31–40 of 195 posts
Earlier quoted context omitted.
Some of us have no use for our ISP's DNS servers, due to government-mandated cencorship.
I was addressing "privacy". It sounds like you have other reasons to not use your ISPs DNS servers. Fair enough.
If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.
Well if you’re using a VPN then your ISP can’t see much. Some VPNs offer DNS too.
Of course you have more options, but it's not TOR.
Edit: I mean TOR only figuratively.
I have a raspberry-pi on my home network running Pi-Hole and my router’s DHCP server gives all devices on my network the Pi-Hole as the DNS address
I'm probably being really stupid, but how does using encrypted DNS prevent your ISP seeing what websites you go to? (I haven't done network stuff for many years, and am a bit out of touch with the current stuff). Can't ISPs still see the eventual target IP address, and do a reverse DNS lookup of that? Even with HTTPS/TLS I thought encryption is done after a handshake isn't it, which would imply a TCP level connection…
It increases the cost and complexity of an ISP tracking you, which is a win within itself. Plus some services share public IPs or are behind a global cache (e.g. Cloudflare) making it harder to pinpoint exactly which endpoint you tried to access. Is it perfect? No. It is better than yesterday? Yes. I call these "micro-wins." One micro-win won't make a difference, but two, three, four, and so on eventually start to ha…
I like this term :)
It's also believe its a win when computer privacy and security begin to edge into main stream lexicon. Somewhat anecdotal but I recently saw that NordVPN is advertising on CNN.
Also mentioned in article: Use DNSCrypt Proxy V2 (a golang rewrite) for DNS over TLS and/or DNScurve https://github.com/jedisct1/dnscrypt-proxy E.g. on a Mac with Homebrew. First: brew install dnscrypt-proxy Second: Edit your /usr/local/etc/dnscrypt-proxy.toml and put e.g. google or cloudflare there inside Third: Put your DNS to 127.0.0.1
Earlier quoted context omitted.
Well if you’re using a VPN then your ISP can’t see much. Some VPNs offer DNS too.
VPN is just a remote ISP. Of course you have more options, but it's not TOR. Edit: I mean TOR only figuratively.
https://boingboing.net/2016/07/01/researchers-find-over-100-...
Dumbass question: is there a difference between setting one’s DNS to https://1.1.1.1 versus 1.1.1.1 unadorned?
+1 for asking, though. Nothing wrong with trying to learn more about something you know very little about. Not sure why others are downvoting you.
Dumbass question: is there a difference between setting one’s DNS to https://1.1.1.1 versus 1.1.1.1 unadorned?
Using DNS over HTTPS which you can leverage in the latest Firefox nightly will make your DNS queries over a HTTPS website service. This will prevent your ISP or anyone else from tracking your DNS queries (besides cloudflare of course).
Dumbass question: is there a difference between setting one’s DNS to https://1.1.1.1 versus 1.1.1.1 unadorned?
However some DNS providers support the new standard DNS-over-HTTPS (including Google and Cloudflare). Some also support the alternative new standard DNS-over-TLS (including Cloudflare).
While support for these encryption methods support is offered by some DNS providers, your client devices may or may not support the new encryption methods. Firefox is currently implementing DNS-over-HTTPS so at least Firefox DNS requests will be soon able to use it and Google is currently beginngin to implemen it in Android. The new encryption methods are still in Draft status so expect to see adoption increase as they near completion.
If you care about privacy, use your ISPs DNS servers. Your ISP can see exactly which websites you're visiting regardless of how you do DNS, thanks to being able to see which IPs you're sending packets to, and thanks to SNI. The only thing you get from adding some third party encrypted DNS service to the mix, is an additional party which can also see what websites you're visiting.
It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.