Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

dohproxy.com

Post reply on HN
Print view View original

21–30 of 47 posts

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#21

Post by laforge »

jkingsman wrote: post #9
kylek wrote: post #3

I thought this was someone else providing an anonymized dns proxy at first, but it's just how to set up your own proxy. Not sure this saves anything over just using DoH to one of the listed providers directly (the requests still come from something you own and can technically be traced back to you, albeit with more effort?) edit: I'm wondering what the ideal setup actually is. Would the root servers need to provide D…

The "more effort" part was what I was going for -- no nation state or warrant-holding organization is going to be stymied by this, but as a personal/home user, I'd rather DoH resolvers not be able to tie my lookups to my personal IP which is doubtless held in many other cross-referencable locations (in my case, home-network wide proxying or Tor isn't feasible).

I‘m wondering if the effort and costs are worth it. I‘d like to think that my DoH provider (cloudflare) is probably one of the more trustworthy parties involved when browsing the web. Every website is still tracking and selling your ip and services like google analytics combine them to build a profile. Correct me if I‘m wrong

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#22

Post by gog »

jkingsman wrote: post #7
goatsi wrote: post #5

Earlier quoted context omitted.

You only get privacy from Cloudflare 3/4 of the time, as their resolver is one of the four requests are proxied to.

The idea is that resolvers just know it's coming from the EC2 instance/etc rather than knowing your personal IP.

They know the personal IP as well since it's being passed in the "X-Forwarded-For" header by nginx.

Having a local recursive resolver with the Client Subnet in DNS Queries turned off would be better for privacy.

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#23

Post by anon9001 »

jkingsman wrote: post #9
kylek wrote: post #3

I thought this was someone else providing an anonymized dns proxy at first, but it's just how to set up your own proxy. Not sure this saves anything over just using DoH to one of the listed providers directly (the requests still come from something you own and can technically be traced back to you, albeit with more effort?) edit: I'm wondering what the ideal setup actually is. Would the root servers need to provide D…

The "more effort" part was what I was going for -- no nation state or warrant-holding organization is going to be stymied by this, but as a personal/home user, I'd rather DoH resolvers not be able to tie my lookups to my personal IP which is doubtless held in many other cross-referencable locations (in my case, home-network wide proxying or Tor isn't feasible).

It's definitely feasible. Old hardware + 2 network cards + pfsense makes a router that can do network-wide VPN. Even a lot of prosumer routers can do VPNs now, but I'm not sure how well it works.

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#24

Post by mike-cardwell »

This setup does the opposite of what they're hoping to do, and is the exact reason that Tor implemented "Entry Guards".

If there is any pattern in the DNS queries you perform (e.g you visit certain sites regularly), then all of a sudden there are now going to be four additional organisations that know your browsing habbits, on top of your existing one (your ISP).

Imagine you go to pornhub.com every day. Your ISP knows that you're doing that today because of your DNS lookups, and they will still know that after the deployment of DOH and ESNI, because like millions of other websites, pornhub doesn't share their IP addresses. But now all of a sudden, you'll be telling cloudflare one day that you go to pornhub, google the next day, opendns the next day, and 42l the next day.

Why do people insist on increasing the number of organisations with access to their browsing history, in the name of privacy?

Don't set up or use this system.

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#25

Post by lolc »

mike-cardwell wrote: post #24

This setup does the opposite of what they're hoping to do, and is the exact reason that Tor implemented "Entry Guards". If there is any pattern in the DNS queries you perform (e.g you visit certain sites regularly), then all of a sudden there are now going to be four additional organisations that know your browsing habbits, on top of your existing one (your ISP). Imagine you go to pornhub.com every day. Your ISP know…

I agree that there is little gain in hiding DNS traffic from your ISP. And like you I'm wondering what the benefit of spreading around one's DNS profile should be. I think it's better to just pick the DNS provider one distrusts the least.

But once you use DoH using a private DNS proxy does in fact provide (some) protection because it detaches one's client address from the requests. Breaking this requires timing correlation or individual domain names for tracking.

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#26

Post by mike-cardwell »

lolc wrote: post #25
mike-cardwell wrote: post #24

This setup does the opposite of what they're hoping to do, and is the exact reason that Tor implemented "Entry Guards". If there is any pattern in the DNS queries you perform (e.g you visit certain sites regularly), then all of a sudden there are now going to be four additional organisations that know your browsing habbits, on top of your existing one (your ISP). Imagine you go to pornhub.com every day. Your ISP know…

I agree that there is little gain in hiding DNS traffic from your ISP. And like you I'm wondering what the benefit of spreading around one's DNS profile should be. I think it's better to just pick the DNS provider one distrusts the least. But once you use DoH using a private DNS proxy does in fact provide (some) protection because it detaches one's client address from the requests. Breaking this requires timing corre…

Why set up a private DNS proxy when you can (arguable more easily) set up a private VPN, which protects all of your traffic instead? A quick "apt install unbound" on the VPN server will give you a private recursive DNS resolver which supports DNSSEC, and you'll be communicating with that over the VPN, so DoH gives you nothing...

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#27

Post by andyjohnson0 »

Today's Guardian has a piece [1] on Firefox's DNS over HTTP and how Mozilla has no plans yet to make it the default in the UK. Most of the article is about how it breaks centralised web filtering, and has concerned-sounding quotes from child protection organisations. Probably a predictable slant for a general readership publication to take, but it is concerning that use of DoH might be being framed solely as enabling criminality. As someone who lives in the UK and who enabled it several months ago for privacy (anti-tracking) reasons, I'm going to have to keep an eye on this.

[1] https://www.theguardian.com/technology/2019/sep/24/firefox-n...

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#28

Post by madisfun »

Round-robin and privacy do not dwell well together. Like mike-cardwell pointed out in another comment, it just distributes the same information to more parties.

As there has to be at least party which will know the request, some information will be leaked. But what can be prevented, is giving "unrelated" requests in the hands of the same resolver. Few of the request per se are interesting, the combinations of them allow to build user profiles.

The policy should not be round robin, but somehow based on the domain itself, so that all requests about the same domain go to the same resolver, but to nobody else.

An even better mechanism would take into account who is the owner and the controller of the domain. So that requests about, let say, facebook.com and fbsbx.com land at the same resolver, but github.com and microsoft.com by another.

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#29

Post by t0astbread »

andyjohnson0 wrote: post #27

Today's Guardian has a piece [1] on Firefox's DNS over HTTP and how Mozilla has no plans yet to make it the default in the UK. Most of the article is about how it breaks centralised web filtering, and has concerned-sounding quotes from child protection organisations. Probably a predictable slant for a general readership publication to take, but it is concerning that use of DoH might be being framed solely as enabling…

Couldn't the UK just work together with popular DoH providers to implement filtering in a clean way?

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#30

Post by t0astbread »

mike-cardwell wrote: post #26
lolc wrote: post #25

Earlier quoted context omitted.

I agree that there is little gain in hiding DNS traffic from your ISP. And like you I'm wondering what the benefit of spreading around one's DNS profile should be. I think it's better to just pick the DNS provider one distrusts the least. But once you use DoH using a private DNS proxy does in fact provide (some) protection because it detaches one's client address from the requests. Breaking this requires timing corre…

Why set up a private DNS proxy when you can (arguable more easily) set up a private VPN, which protects all of your traffic instead? A quick "apt install unbound" on the VPN server will give you a private recursive DNS resolver which supports DNSSEC, and you'll be communicating with that over the VPN, so DoH gives you nothing...

When you set up a private VPN to tunnel your traffic through, doesn't your VPN server just become your client? Or am I missing something here?
Post reply on HN