A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy
1–10 of 47 posts
Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy
#2The privacy noted here appears to essentially boil down to “from Cloudflare” right now, and comes at the risk of leaking DNS queries to other third-parties who are often more inclined to act maliciously towards your privacy and are not committed against doing so.
Be sure that you trust your “over the wire” connection to not sniff and uniquely tag all of your DNS requests with your specific identifying information, such as Verizon and many other service provides often do.
Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy
#3I thought this was someone else providing an anonymized dns proxy at first, but it's just how to set up your own proxy. Not sure this saves anything over just using DoH to one of the listed providers directly (the requests still come from something you own and can technically be traced back to you, albeit with more effort?)
edit: I'm wondering what the ideal setup actually is. Would the root servers need to provide DoH endpoints?
Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy
#4A quick bug report: you do not need to set up renewals in cron. In the certbot ppa (and Debian, and thus Ubuntu), they're automatically set up for you at the time of install using both cron and systemd timers.
Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy
#5The privacy noted here appears to essentially boil down to “from Cloudflare” right now, and comes at the risk of leaking DNS queries to other third-parties who are often more inclined to act maliciously towards your privacy and are not committed against doing so. Be sure that you trust your “over the wire” connection to not sniff and uniquely tag all of your DNS requests with your specific identifying information, su…
You only get privacy from Cloudflare 3/4 of the time, as their resolver is one of the four requests are proxied to.
Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy
#6I thought that regardless of dns provider, you can't stop the ip destination. No doubt there's real-time recording of what domain points to what ip. It's harder for your local syaadmin probably, but not much further.
Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy
#7The privacy noted here appears to essentially boil down to “from Cloudflare” right now, and comes at the risk of leaking DNS queries to other third-parties who are often more inclined to act maliciously towards your privacy and are not committed against doing so. Be sure that you trust your “over the wire” connection to not sniff and uniquely tag all of your DNS requests with your specific identifying information, su…
You only get privacy from Cloudflare 3/4 of the time, as their resolver is one of the four requests are proxied to.
The idea is that resolvers just know it's coming from the EC2 instance/etc rather than knowing your personal IP.
Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy
#8I thought that regardless of dns provider, you can't stop the ip destination. No doubt there's real-time recording of what domain points to what ip. It's harder for your local syaadmin probably, but not much further.
Indeed, that and SNI[1] make this whole DoH thing pretty pointless for privacy IMHO --- if you are seriously concerned about your ISP monitoring your traffic, tunnel everything through a VPN that exits into the Internet somewhere else. It seems more like an effort to frustrate host-based adblocking more than anything.
[1] Looking at SNI is even more accurate, since DNS lookups don't necessarily (but often) mean a connection to that host will be made; a TLS handshake, on the other hand, means a connection is being made.
Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy
#9I thought this was someone else providing an anonymized dns proxy at first, but it's just how to set up your own proxy. Not sure this saves anything over just using DoH to one of the listed providers directly (the requests still come from something you own and can technically be traced back to you, albeit with more effort?) edit: I'm wondering what the ideal setup actually is. Would the root servers need to provide D…
The "more effort" part was what I was going for -- no nation state or warrant-holding organization is going to be stymied by this, but as a personal/home user, I'd rather DoH resolvers not be able to tie my lookups to my personal IP which is doubtless held in many other cross-referencable locations (in my case, home-network wide proxying or Tor isn't feasible).
Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy
#10I thought that regardless of dns provider, you can't stop the ip destination. No doubt there's real-time recording of what domain points to what ip. It's harder for your local syaadmin probably, but not much further.
Indeed, that and SNI[1] make this whole DoH thing pretty pointless for privacy IMHO --- if you are seriously concerned about your ISP monitoring your traffic, tunnel everything through a VPN that exits into the Internet somewhere else. It seems more like an effort to frustrate host-based adblocking more than anything. [1] Looking at SNI is even more accurate, since DNS lookups don't necessarily (but often) mean a con…
Encrypted SNI exists.
https://blog.cloudflare.com/encrypted-sni/
I doubt DoH is a ploy to break adblocking; if you don’t control the device making the requests they could already do plenty of things to break crude adblocking techniques like that. (Nevermind the fact that one of its biggest supporters is Mozilla.)
Stating that this is pointless for privacy seems like an exaggeration. Sure its not a panacea, but for probably 80% of sites, the destination IP tells you you are headed to Amazon or Cloudflare. Besides that, why reveal more information than less, and why not remove unencrypted, easily manipulated network traffic? Personally, I aim to eliminate unencrypted traffic on my networks.