Every privacy-focused DNS service requires an account: NextDNS, Cloudflare for Families, Apple's iCloud Private Relay (paid, iOS-only). The protocol that doesn’t require one - ODoH - had basically one well-known public relay operator (Frank Denis on Fastly Compute, default in dnscrypt-proxy). I built a second one and the client to talk to it.
Show HN: Running the second public ODoH relay
1–10 of 50 posts
Re: Show HN: Running the second public ODoH relay
#2The relay is a systemd unit on a VPS, Caddy for TLS, SSRF-hardened (regex-strict hostnames, no IP literals). eTLD+1 same-operator check rejects relay+target run by the same org by default. HPKE is odoh-rs from Cloudflare
``` cargo install numa
# set mode = "odoh" in numa.toml ```
Re: Show HN: Running the second public ODoH relay
#3What’s the selling point of ODoH given the low uptake of ECH which means the name of the server you’re talking to is given away anyway?
Re: Show HN: Running the second public ODoH relay
#4What’s the selling point of ODoH given the low uptake of ECH which means the name of the server you’re talking to is given away anyway?
I'd think that if you've got several leaks then patching one up is still forward progress even if it doesn't deliver a full fix immediately.
Re: Show HN: Running the second public ODoH relay
#5What’s the selling point of ODoH given the low uptake of ECH which means the name of the server you’re talking to is given away anyway?
They solve different things. ODoH hides your question, not who you're talking to.
Re: Show HN: Running the second public ODoH relay
#6What would it take to get truly anonymous dns? I guess it’s not really possible no?
Re: Show HN: Running the second public ODoH relay
#7What would it take to get truly anonymous dns? I guess it’s not really possible no?
Why not? Cloudflare makes 1.1.1.1 available over tor although the latency is through the roof and you still need to consider the possibility of fingerprinting the client network stack.
Re: Show HN: Running the second public ODoH relay
#8What’s the selling point of ODoH given the low uptake of ECH which means the name of the server you’re talking to is given away anyway?
They solve different things. ODoH hides your question, not who you're talking to.
Sure ODoH hides your query but you then turn around and leak the question you just asked as part of the TLS handshake.
Re: Show HN: Running the second public ODoH relay
#9[dead]
Re: Show HN: Running the second public ODoH relay
#10What’s the selling point of ODoH given the low uptake of ECH which means the name of the server you’re talking to is given away anyway?
My, admittedly cynical, view of it is that the main selling point is that you share your data with the person running the ODoH server.
The truth is that very very few people run their own recursive nameserver. The entirely reasonable assumption for any authoritative nameserver, like .com, is that the query is being asked on behalf of someone else and knowing that a user of your nameserver asked for the ip of sexysheep.com doesn't give them a lot of useful info.
I'm think many ISPs actually sell a lot of data from their recursive nameservers, but I'm willing to bet that almost no-one bothers to sniff port 53 udp traffic going elsewhere.
My vote for the best privacy option is always going to be just run pi-hole with your own recursive nameservers.