3 ms·
Potential workarounds: 1. Round Robin your DoH requests across several providers. Eg, if CloudFlare sees one quarter of your DNS requests it's less revealing t
by kardos 8y ago
Potential workarounds:
1. Round Robin your DoH requests across several providers. Eg, if CloudFlare sees one quarter of your DNS requests it's less revealing then if they see all of them.
2. DNS proxies. Sort of like a VPN for the DNS requests such that they're aggregated to one source IP before being passed to the DoH provider. Done at the ISP level? Or some other arrangement. The VPN here would not be privy to the requests due to TLS.
These ideas may require more work to be practical.
- icebraining 8y ago1) seems unlikely; a 25% sample is probably quite representative. 2) that's essentially what a typical DNS provider like Cloudflare or Google DNS is: they proxy your requests back to the authoritative DNS servers, then return the response to you.
- kardos 8y ago1) Fair enough, 25% of the requests would just take ~4x as long to get a more-or-less complete sampling. So how about a revised version: shard the requests, so CloudFlare only sees A-G, Google only sees H-P, etc. 2) No argument about that. I'm considering the privacy angle. A pre-DoC proxy would know your IP but not the DNS request contents, and the DoC provider would have the request but not the original IP.
- icebraining 8y agoOh, I didn't understand (2), you mean a simple TCP proxy. Well, I guess one could already use Tor for that.
- dsl 8y agoRound robin won't work because a 25% sample is just as useful as a full feed. All they need is enough users to provide a statistically significant representation of traffic. For you personally, if you send a query for www.example.com to one provider, and a query for images.example.net to another, you've outed yourself as browsing example.com to both.
- kardos 8y agoAgreed, see reply to your sibling comment for a less-broken idea