Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1.1.1.1 for Families

blog.cloudflare.com

Post reply on HN
Print view View original

151–160 of 171 posts

Re: 1.1.1.1 for Families

#151

Post by tick_tock_tick »

tomklein wrote: post #141
fragmede wrote: post #140

Earlier quoted context omitted.

Yes. From a technical standpoint, archive.is' stance is that it's actually important useful data that, more importantly, isn't a privacy violation. How much you agree with archive.is depends on a very technical understanding of the subject, or barring that, it depends on how much you buy Cloudflare's reasoning. Cloudflare's business would prefer you pay for Cloudflare (at large but specifically their anycast) instead…

I coded a GeoDNS for a couple of my sites and Cloudflare‘s IPs are always geolocated to the nearest datacenters and works great in a GeoDNS setting. Also, what about DNS resolvers that don’t support EDNS at all?

The check archive.is uses to return garbage is specifically for cloudflare's IPs all other non-EDNS works fine. You can dig to there authoritative DNS server yourself to see.

Re: 1.1.1.1 for Families

#152

Post by saurik »

fragmede wrote: post #134
saurik wrote: post #110

Earlier quoted context omitted.

Can you explain the attack a bit more? One would (naively) expect that the process of the user connecting to my web server would expose their IP address (associated with their intent) to many more relevant actors (including "nationstate actors") than Cloudflare connecting to my DNS server... is the issue that the specific nationstate actor you have been concerned with is explicitly able to target and achieve surveill…

The "attack" is bad implementations revealing the whole IP, leaking that PII, to anybody watching DNS, instead of the query being masked to a /20, or some other subnet. Not all VPNs route DNS queries over the VPN for performance reasons. Thus, knowing that a specific IP is visiting dissident net when that cannot be directly observed is very useful.

Your "VPN fails to prevent my ISP from seeing the DNS request" attack is already prevented by using 1.1.1.1 with DNS-over-HTTPS even if Cloudflare gives your IP address, unencrypted, to the upstream DNS server, as the only party in question there is your local ISP. I am asking after some detail on the specific attack that Cloudflare is claiming they caught nationstate actors doing wherein it matters that Cloudflare's DNS requests leak my IP address, as the only scenario I can come up with where that matters is a hypothetical attacker that specifically is monitoring Cloudflare's egress (which frankly sounds relatively difficult due to scale) but not the website's ingress (which for a website of interest seems absolutely trivial) nor the user's egress (such as many countries now seem to do routinely), either of which trivially out the user's address and intent due to the browser making a direct socket connection to the result of the DNS query.

Re: 1.1.1.1 for Families

#153

Post by cnst »

smt88 wrote: post #94
cnst wrote: post #62

Earlier quoted context omitted.

Doesn't T-Mobile US offer home internet over 4G and 5G in most of the US now? I've actually been using tethering for home internet, and it's often faster and cheaper than landline alternatives. Easily get 100Mbps in my location over 4G LTE on an old phone.

I don't think I could make do with less than 1 Gb/s (currently gave 1.3). I have a ton of home automation, a few HD cameras, and household members who stream video (or play games) basically 24/7.

Aren't you a big enough player to have your own recursive DNS, then?

Plus, if you get so much bandwidth from your provider, are they really still messing about with your DNS?

Re: 1.1.1.1 for Families

#154

Post by Terretta »

8fingerlouie wrote: post #3

Looks like a great alternative to NextDNS if you can do without any special configuration. For me, NextDNS is still better. I can setup separate DNS zones for adults, children, IOT, etc. and it works across networks (unlike Pihole/AdguardHome). I can also setup DNS forwards for each zone.

You're not even mentioning that NextDNS blocks ads and trackers.

This release claims:

> * Since launching 1.1.1.1, the number one request we have received is to provide a version of the product that automatically filters out bad sites.*

Really? More asked for than ad blocking or tracker blocking?

Re: 1.1.1.1 for Families

#155

Post by cnst »

yjftsjthsd-h wrote: post #69
cnst wrote: post #61

Earlier quoted context omitted.

So, they basically still collect, log and process the exact same data as Google DNS, but disallow anyone else from having it, breaking legitimate uses of DNS for GeoIP targeting and DoS mitigation? How convenient!

> legitimate uses of DNS for GeoIP targeting and DoS mitigation What legitimate uses would those be, and how is DNS involved in DoS mitigation?

A good example is Cloudflare's own CDN business — they require you to delegate your domain name to their DNS servers by name, not by IP address with your own glue records on your own domain name. Because they want to be able to use all the resources available to stop DDoS, including EDNS Client Subnet provided by other resolvers.

Same goes for GeoIP — EDNS Client Subnet was specifically created for effective and cheap GeoIP. (BGP anycast isn't cheap.)

I mean, both issues are exactly why archive.is had to put the block in place. For sure both of these usecases are pretty legitimate.

BTW, what's the actual legitimate need to block ECS? After a domain name is resolved by DNS, you still have to connect directly to the hostname by an IP address, and your IP will be leaked — there's no way around this, that's how internet works. Cloudflare knowingly runs these marketing campaigns trying to obscure this simple fact that easily invalidates the need for their services, and invalidates the benefits of their service compared to competition.

Re: 1.1.1.1 for Families

#156

Post by dhaavi »

BatteryMountain wrote: post #112
BatteryMountain wrote: post #109

Well one of my domains resolves to some dodgy russian website when using cloudflare's dns. I did everything in my power, including trying to contact them, but it still resolves to the russian host. On any other dns server it resolves correctly to gandi's parking page. Cloudflare did send me an email within 10 seconds to say that no support ticket can/will be logged since I'm not a paying customer (or just customer on…

And the reason why it pissed me off was, I thought my mikrotik router or raspberry pi + pihole got compromised. I spent two hours trying to track down the problem, reset all dns setting on gandi, resetting and updating the router etc... just to find that it worked fine on my phone on MNO's network...then I digged further and found if I switch my dns to anything other than 1.1.1.1, it worked fine. So I don't care what…

Just tweet at the 1.1.1.1 account, it‘ll resolve for you on Twitter. ;P See https://twitter.com/1111Resolver

Re: 1.1.1.1 for Families

#157

Post by cnst »

GNOMES wrote: post #99

Any updates from Cloudflare on their replacement for EDNS that they are making with Google/Facebook/Netflix etc? https://news.ycombinator.com/item?id=19828317 ``We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation targeting witho…

It's a problem of their own making that doesn't require a solution.

After the client gets the IP address of the content web server from the DNS resolver, the client has to connect directly to the content web server, and the whole IP address — not just the subnet — is immediately shared with the content server anyways.

The market is supposed to regulate this abusive behaviour by showing how much slower the websites work when resolved through Cloudflare DNS compared to Google DNS or any other DNS providers that support EDNS Client Subnet. It seems that most of DNS benchmarks simply test how fast the names resolve, not how good of a resolution it is. So, it's a miss on the benchmark side.

Re: 1.1.1.1 for Families

#158

Post by fragmede »

nobody9999 wrote: post #103
Brybry wrote: post #95

Earlier quoted context omitted.

I use Pi-Hole + Unbound forwarding to Cloudflare/Quad9 over TLS. It would be nice if all servers supported DoT/DoH + DNSSEC and you could roll your own recursive DNS server and have more trust in traffic not being intercepted. Post-Snowden revelations I feel pretty confident that DNS requests in the clear are being surveilled. I don't know for sure that requests to Cloudflare or Quad9 are being surveilled.

>It would be nice if all servers supported DoT/DoH + DNSSEC and you could roll your own recursive DNS server and have more trust in traffic not being intercepted. I love DNSSEC, but am not in favor of DoH/DoT. Mostly because I can't control DoH/DoT requests emanating from my network, as they're already encrypted and can't be differentiated from standard HTTPS traffic. That's an issue (and will become a much bigger on…

Post-Snowden, the lesson is the NSA is doing their damnedest to watch American's activities online. I would bet money that they're doinf everything they can to watch Cloudflare, despite no direct evidence, because of course they are.

Re: 1.1.1.1 for Families

#159

Post by radicaldreamer »

nobody9999 wrote: post #139
Brybry wrote: post #129

Earlier quoted context omitted.

I don't think my ISP can easily intercept the content of DoT DNS requests. They would need a valid certificate for 1.1.1.1#cloudflare-dns.com or 9.9.9.9#dns.quad9.net from a trusted (by me) CA, correct? Now obviously that's not impossible but is a VPN any better in that scenario?

>I don't think my ISP can easily intercept the content of DoT DNS requests. No. But they can intercept connections to the IP addresses returned by such DNS queries. >They would need a valid certificate for 1.1.1.1#cloudflare-dns.com or 9.9.9.9#dns.quad9.net from a trusted (by me) CA, correct? In order to MiTM such requests, yes. >Now obviously that's not impossible but is a VPN any better in that scenario? You're onl…

You can use eero secure+, which will intercept dns requests at the gateway to prevent devices and apps from bypassing the set dns servers. I won't work for apps which hardcore their own DoH/DoT clients and use their own servers, however.

Re: 1.1.1.1 for Families

#160

Post by Tommek »

legrande wrote: post #114

Who bears the brunt of the task of collecting every adult/NSFW domain out there? Doesn't such a list grow by huge numbers each day? What is the name of this list, and where can I get it?

You know, for educational reasons ... :D
Post reply on HN