31–40 of 137 posts
Well there goes the interest I had in this.
>That means that your ISP can still figure out which sites you’re visiting, because it’s right there in the server name indication. Plus, the routers that pass that initial request from your browser to the web server can see that info too. Well there goes the interest I had in this.
There are 3 major protocols available for DNS privacy: * DNSCrypt * DNS over TLS * DNS over HTTPS DNSCrypt is the one with better client support and a long list of providers available. If you pick DNS over TLS or DNS over HTTPS you will be restricted to 3 or 4 major players (google, quad9, cloudflare and cleanbrowsing). If you trust them, you are good. For example, this is the list of providers with DNSCrypt support:…
Because if not, any requests made by non-browsers are still susceptible and will only give users a false sense of security.
I kind of hate this. Taking a decentralised service, and replacing it with a service provided by a small handful of tech giants. "But this doesn’t mean you have to use Cloudflare. Users can configure Firefox to use whichever DoH-supporting recursive resolver they want. As more offerings crop up, we plan to make it easy to discover and switch to them." Only defaults matter. Your average web user wont be interested in…
Do not select any default. Randomize the selections.
>That means that your ISP can still figure out which sites you’re visiting, because it’s right there in the server name indication. Plus, the routers that pass that initial request from your browser to the web server can see that info too. Well there goes the interest I had in this.
(also, 1] dns leaks are worse than sni leaks as typically more people are exposed to the dns query and 2] HTTP/2 can carry more than one hostname on a connection so some hostnames that appear in dns are never leaked through sni.)
There was a good chunk of time where my ISP (Verizon FIOS at the time) was having some kind of DNS hijacking attack happening where many CDN IPs were being replaced with an IP of a server that was adding some ad-injecting javascript into many pages (and god knows what else, I still have the payload laying around somewhere as I saved it for future curiosity). At the time my only real recourse was to pump my whole hous…
> Does anyone know of a way to force all DNS queries in windows to use DoH? I think you could use pi-hole to do this. https://docs.pi-hole.net/guides/dns-over-https/
I kind of hate this. Taking a decentralised service, and replacing it with a service provided by a small handful of tech giants. "But this doesn’t mean you have to use Cloudflare. Users can configure Firefox to use whichever DoH-supporting recursive resolver they want. As more offerings crop up, we plan to make it easy to discover and switch to them." Only defaults matter. Your average web user wont be interested in…
There are 3 major protocols available for DNS privacy: * DNSCrypt * DNS over TLS * DNS over HTTPS DNSCrypt is the one with better client support and a long list of providers available. If you pick DNS over TLS or DNS over HTTPS you will be restricted to 3 or 4 major players (google, quad9, cloudflare and cleanbrowsing). If you trust them, you are good. For example, this is the list of providers with DNSCrypt support:…
It doesn't require sessions (uses UDP by default, like regular DNS, but prevents amplification), enforces safe cryptography and pinned certificates, is trivial to implement, doesn't need OpenSSL, implements padding without inventing yet another DNS extension, and can use unique keys for each question (so that DNS providers can't fingerprint clients, unlike other options due to TCP sessions and TLS tickets).
I tried DNS over TLS (somewhat similar) and it has some potential. But not with those strict timeouts. 1.1.1.1 closes the TCP connection almost instantly after the query response, 9.9.9.9 waits a bit longer, about 10 seconds (need to check again). So everytime you want to make a query, you have to wait several RTTs before getting a response. The connection need to be open for as long as possible, at least 5 minutes.…
DNS over HTTPS uses DNS in the protocol. Does that make it extra-recursive DNS?
You can connect using an IP address. At least to bootstrap the process. This is where DNS Stamps come in handy https://github.com/jedisct1/dnscrypt-proxy/wiki/stamps