$ ping 1.1.1.1 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=47 time=214.866 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=47 time=173.416 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=45 time=256.007 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=45 time=196.638 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=45 time=294.694 ms 64 bytes from 1.1.1.1: icmp_seq=5 ttl=45 time=314.883 ms 64 bytes from 1.1.1.1: ic…
I get roughly the same 45-48ms from the EU for both.
1.1.1.1: Fast, privacy-first consumer DNS service
31–40 of 695 posts
Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#32Today I learned that it is possible to request a certificate for an IP address.
The Baseline Requirements agreed between Web Browser vendors and root Certificate Authorities dictate how the CA can figure out if an applicant is allowed a certificate for a particular name, for dnsNames this is the Ten Blessed Methods, for ipAddress the rules are a bit... eh, rusty, but the idea is you can't get one for that dynamic IP you have from your cable provider for 24 hours, but somebody who really controls the IP address can get one. They're uncommon, but not rare, maybe a dozen a day are issued?
Your web browser requires that the name in the URL exactly matches the name in the certificate. So if you visit https://some-dns-server.example/ the certificate needs to be for some-dns-server.example (or *.example) and a certificate for 1.1.1.1 doesn't work, even if some-dns-server.example has IP address 1.1.1.1 - so this cert is only useful because they want people actually typing https://1.1.1.1/ into browsers...
[edited, I have "Servers" on the brain, it's _Subject_ Alternative Name, you can use them to name email recipients, and lots of things that aren't servers]
Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#33$ ping 1.1.1.1 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=47 time=214.866 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=47 time=173.416 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=45 time=256.007 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=45 time=196.638 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=45 time=294.694 ms 64 bytes from 1.1.1.1: icmp_seq=5 ttl=45 time=314.883 ms 64 bytes from 1.1.1.1: ic…
PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=60 time=2.099 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=60 time=2.073 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=60 time=1.963 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=60 time=2.089 ms PING 8.8.8.8 (8.8.8.8): 56 data bytes 64 bytes from 8.8.8.8: icmp_seq=0 ttl=60 time=1.908 ms 64 bytes from 8.8.8.8: icmp_seq=1 ttl=60 time=1.888 ms 64 bytes from…
ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1): 56 data bytes
64 bytes from 1.1.1.1: icmp_seq=0 ttl=59 time=3.111 ms
64 bytes from 1.1.1.1: icmp_seq=1 ttl=59 time=3.172 ms
64 bytes from 1.1.1.1: icmp_seq=2 ttl=59 time=3.301 ms
64 bytes from 1.1.1.1: icmp_seq=3 ttl=59 time=3.018 ms
64 bytes from 1.1.1.1: icmp_seq=4 ttl=59 time=3.218 ms
^C
--- 1.1.1.1 ping statistics ---
5 packets transmitted, 5 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 3.018/3.164/3.301/0.096 ms
fwiw Google DNS is around the same, 2.942ms average.Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#34This is the Cloudflare resolver, right? What's the "privacy-first" part about? It's just another third party DNS host. They haven't changed the protocol to be uninspectable and AFAIK haven't made any guarantees about logging or whatnot that would enhance privacy vs. using whatever you are now. This just means you're trusting Cloudflare instead of Comcast or Google or whoever.
Did you read the page? They're supporting DNS over TLS and DNS over HTTPS - both changes to the protocol to make in uninspectable. They've also said they're not logging IP info and they're getting independent auditors in to confirm what they're saying. Sounds trustworthy to me
What is intriguing to me is why Cloudflare are offering this. Perhaps it is to provide data on traffic that is 'invisible' to them, as in it doesn't currently touch their networks. Possibly as a sales-lead generator.
Or is the plan to become dominant and then use DNS blackholing to shutdown malware that is a threat to their systems?
Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#35uhm how can you get an ssl cert for an IP?
https://stackoverflow.com/questions/1095780/are-ssl-certific...
Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#36$ ping 1.1.1.1 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=47 time=214.866 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=47 time=173.416 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=45 time=256.007 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=45 time=196.638 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=45 time=294.694 ms 64 bytes from 1.1.1.1: icmp_seq=5 ttl=45 time=314.883 ms 64 bytes from 1.1.1.1: ic…
Pinging 8.8.8.8 with 32 bytes of data:
Reply from 8.8.8.8: bytes=32 timeReply from 8.8.8.8: bytes=32 time=1ms TTL=57
Reply from 8.8.8.8: bytes=32 timeReply from 8.8.8.8: bytes=32 timePinging 1.1.1.1 with 32 bytes of data:
Reply from 1.1.1.1: bytes=32 time=6ms TTL=57
Reply from 1.1.1.1: bytes=32 time=6ms TTL=57
Reply from 1.1.1.1: bytes=32 time=6ms TTL=57
Reply from 1.1.1.1: bytes=32 time=6ms TTL=57
(Switzerland)
Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#37Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#38$ ping 1.1.1.1 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=47 time=214.866 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=47 time=173.416 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=45 time=256.007 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=45 time=196.638 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=45 time=294.694 ms 64 bytes from 1.1.1.1: icmp_seq=5 ttl=45 time=314.883 ms 64 bytes from 1.1.1.1: ic…
Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#39; > DiG 9.8.3-P1 > dailystormer.name @1.1.1.1 ;; global options: +cmd ;; Got answer: ;; ->>HEADER;; QUESTION SECTION: ;dailystormer.name. IN A
;; ANSWER SECTION: dailystormer.name. 86400 IN A 198.251.90.113
;; AUTHORITY SECTION: dailystormer.name. 86400 IN NS f1g1ns1.dnspod.net. dailystormer.name. 86400 IN NS f1g1ns2.dnspod.net.
;; ADDITIONAL SECTION: f1g1ns1.dnspod.net. 70157 IN A 58.247.212.36 f1g1ns1.dnspod.net. 70157 IN A 61.151.180.44 f1g1ns1.dnspod.net. 70157 IN A 180.163.19.15 f1g1ns1.dnspod.net. 70157 IN A 182.140.167.166 f1g1ns1.dnspod.net. 70157 IN A 14.215.150.17 f1g1ns2.dnspod.net. 70157 IN A 61.129.8.159 f1g1ns2.dnspod.net. 70157 IN A 101.226.220.16 f1g1ns2.dnspod.net. 70157 IN A 121.51.128.164 f1g1ns2.dnspod.net. 70157 IN A 182.140.167.188 f1g1ns2.dnspod.net. 70157 IN A 52.220.136.67
;; Query time: 550 msec ;; SERVER: 1.1.1.1#53(1.1.1.1) ;; WHEN: Sun Apr 1 -:-:- 2018 ;; MSG SIZE rcvd: 265
Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#40 sudo networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1