11–20 of 47 posts
A quick bug report: you do not need to set up renewals in cron. In the certbot ppa (and Debian, and thus Ubuntu), they're automatically set up for you at the time of install using both cron and systemd timers.
Earlier quoted context omitted.
Indeed, that and SNI[1] make this whole DoH thing pretty pointless for privacy IMHO --- if you are seriously concerned about your ISP monitoring your traffic, tunnel everything through a VPN that exits into the Internet somewhere else. It seems more like an effort to frustrate host-based adblocking more than anything. [1] Looking at SNI is even more accurate, since DNS lookups don't necessarily (but often) mean a con…
Encrypted SNI exists. https://blog.cloudflare.com/encrypted-sni/ I doubt DoH is a ploy to break adblocking; if you don’t control the device making the requests they could already do plenty of things to break crude adblocking techniques like that. (Nevermind the fact that one of its biggest supporters is Mozilla.) Stating that this is pointless for privacy seems like an exaggeration. Sure its not a panacea, but for pr…
I thought this was someone else providing an anonymized dns proxy at first, but it's just how to set up your own proxy. Not sure this saves anything over just using DoH to one of the listed providers directly (the requests still come from something you own and can technically be traced back to you, albeit with more effort?) edit: I'm wondering what the ideal setup actually is. Would the root servers need to provide D…
The "more effort" part was what I was going for -- no nation state or warrant-holding organization is going to be stymied by this, but as a personal/home user, I'd rather DoH resolvers not be able to tie my lookups to my personal IP which is doubtless held in many other cross-referencable locations (in my case, home-network wide proxying or Tor isn't feasible).
The privacy noted here appears to essentially boil down to “from Cloudflare” right now, and comes at the risk of leaking DNS queries to other third-parties who are often more inclined to act maliciously towards your privacy and are not committed against doing so. Be sure that you trust your “over the wire” connection to not sniff and uniquely tag all of your DNS requests with your specific identifying information, su…
You only get privacy from Cloudflare 3/4 of the time, as their resolver is one of the four requests are proxied to.
I thought this was someone else providing an anonymized dns proxy at first, but it's just how to set up your own proxy. Not sure this saves anything over just using DoH to one of the listed providers directly (the requests still come from something you own and can technically be traced back to you, albeit with more effort?) edit: I'm wondering what the ideal setup actually is. Would the root servers need to provide D…
The privacy noted here appears to essentially boil down to “from Cloudflare” right now, and comes at the risk of leaking DNS queries to other third-parties who are often more inclined to act maliciously towards your privacy and are not committed against doing so. Be sure that you trust your “over the wire” connection to not sniff and uniquely tag all of your DNS requests with your specific identifying information, su…
You only get privacy from Cloudflare 3/4 of the time, as their resolver is one of the four requests are proxied to.
Earlier quoted context omitted.
The "more effort" part was what I was going for -- no nation state or warrant-holding organization is going to be stymied by this, but as a personal/home user, I'd rather DoH resolvers not be able to tie my lookups to my personal IP which is doubtless held in many other cross-referencable locations (in my case, home-network wide proxying or Tor isn't feasible).
I wonder if it'd be feasible to proxy only the DNS requests over Tor. Maybe set up your network-level DNS proxy to route upstream queries through a Tor tunnel to a different DNS-over-HTTPS resolver. Perhaps even have the DNS proxy cache DNS records and proactively revalidate commonly used ones to avoid most of the latency overhead of Tor.
[0] https://en.m.wikipedia.org/wiki/Unbound_(DNS_server)#Feature...
Earlier quoted context omitted.
Indeed, that and SNI[1] make this whole DoH thing pretty pointless for privacy IMHO --- if you are seriously concerned about your ISP monitoring your traffic, tunnel everything through a VPN that exits into the Internet somewhere else. It seems more like an effort to frustrate host-based adblocking more than anything. [1] Looking at SNI is even more accurate, since DNS lookups don't necessarily (but often) mean a con…
Encrypted SNI exists. https://blog.cloudflare.com/encrypted-sni/ I doubt DoH is a ploy to break adblocking; if you don’t control the device making the requests they could already do plenty of things to break crude adblocking techniques like that. (Nevermind the fact that one of its biggest supporters is Mozilla.) Stating that this is pointless for privacy seems like an exaggeration. Sure its not a panacea, but for pr…
Edit: And Cloudflare‘s own service mitigates the use of IP addresses to identify sites, since (AFAIK) all Cloudflare-wrapped sites are accessed via the same IP. Of course, this is only an improvement if you trust Cloudflare.