Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1.1.1.1 for Families

blog.cloudflare.com

Post reply on HN
Print view View original

161–170 of 171 posts

Re: 1.1.1.1 for Families

#161

Post by 8fingerlouie »

legrande wrote: post #115
8fingerlouie wrote: post #3

Looks like a great alternative to NextDNS if you can do without any special configuration. For me, NextDNS is still better. I can setup separate DNS zones for adults, children, IOT, etc. and it works across networks (unlike Pihole/AdguardHome). I can also setup DNS forwards for each zone.

NextDNS is great and all, but it's another third party that could be handing your data over to god knows who. PiHole is local and I don't have to worry about my data being misused.

PiHole also performs upstream DNS lookups, which could also be handed over to 3rd parties, be that Google (8.8.8.8), or Cloudflare (1.1.1.1), or even your own ISP.

With NextDNS you at least have a TOS that specifies

"1. We do not (and will never) sell, license, sublicense or share any of the data submitted directly or indirectly by our users with any person or entity. NextDNS Inc. is an independent company 100% funded, owned and controlled by its founders and will never engage in any data sharing or selling activities, now or in the future."

As well as the option to keep logs in the EU, and thus place it under the GDPR, and since IP traffic information is generally classified as PIM, it will be covered.

Re: 1.1.1.1 for Families

#162

Post by _nalply »

b215826 wrote: post #11

I used to use 1.1.1.1 till the day I realized that it doesn't resolve archive.is [1]. I don't particularly care what the details are, whose fault it is, etc., but as an end user, I see this a major problem because with 1.1.1.1 if my browser is unable to resolve a domain, I wouldn't know if it's my DNS's fault or if it's the site's without an explicit check. I also don't care much for family "protection", so right now…

It seems that archive.is doesn't want to support 1.1.1.1 requests.

Solution: Resolve archive.is yourself if you want to use 1.1.1.1. For example with a host file, pihole, dnmasq, whatever. Look up archive.is once with a different DNS server then create a manual record for archive.is. Whatever.

Finally you could write a script to do this automatically in regular intervals to your taste.

Re: 1.1.1.1 for Families

#163

Post by kenmacd »

saurik wrote: post #150
ViViDboarder wrote: post #120

Earlier quoted context omitted.

Because DNS is still largely unencrypted. Nation state actors can read that information and map who is making requests for what domains. It’s not so much a concern of the site host from getting the users IP, because the user is presumably going to visit it. This is an issue with Archive.is because they host their own DNS, not their web server.

I am sorry, can you explain this to me step by step? My computer makes a DNS request through Cloudflare, which forwards a request to archive.is's DNS server which is apparently going out of its way to carefully prevent anyone from figuring out that I wanted to access archive.is... and then my computer ruins all of that by making a direct connection to archive.is's web server. If you are a "nationstate actor" able to…

The IP you connect to could host 1000 sites. Leaking which one you're actually accessing could be important.

Re: 1.1.1.1 for Families

#164

Post by nobody9999 »

radicaldreamer wrote: post #159
nobody9999 wrote: post #139

Earlier quoted context omitted.

>I don't think my ISP can easily intercept the content of DoT DNS requests. No. But they can intercept connections to the IP addresses returned by such DNS queries. >They would need a valid certificate for 1.1.1.1#cloudflare-dns.com or 9.9.9.9#dns.quad9.net from a trusted (by me) CA, correct? In order to MiTM such requests, yes. >Now obviously that's not impossible but is a VPN any better in that scenario? You're onl…

You can use eero secure+, which will intercept dns requests at the gateway to prevent devices and apps from bypassing the set dns servers. I won't work for apps which hardcore their own DoH/DoT clients and use their own servers, however.

>You can use eero secure+, which will intercept dns requests at the gateway to prevent devices and apps from bypassing the set dns servers.

I'm not familiar with eero secure+, but why would I want to pay for something like that, when a single firewall egress[0] rule can block outbound DNS requests that come from sources other than the "set dns servers"?

Note that I'm not trying to denigrate eero secure+, I don't know anything about it except that it's some sort of cloud-based (read: someone else's servers) security application.

I'm merely pointing out that limiting outbound DNS requests to specific hosts is trivial.

[0] https://en.wikipedia.org/wiki/Egress_filtering

Re: 1.1.1.1 for Families

#165

Post by jwalton »

Since I see from your domain name that you are in Canada, might I suggest Canadian Shield[0] from CIRA (the .ca registry) as an alternative to 1.1.1.1?

I have an article about setting it up via PiHole, too[1].

[0]: https://www.cira.ca/cybersecurity-services/canadian-shield

[1]: http://www.thedreaming.org/2020/11/07/pihole/

Re: 1.1.1.1 for Families

#166

Post by omegalulw »

drexlspivey wrote: post #17

I had to stop using 1.1.1.1 because I am getting rate limited when using their “cloudflared” dns-over-https proxy. My pretty modest home network and the various services running make 20-25k queries per day and I get a lot of REFUSED responses. Google on the other hand has no problem serving all of them. I even set a local cache to bypass the dns TTL but the problem is that sometimes 10 or more queries arrive at the s…

Why can't you not set up a local DNS on any PC backed by 1.1.1.1 if you really want to stay with Cloudflare?

Re: 1.1.1.1 for Families

#167

Post by unityByFreedom »

_fat_santa wrote: post #113
vultour wrote: post #21

I know they consider "1.1.1.1" to also be a product name, but it's very confusing when the text says 1.1.1.1 50 times, and then there's 2 mentions of "Oh, the service is at 1.1.1.2".

They laid it out pretty simply in the article: 1.1.1.1 - General 1.1.1.2 - No Malware 1.1.1.3 - No adult content Personally I like how they laid this out, makes it super easy to remember.

I like it too. If Cloudflare posts become the impetus for reading the article, all the better. Their posts are well written and they don't burden the reader with what the editor wants you to know after hooking you with a headline.

Re: 1.1.1.1 for Families

#168

Post by unityByFreedom »

_l4jh wrote: post #77
b215826 wrote: post #11

I used to use 1.1.1.1 till the day I realized that it doesn't resolve archive.is [1]. I don't particularly care what the details are, whose fault it is, etc., but as an end user, I see this a major problem because with 1.1.1.1 if my browser is unable to resolve a domain, I wouldn't know if it's my DNS's fault or if it's the site's without an explicit check. I also don't care much for family "protection", so right now…

If you run a pi-hole create a config file in /etc/dnsmasq.d such as 02-archive.is.conf with the following server=/archive.is/8.8.8.8 server=/archive.is/8.8.4.4 server=/archive.li/8.8.8.8 server=/archive.li/8.8.4.4 server=/archive.to/8.8.8.8 server=/archive.to/8.8.4.4 server=/archive.today/8.8.8.8 server=/archive.today/8.8.4.4 And restart dnsmasq (or just reboot the pi) This will resolve the common archive.is domains…

I just installed pi-hole and it says version 4 doesn't use dnsmasq anymore [1].

edit: Nevermind, your configuration worked. I verified after flushing DNS cache that archive.is was at first inaccessible, and now after a pihole reboot it does resolve. Thanks!

I wonder if this is another way to set up the same thing with PiHole's "FTL-DNS" [2]

[1] https://docs.pi-hole.net/ftldns/dns-resolver/

[2] https://docs.pi-hole.net/ftldns/configfile/#pihole_ptr

Re: 1.1.1.1 for Families

#169

Post by kd913 »

CharlesW wrote: post #74
kd913 wrote: post #39

Why is this here? It was launched last year? Also, people should really be using Dnscrypt-proxy/DoH/DoT. Otherwise it's really easy for your ISP just to read/capture your DNS requests.

> Why is this here? It was launched last year? FWIW, I'm one of today's lucky 10,000 and am thankful to have seen it.

If this is new for you, please look into a pihole + Dnscrypt-proxy setup instead.

Re: 1.1.1.1 for Families

#170

Post by so_throwaway »

skrebbel wrote: post #34
so_throwaway wrote: post #18

Earlier quoted context omitted.

This is irrelevant, no one using a VPN is also configuring a 'family-friendly' DNS resolver.

Why not? I use a VPN to give my half-Danish children access to Danish TV from outside Denmark, and I also have, well, children who I might want to protect against evil content such as nipples. I don't do the latter but that has little to do with the fact that I use a VPN sometimes and more to do with the fact that we're not American and American ideas of what's "family friendly" feel extremely alien to us. In fact, g…

I mean, you don't seem to be a counter-example to the claim that "no one using a VPN is also configuring a 'family-friendly' DNS resolver".
Post reply on HN