1.1.1.1: Fast, privacy-first consumer DNS service • Hacker News Board

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#231

Post by Andre_Wanglin » Sun, Apr 01, 2018, 3:52 PM UTC

ocdtrekkie wrote: post #225

JD557 wrote: post #176

I wish that they talked a bit more about their stance regarding censorship. They have a small paragraph talking about the problem, but they don't talk about the "solution". While Cloudflare has been pretty neutral about censoring sites in the past (notably, pirate sites), the Daily Stormer incident put them in a though spot[1]. They talk a bit about Project Galileo (the link is broken BTW, it should be https://www.cl…

Bear in mind, they dropped Daily Stormer because they were claiming Cloudflare agreed with their ideology. Which someone in the previous discussion pointed out was a Terms of Service violation. DNS resolving offers no such terms and no such reason to make such a claim. I don't see that playing here. And bear in mind, when the CEO did it, he wrote about how dangerous it was that companies had that power. I don't feel…

>because they were claiming Cloudflare agreed with their ideology.

That was a lie. It was a commenter on an article.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#232

Post by markonen » Sun, Apr 01, 2018, 3:54 PM UTC

xioxox wrote: post #212

markonen wrote: post #197

Earlier quoted context omitted.

Not really. Typically the query includes much more information (the site you want to visit) than the response (an IP potentially shared by thousands or millions of sites).

Even with https, the name of the site is sent in clear when the connection to the site is established (this is SNI).

Back when they chose this design for SNI, I’m sure someone argued that it was fine because DNS had already leaked the hostname anyway :)

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#233

Post by IshKebab » Sun, Apr 01, 2018, 3:54 PM UTC

tyingq wrote: post #220

bluejekyll wrote: post #146

DNS-over-HTTPS doesn’t make as much sense to me as DNS-over-TLS. They are effectively the same thing, but HTTPS has the added overhead of the HTTP headers per request. If you look at the currently in progress RFC, https://tools.ietf.org/html/draft-ietf-doh-dns-over-https-04 , this is quite literally the only difference. The DNS request is encoded as a standard serialized DNS packet. The article mentions QUIC as being…

Dns over https would be harder for governments and other middleman to block or intercept, despite it being less efficient. It would look like any other https request. Especially if browsers agreed to universally support it.

No it wouldn't. They're both encrypted with the same method so they can't tell whether http is used or not.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#234

Post by wila » Sun, Apr 01, 2018, 3:55 PM UTC

ancarda wrote: post #128

dorfsmay wrote: post #126

What about ipv6? There were rumours that they were getting 2001:2001:: and 2001:2001:2001::, but I can neither ping those addresses not use them to resolve.

https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1... 2606:4700:4700::1111 2606:4700:4700::1001 Not as memorable, unfortunately.

2606:4700:4700::1111

You could make it slightly more memorable by decoding from hex to ascii, but that does not help too much either in this case:

& ACK:G NUL: G NUL::1111

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#235

Post by auxym » Sun, Apr 01, 2018, 3:56 PM UTC

bogomipz wrote: post #113

tialaramex wrote: post #17

Earlier quoted context omitted.

"We will never log your IP address (the way other companies identify you). And we’re not just saying that. We’ve retained KPMG to audit our systems annually to ensure that we're doing what we say." Now, audits are generally not worth very much (even, perhaps even especially, from a Big Four group like KPMG), but for this type of thing (verifying that a company isn't doing something they promised they would not do) th…

>"Now, audits are generally not worth very much (even, perhaps even especially, from a Big Four group like KPMG)" Indeed, see the recent KPMG scandal: https://www.marketwatch.com/story/kpmg-indictment-suggests-m...

They were also implicated in tax evasion schemes in Canada.

http://www.cbc.ca/news/business/canada-revenue-kpmg-secret-a...

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#236

Post by IshKebab » Sun, Apr 01, 2018, 3:56 PM UTC

WhitneyLand wrote: post #211

bluejekyll wrote: post #146

DNS-over-HTTPS doesn’t make as much sense to me as DNS-over-TLS. They are effectively the same thing, but HTTPS has the added overhead of the HTTP headers per request. If you look at the currently in progress RFC, https://tools.ietf.org/html/draft-ietf-doh-dns-over-https-04 , this is quite literally the only difference. The DNS request is encoded as a standard serialized DNS packet. The article mentions QUIC as being…

How is any of this more secure against your ISP in any case given someone willing to do reverse lookup‘s on IP addresses? If someone controls routers is it not nearly useless? So for example all mobile 4g providers could laugh at this and build a nearly as good database of every site you visit?

Reverse DNS is a lot more difficult than just intercepting DNS requests. Especially with virtual hosts, caching proxies and so on.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#237

Post by [deleted] » Sun, Apr 01, 2018, 4:03 PM UTC

[deleted]

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#238

Post by slowsun » Sun, Apr 01, 2018, 4:04 PM UTC

> What many Internet users don't realize is that even if you're visiting a website that is encrypted — has the little green lock in your browser — that doesn't keep your DNS resolver from knowing the identity of all the sites you visit. That means, by default, your ISP, every wifi network you've connected to, and your mobile network provider have a list of every site you've visited while using them.

> Network operators have been licking their chops for some time over the idea of taking their users' browsing data and finding a way to monetize it.

The "1.1.1.1 stops ISPs/Starbucks from selling your browsing history" pitch is untrue and, given Cloudflare's expertise, seems disingenuous.

HTTPS transmits domains unencrypted in request headers, to support SNI. So even if DNS lookups are completely hidden, my ISP can still log all domains I visit by inspecting my HTTP(S) requests.

And the domain log from my web requests is more valuable than my DNS log. Advertisers and data aggregators can see the true timing and frequency of my browsing history, whereas a DNS log is affected by router/OS/browser lookup caching.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#239

Post by mastax » Sun, Apr 01, 2018, 4:04 PM UTC

If you want to figure out what the fastest DNS server is for you, I suggest this freeware utility https://www.grc.com/dns/benchmark.htm

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#240

Post by ebikelaw » Sun, Apr 01, 2018, 4:06 PM UTC

tssva wrote: post #230

ebikelaw wrote: post #173

There’s more to dns performance than query time. Cloudflare doesn’t seem to be sending the EDNS client subnet to authoritative resolvers, which means those resolvers can’t give sensible nearest-to-client responses. This is a crucial feature of what makes the modern web fast.

It would be hard to claim to be a dns service which helps protect your privacy while also forwarding your subnet info on to other DNS servers. Cloudflare has a large number of PoPs and are increasing them rapidly. If the service is distributed to them all than the authoritative server is likely to give a response that is similar to that it would have provided if the subnet had been explicitly provided since the Cloud…

What exactly is the privacy threat model in this situation? If you are about to connect to the resolved service it makes no difference that you hid your subnet from that service’s DNS server.