Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Choosing a Public DNS Resolver

evilbit.de

Post reply on HN
Print view View original

121–130 of 143 posts

Re: Choosing a Public DNS Resolver

#121

Post by krick »

aetherspawn wrote: post #82

Use your ISPs official DNS so that you get the shortest path possible from the ISPs handoff location to the CDN (and overseas trunks), not a generic DNS that doesn’t know about your ISPs layout. ISP: 1ms to Cloudflare Cloudflare: 10ms to Cloudflare Thank you for your attention to this matter. Edit: will clarify, this advice applies to countries with good privacy laws and no national surveillance i.e. not the USA

Are these even real countries at this point? Also, it's not even about privacy, AFAIK pretty much any country will try to protect you from accessing something they don't like you to access, and in most cases it's some half-assed attempt to do so, like your ISP's default DNS directing you to some warning page instead of actually opening the website you were going to open. So changing your ISPs DNS to something like 8.8.8.8, while it doesn't necessarily increase privacy, is the first major step to improve your browsing experience.

Re: Choosing a Public DNS Resolver

#122

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #113

Why only 29 Is the author suggesting this represents the actual number of open resolvers on today's internet How can any consideration of "privacy" or "security" of DNS not also consider SNI SNI allows third parties to see when the user tries to connect to an address published for a domain name. It can allow third parties to interfere with such connections DNS only allows third parties to see when a user looks up an…

ECH is not generally available to www users aside from a few "test" sites

It is not clear to whom the term "you" refers in the author's reply

As for myself, I do not use remote DNS except to periodically retrieve bulk DNS data. When I am accessing HTTP servers I do not make remote DNS requests. I already have the IP address information I need. For me, this is faster and more reliable

I store bulk DNS data, obtained from a variety of sources, loaded into the memory of local TLS forward proxies

Every user is different and each user should think for themselves

Re: Choosing a Public DNS Resolver

#123

Post by abcdefg12 »

kev009 wrote: post #56
abcdefg12 wrote: post #52

Earlier quoted context omitted.

Downside is privacy

Versus letting a singular entity snoop everything? If you actually open a connection to the result what is the difference? The only way to fully deal with all that is an overlay or mixnets.

ISP snooping vs encrypted scatter to a bunch of dnscrypt resolvers

Re: Choosing a Public DNS Resolver

#125

Post by abcdefg12 »

exiguus wrote: post #66
abcdefg12 wrote: post #53

Earlier quoted context omitted.

And your isp can record all your queries

Do you mean when communicating directly with a root DNS server over unencrypted UDP or TCP? You're right. There's currently no universal way to encrypt direct queries to root DNS servers. To work around this, the best approach is to host your own public DNS server outside your untrusted ISPs network and connect to it securely using DoH, DoQ, or DoT. Alternatively, you can rely on a trusted third-party public DNS prov…

That’s fine if you don’t care about privacy as long as you’re conscious about that. Dnscrypt is simple enough to use otherwise

Re: Choosing a Public DNS Resolver

#126

Post by tredre3 »

marginalia_nu wrote: post #98
aetherspawn wrote: post #82

Use your ISPs official DNS so that you get the shortest path possible from the ISPs handoff location to the CDN (and overseas trunks), not a generic DNS that doesn’t know about your ISPs layout. ISP: 1ms to Cloudflare Cloudflare: 10ms to Cloudflare Thank you for your attention to this matter. Edit: will clarify, this advice applies to countries with good privacy laws and no national surveillance i.e. not the USA

Changing your DNS does basically bupkis for privacy, since they can still read your DNS queries and SNIs.

If I set my DNS provider to use DoH or DoT, my ISP will no longer see my DNS requests. I'm confident that my ISP doesn't do DPI at scale to extract SNI, so the lack of ECH doesn't break the entirety of the privacy benefit.

The fact that they could perform DPI doesn't change the reality that most ISPs probably aren't doing it, unless mandated by law, because it's expensive and in my main country of residence they can't sell that data to offset the cost.

I'm surprised to see such lack of nuance coming from you.

Re: Choosing a Public DNS Resolver

#127

Post by abcdefg12 »

Bender wrote: post #72
abcdefg12 wrote: post #51

Earlier quoted context omitted.

There is a bunch of public dnscrypt servers to which your client can randomly fan out encrypted queries.

There are but I will wait until all the authoritative resolvers support TLS. If I wanted to hide my traffic from my ISP then I would just use DoT from my firewall Unbound instance to a few Unbound instances I already have around the web.

« I’ll keep my house door open until there is a really secure lock installed ». You either care about tampering and snooping or you don’t.

Re: Choosing a Public DNS Resolver

#128

Post by Bender »

abcdefg12 wrote: post #127
Bender wrote: post #72

Earlier quoted context omitted.

There are but I will wait until all the authoritative resolvers support TLS. If I wanted to hide my traffic from my ISP then I would just use DoT from my firewall Unbound instance to a few Unbound instances I already have around the web.

« I’ll keep my house door open until there is a really secure lock installed ». You either care about tampering and snooping or you don’t.

I understand your concerns. I personally do not share these concerns though I did when I resided in California that is for sure.

I know just about everyone at my ISP. I know where many of them live. We all live in the same small tight knit community. They tried really hard to get me to join their network team.

Re: Choosing a Public DNS Resolver

#129

Post by Bender »

TacticalCoder wrote: post #101
Bender wrote: post #5

I use Unbound locally as a DoH server. The Alpine Linux Unbound package is compiled with libnghttp2, required for the built in DoH listener . That's more than enough to enable ECH [1]. I pre-cache all the domains I use hourly via cron. My ISP is not going to dork with my DNS requests and their employees are bigger deviants than I. If I ever started browsing the web from a phone I would just set up my own public DoH s…

I run unbound too here. I love it that it takes wildcards to blacklist domains. I'm using big lists of domains to block and then I've got a whitelist that supercedes the blocked ones. And I've got a little tool that takes: ayt7.ads.acme.com afi6.ads.acme.com foi5.ads.acme.com and simplifies it to: ads.acme.com Then I've got a script which generates variations of domains name I use. Say if I use: mybank.com (legit) I…

It sounds like we share some similar tactics. Some day you should make an article about your setup.

Re: Choosing a Public DNS Resolver

#130

Post by Marsymars »

aetherspawn wrote: post #82

Use your ISPs official DNS so that you get the shortest path possible from the ISPs handoff location to the CDN (and overseas trunks), not a generic DNS that doesn’t know about your ISPs layout. ISP: 1ms to Cloudflare Cloudflare: 10ms to Cloudflare Thank you for your attention to this matter. Edit: will clarify, this advice applies to countries with good privacy laws and no national surveillance i.e. not the USA

In practice, performance will probably be better overall with a DNS that blocks ad servers.
Post reply on HN