Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS servers that offer privacy and filtering

danielmiessler.com

Post reply on HN
Print view View original

51–60 of 95 posts

Re: DNS servers that offer privacy and filtering

#51

Post by flox25 »

zackbloom wrote: post #42
flox25 wrote: post #36

Earlier quoted context omitted.

What? How do you come to that conclusion? Google actually tells you what it is collecting, if you cannot see how, say, city of origin, cannot be used to target you with specific search result, then I really cannot explain it to you. Cloudflare does not store any information, but they are pretty frank about passing it on to APNIC for "research" as part of the deal where APNIC lend the 1.0.0.1 and 1.1.1.1 address to th…

I work at Cloudflare. APNIC absolutely does not get individual DNS query logs. Their primary interest is in studying the other junk traffic which ends up hitting 1.1.1.1. For the record, we don't build any sort of profile of DNS queryiers, map them back to any existing profile we have, or even keep the data you would need to have to do that.

Well, for me to believe that there still is such a thing as a free lunch, you'll have to be better than that.

If the data sent to APNIC is so safe and non-personal, why not make it transparent? Instead, when contacting APNIC about it, you get a typical one liner stating that

> ... the access to the primary data feed will be strictly limited to the researchers in APNIC Labs, and we will naturally abide by APNIC's non-disclosure policies.

Clearly, someone thinks there is something to hide. Maybe not Cloudflare, but then it's someone else.

Re: DNS servers that offer privacy and filtering

#52

Post by miyuru »

> If you care about privacy and speed and maximum memorability, I recommend CloudFlare

I disagree with the speed part, because cloudflare doesn't support EDNS. This is great for privacy but not for speed.

Here is proof: https://pastebin.com/raw/QnbWXU1a

If he meant speed in the DNS resolution context, I somewhat agree with him.

Re: DNS servers that offer privacy and filtering

#53

Post by Tor3 »

3xblah wrote: post #46

His blog post pays no mention of users whose DNS queries are being redirected. Isn't that a privacy concern? Hotels and ISPs sometimes set up captive portals that intercept and redirect port 53 to their own choice of DNS servers. As such, users might want memorise the addresses of some resolvers that listen on non-standard ports (not port 53). A user behind one of these captive portals who pings any of the resolvers…

In a hotel I always first thing direct everything through a VPN server (work or home, depending on what I want to do). Some hotels block UDP, in that case I switch the VPN to go via TCP port 443. But some hotels (really!) block port 443.. fortunately not that many anymore.

Re: DNS servers that offer privacy and filtering

#54

Post by kakarot »

klodolph wrote: post #50
kakarot wrote: post #24

Earlier quoted context omitted.

Even with DNS/HTTPS and such, wouldn't using a home DNS resolver with a VPN on both ends of the connection still make you a little more vulnerable to network analysis and timing attacks since your DNS requests are guaranteed to go through a specific IP which only serves you?

Not sure what timing attacks you are talking about. Having traffic analysis in your threat model is an extreme choice, typically it means your adversaries include law enforcement agencies or state-level actors. Sending DNS over VPN might just mean that you don’t trust your ISP and think they might intercept the request and forge a response—something which does happen, and I’ve personally observed it at two different…

It's not in my threat model per se, but it's something I give a lot of thought to because systems like this are expected to be used by political dissidents, whistleblowers and other persecuted individuals who are subject to such threat models.

My ISP probably forges responses because they have no problem injecting html/js and hijacking ad space on unencrypted connections.

As far as timing attacks, an example would be such: Even though you are at a coffee shop in an undisclosed location miles away from home, if LE has a reason to profile the IP you're broadcasting from at home they could do look at request times and try to link a request from the coffee shop to your home DNS server.

If you use a public DNS server, you have the same benefit of using a public VPN vs a private VPN, in that your traffic gets bundled with everyone else's and obfuscated. It's harder to establish a link between you and the DNS server using network analysis because potentially thousands of connections are being made to that same DNS server from the same VPN node at the same time.

Re: DNS servers that offer privacy and filtering

#55

Post by ickwabe »

blakesterz wrote: post #12
palijer wrote: post #7

DNS servers should not be used as "internet connectivity tests" by pinging them. They are not maintained as ICMP test servers, and that is not their purpose. While many do not block ICMP packets, there are typically rate limiting systems in place, and other reasons why they would not respond to ping requests. Pinging DNS servers is a shitty inconclusive test for internet connectivity, or SLA measurements etc etc.

I've used the thing [0] from grc.com, is there other ways that are reliable as well? https://www.grc.com/dns/benchmark.htm

I use this as well. Found it very helpful.

Re: DNS servers that offer privacy and filtering

#56

Post by acranox »

krylon wrote: post #2

I know this is not for everyone, but I strongly prefer to run my own recursive resolver at home. Performance is great, plus I get regular DNS for the machines on my home network. Also, it was a fun little project. :)

That's great and all, but you still need to pick an upstream DNS server. The conventional advice is to use one of these public services, or your ISP's resolvers, to avoid hitting the root servers constantly. A lot of services these days have very short TTLs, so running your own recursive resolver still causes a lot of requests to get forwarded.

Also, as counterintuitive as it might seem, when I use namebench ( https://code.google.com/archive/p/namebench/ ) it still says cloudflare and google are faster than my local resolver. (not by a lot though)

Re: DNS servers that offer privacy and filtering

#57

Post by judge2020 »

flox25 wrote: post #51
zackbloom wrote: post #42

Earlier quoted context omitted.

I work at Cloudflare. APNIC absolutely does not get individual DNS query logs. Their primary interest is in studying the other junk traffic which ends up hitting 1.1.1.1. For the record, we don't build any sort of profile of DNS queryiers, map them back to any existing profile we have, or even keep the data you would need to have to do that.

Well, for me to believe that there still is such a thing as a free lunch, you'll have to be better than that. If the data sent to APNIC is so safe and non-personal, why not make it transparent? Instead, when contacting APNIC about it, you get a typical one liner stating that > ... the access to the primary data feed will be strictly limited to the researchers in APNIC Labs, and we will naturally abide by APNIC's non-…

> why not make it transparent?

I'm not with CF or APNIC, but it's likely due to issues with sensitive data.

Say a web service is hitting `http://internal.example.com:5220` with basic authentication, or there's a misconfigured jira trying to access `internal.example.com:3306`, but the DNS admins have retired `internal.example.com` and decided to make it return `1.1.1.1` for some reason. Showing all traffic that hits the service would expose a little too much sensitive information.

Re: DNS servers that offer privacy and filtering

#58

Post by nykolasz »

I need to point out that Norton DNS has been retired and is not supported anymore (and never offered any privacy).

"On November 15, 2018, Norton ConnectSafe service is being retired or discontinued meaning the service will no longer be available or supported. You may continue to use ConnectSafe until November 15, 2018. However, we do recommend that you take a moment to review important details related to this announcement below."

Some alternatives: https://medium.com/@nykolas.z/norton-connectsafe-dns-is-shut...

I am actually surprised he didn't mention CleanBrowsing in their list, which I would recommend as good alternative to Norton and OpenDNS.

Re: DNS servers that offer privacy and filtering

#59

Post by flox25 »

judge2020 wrote: post #57
flox25 wrote: post #51

Earlier quoted context omitted.

Well, for me to believe that there still is such a thing as a free lunch, you'll have to be better than that. If the data sent to APNIC is so safe and non-personal, why not make it transparent? Instead, when contacting APNIC about it, you get a typical one liner stating that > ... the access to the primary data feed will be strictly limited to the researchers in APNIC Labs, and we will naturally abide by APNIC's non-…

> why not make it transparent? I'm not with CF or APNIC, but it's likely due to issues with sensitive data. Say a web service is hitting ` http://internal.example.com:5220` with basic authentication, or there's a misconfigured jira trying to access `internal.example.com:3306`, but the DNS admins have retired `internal.example.com` and decided to make it return `1.1.1.1` for some reason. Showing all traffic that hits…

I have worked in a lot of companies and never have I seen anyone treat a DNS name as security relevant information. If you rely on DNS names not to be known as a measure of privacy and/or security, you clearly are doing it wrong. As a matter of fact, DNS names supposed to be known, it's their one and only purpose.

In addition, if "internal.example.com" is not already resolvable publicly (which would mean that it's known) CF could not guarantee the privacy of that query anyways because their DNS is not part of the root zone, which means they need to forward it to someplace beyond their control, meaning they leak it no matter what.

Re: DNS servers that offer privacy and filtering

#60

Post by wtmt »

I used OpenDNS long ago, even though it wasn't as easy to remember as the ones that came later. Then I shifted to Google DNS and stayed with it, albeit with some discomfort (even if the policies state it doesn't track, it's still a leap of faith for me). Then last year I switched to Cloudflare DNS and also learned about Quad9 DNS.

I haven't done local benchmarking using a tool like namebench for a long time, and it looks like that tool has not been updated for several years. Any alternatives for it that are cross platform?

Post reply on HN