate? Neither Google nor CloudFlare seem to collect information for profiling.

Google: https://developers.google.com/speed/public-dns/privacy

CloudFlare: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

Post reply on HN