41–50 of 95 posts
Surprised that 4.2.2.x (Level3) is not on the list --- it's also unfiltered DNS, and run by a company that focuses only on networking.
Earlier quoted context omitted.
> two companies that track your DNS queries for profiling (Google, Cloudflare) Can you elaborate? Neither Google nor CloudFlare seem to collect information for profiling. Google: https://developers.google.com/speed/public-dns/privacy CloudFlare: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
What? How do you come to that conclusion? Google actually tells you what it is collecting, if you cannot see how, say, city of origin, cannot be used to target you with specific search result, then I really cannot explain it to you. Cloudflare does not store any information, but they are pretty frank about passing it on to APNIC for "research" as part of the deal where APNIC lend the 1.0.0.1 and 1.1.1.1 address to th…
For the record, we don't build any sort of profile of DNS queryiers, map them back to any existing profile we have, or even keep the data you would need to have to do that.
Do I have to?
Actually, no. Even if one does accept the premise that one should use these third-party non-contracted services, challenged elsewhere in this very discussion, there's no reason that one need have these things memorized. Written in a handy pocketbook, perhaps. But not necessarily memorized.
DNS servers should not be used as "internet connectivity tests" by pinging them. They are not maintained as ICMP test servers, and that is not their purpose. While many do not block ICMP packets, there are typically rate limiting systems in place, and other reasons why they would not respond to ping requests. Pinging DNS servers is a shitty inconclusive test for internet connectivity, or SLA measurements etc etc.
TL;DR: At the risk of repeating myself: Google Public DNS is a Domain Name System service, not an ICMP network testing service.
Hotels and ISPs sometimes set up captive portals that intercept and redirect port 53 to their own choice of DNS servers.
As such, users might want memorise the addresses of some resolvers that listen on non-standard ports (not port 53).
A user behind one of these captive portals who pings any of the resolvers in this blog post will not be pinging those servers; she will be pinging the hotel/ISP's chosen DNS servers and she may be none the wiser.
Earlier quoted context omitted.
You are better off using traceroute to one of these addresses, you should at least get some route outside of your own network.
Traceroute uses ICMP as well, and may send more packets then ping. It works by setting the TTL on the ICMP packet, which is the number of route hops to traverse before the packet is dropped. Routers are supposed to ( this can be disabled, and is why you get * * * sometimes) respond with a TTL expired. So it starts with a TTL of 1, and then increments by 1 after each hop is discovered (or no response in some timeout).
I believe this is because you need root privileges/special capabilities to send ICMP packets.
I configured DNScrypt on Tomato and I also use Tomato to redirect all DNS requests so it can't be bypassed by simply re-pointing DNS. VPN obviously bypasses it.
Earlier quoted context omitted.
Traceroute uses ICMP as well, and may send more packets then ping. It works by setting the TTL on the ICMP packet, which is the number of route hops to traverse before the packet is dropped. Routers are supposed to ( this can be disabled, and is why you get * * * sometimes) respond with a TTL expired. So it starts with a TTL of 1, and then increments by 1 after each hop is discovered (or no response in some timeout).
On unixes, traceroute typically uses UDP by default (nowadays, ICMP is often an option, as are TCP SYN packets). Windows' tracert uses ICMP. I believe this is because you need root privileges/special capabilities to send ICMP packets.
Earlier quoted context omitted.
More people should do this. I recently switched my home network DNS forwarder from Bind to DNS Crypt Proxy ( https://github.com/jedisct1/dnscrypt-proxy ). You can get ad/content filtering lists along with some little privacy enhancements like DNS Crypt and DNS over HTTPS support for encrypted DNS queries to supported services, like CloudFlare.
Even with DNS/HTTPS and such, wouldn't using a home DNS resolver with a VPN on both ends of the connection still make you a little more vulnerable to network analysis and timing attacks since your DNS requests are guaranteed to go through a specific IP which only serves you?
Having traffic analysis in your threat model is an extreme choice, typically it means your adversaries include law enforcement agencies or state-level actors. Sending DNS over VPN might just mean that you don’t trust your ISP and think they might intercept the request and forge a response—something which does happen, and I’ve personally observed it at two different ISPs.