1.1.1.1: Fast, privacy-first consumer DNS service • Hacker News Board

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#271

Post by azinman2 » Sun, Apr 01, 2018, 4:42 PM UTC

chimera77 wrote: post #202

bluejekyll wrote: post #146

DNS-over-HTTPS doesn’t make as much sense to me as DNS-over-TLS. They are effectively the same thing, but HTTPS has the added overhead of the HTTP headers per request. If you look at the currently in progress RFC, https://tools.ietf.org/html/draft-ietf-doh-dns-over-https-04 , this is quite literally the only difference. The DNS request is encoded as a standard serialized DNS packet. The article mentions QUIC as being…

One of the use cases for DNS-over-HTTPS given in the draft was to allow web applications access to DNS directly via existing browser APIs.

Ok that’s actually pretty cool.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#272

Post by lenova » Sun, Apr 01, 2018, 4:43 PM UTC

Is there a way to use Cloudflare's new DNS servers with Simple DNSCrypt? (https://simplednscrypt.org/)

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#273

Post by kzrdude » Sun, Apr 01, 2018, 4:43 PM UTC

vimda wrote: post #11

ajross wrote: post #3

This is the Cloudflare resolver, right? What's the "privacy-first" part about? It's just another third party DNS host. They haven't changed the protocol to be uninspectable and AFAIK haven't made any guarantees about logging or whatnot that would enhance privacy vs. using whatever you are now. This just means you're trusting Cloudflare instead of Comcast or Google or whoever.

Did you read the page? They're supporting DNS over TLS and DNS over HTTPS - both changes to the protocol to make in uninspectable. They've also said they're not logging IP info and they're getting independent auditors in to confirm what they're saying. Sounds trustworthy to me

It seems like bait-and-switch though? They tell about DNS over https and dns without logging, and then direct to an installation instruction where you can learn to start to use, "DNS without logging", but nothing that's encrypted? What am I missing?

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#274

Post by jedisct1 » Sun, Apr 01, 2018, 4:47 PM UTC

lenova wrote: post #272

Is there a way to use Cloudflare's new DNS servers with Simple DNSCrypt? ( https://simplednscrypt.org/ )

Yes, just select "Cloudflare" in the list.

It's been available in the public list for quite some time already.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#275

Post by myth_buster » Sun, Apr 01, 2018, 4:48 PM UTC

nubela wrote: post #19

$ ping 1.1.1.1 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=47 time=214.866 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=47 time=173.416 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=45 time=256.007 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=45 time=196.638 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=45 time=294.694 ms 64 bytes from 1.1.1.1: icmp_seq=5 ttl=45 time=314.883 ms 64 bytes from 1.1.1.1: ic…

Colorado, US

1.1.1.1 round-trip min/avg/max/stddev = 10.984/12.221/14.909/1.239 ms

8.8.8.8 round-trip min/avg/max/stddev = 11.022/12.702/15.102/1.317 ms

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#276

Post by jedisct1 » Sun, Apr 01, 2018, 4:48 PM UTC

vinniejames wrote: post #267

How does this service, with DNS-over-HTTPS or DNS-over-TLS, compare to something like DNS Crypt? https://www.opendns.com/about/innovations/dnscrypt/

https://dnscrypt.info/faq/

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#277

Post by [deleted] » Sun, Apr 01, 2018, 4:48 PM UTC

[deleted]

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#278

Post by Operyl » Sun, Apr 01, 2018, 4:49 PM UTC

gsnedders wrote: post #261

bluejekyll wrote: post #219

Earlier quoted context omitted.

When we add TLS on top of the protocol, ISPs can only filter based on port at that point. We can run DNS on 443 if that helps, but as you said, static well-known IPs can then be blocked. > I imagine most of the benefit is surely to people who can spin up their own resolvers. There are already many easily run DNS resolvers available. Is there a benefit you see in operating them over HTTPS that improves on that?

> When we add TLS on top of the protocol, ISPs can only filter based on port at that point. And SNI… :(

If this were to become an issue, I guess Cloudflare could try to disable SNI.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#279

Post by rhabarba » Sun, Apr 01, 2018, 4:51 PM UTC

I cannot trust a service provided by a company which implies that Tor users are mostly bad people. No, thanks.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#280

Post by jhanschoo » Sun, Apr 01, 2018, 4:51 PM UTC

dictum wrote: post #48

shimms wrote: post #9

Earlier quoted context omitted.

Yes they have: "Privacy First: Guaranteed. We will never sell your data or use it to target ads. Period. We will never log your IP address (the way other companies identify you). And we’re not just saying that. We’ve retained KPMG to audit our systems annually to ensure that we're doing what we say. Frankly, we don’t want to know what you do on the Internet—it’s none of our business—and we’ve taken the technical step…

> Frankly, we don’t want to know what you do on the Internet—it’s none of our business In the DNS resolver space, what is their business?

Traffic from heavily censored regimes to its big customers, which often end up being censored due to user contributions, I suppose.