4 ms·

So instead of getting spied, blocked, tampered, etc. by your ISP you are getting spied by Cloudflare? We didn’t solve the problem, just shifted it..

satokema 7y ago
What DNS provider is actually trustworthy and how can you prove it?
greenyoda 7y ago
My ISP knows my real-world identity: name, address, phone number and credit card information. Cloudflare knows none of these things about me, so there's much less they can do with my browsing information.
- tinus_hn 7y ago
  Cloudflare has access to many of the sites you browse. They have the SSL keys, they host the services. They (potentially) know a lot more about you than your ISP. If you ever bought something from a web shop hosted on Cloudflare they have access to your billing address, credit card info and what you are buying. They may not collect it but they do have access.
celsoazevedo 7y ago
Set up your own server then?
BlackRing 7y ago
Who said he was using cloudflare as his upstream DNS? There are far more choices than cloudflare, google, or your ISP.
snek 7y ago
Cloudflare has a list of all data they collect from firefox DoH here: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
- andrerm 7y ago
  Why do people trust cloudflare more then FB and Google? Isnt the ultimate goal of all this big tech co the same: to known everything?
- LinuxBender 7y ago
  Before CF was CF, they were a group of blackhats running honeypots. I was part of that community. It turned out, building a distributed CDN had potential to make money. And here we are. They built a great CDN. I would use them over Akamai any day. They have very talented hackers. That said, consolidating all DNS lookups to one central company guarantees they will have non stop pressure (if not already) to give warrant-less access to the data. This is very valuable data. I never take privacy statements on a website seriously. A company can say one thing and do another. HN crowd knows this better than anyone.
  - noncoml 7y ago
    source?
    - LinuxBender 7y ago
      For what, the honeypots? I have no idea of such an article exists. I was one of their members and ran several honeypots and made use of several of my domains. It was started on freenode's IRC network, or at least that is how I learned about it and joined in. There are probably IRC logs on archive servers out there somewhere.
      - noncoml 7y ago
        Interesting story, thanks for sharing it!
cheez 7y ago
They delete it after 24 hours and aggregate it via sampling for tuning afterwards. Even I keep logs for 7 days before selecting for permanent storage, they are saints.
- noncoml 7y ago
  Doesn't matter if they are saints or not. My point was that we need a solution that we don't have to trust the other party being saint.
  - cheez 7y ago
    Does such a thing exist? You ask for a key lookup from address A, that can be stored no matter what. You can obfuscate it through proxies I guess
soziawa 7y ago
Pi-Hole doesn't require Cloudflare DNS. You can use your ISPs DNS service as they know who you're connecting to anyways. Or you take 15 minutes and set up unbound.
zaarn 7y ago
Run DoH over a Tor socket then...
StreamBright 7y ago
You can operate a full resolver without Cloudflare or any other resolver DNS server. Every time you do a complete recursive resolution on the DNS names yourself locally and then only the DNS servers of the service you are using are going to know that you visited their service (and the adversary eavesdropping on the network between you and the service).

satokema 7y ago

What DNS provider is actually trustworthy and how can you prove it?

greenyoda 7y ago

My ISP knows my real-world identity: name, address, phone number and credit card information. Cloudflare knows none of these things about me, so there's much less they can do with my browsing information.

tinus_hn 7y ago
Cloudflare has access to many of the sites you browse. They have the SSL keys, they host the services. They (potentially) know a lot more about you than your ISP. If you ever bought something from a web shop hosted on Cloudflare they have access to your billing address, credit card info and what you are buying. They may not collect it but they do have access.

celsoazevedo 7y ago

Set up your own server then?

BlackRing 7y ago

Who said he was using cloudflare as his upstream DNS? There are far more choices than cloudflare, google, or your ISP.

snek 7y ago

Cloudflare has a list of all data they collect from firefox DoH here: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

andrerm 7y ago
Why do people trust cloudflare more then FB and Google? Isnt the ultimate goal of all this big tech co the same: to known everything?
LinuxBender 7y ago
Before CF was CF, they were a group of blackhats running honeypots. I was part of that community. It turned out, building a distributed CDN had potential to make money. And here we are. They built a great CDN. I would use them over Akamai any day. They have very talented hackers. That said, consolidating all DNS lookups to one central company guarantees they will have non stop pressure (if not already) to give warrant-less access to the data. This is very valuable data. I never take privacy statements on a website seriously. A company can say one thing and do another. HN crowd knows this better than anyone.
- noncoml 7y ago
  source?
  - LinuxBender 7y ago
    For what, the honeypots? I have no idea of such an article exists. I was one of their members and ran several honeypots and made use of several of my domains. It was started on freenode's IRC network, or at least that is how I learned about it and joined in. There are probably IRC logs on archive servers out there somewhere.
    - noncoml 7y ago
      Interesting story, thanks for sharing it!

cheez 7y ago

They delete it after 24 hours and aggregate it via sampling for tuning afterwards. Even I keep logs for 7 days before selecting for permanent storage, they are saints.

noncoml 7y ago
Doesn't matter if they are saints or not. My point was that we need a solution that we don't have to trust the other party being saint.
- cheez 7y ago
  Does such a thing exist? You ask for a key lookup from address A, that can be stored no matter what. You can obfuscate it through proxies I guess

soziawa 7y ago

Pi-Hole doesn't require Cloudflare DNS. You can use your ISPs DNS service as they know who you're connecting to anyways. Or you take 15 minutes and set up unbound.

zaarn 7y ago

Run DoH over a Tor socket then...

StreamBright 7y ago

You can operate a full resolver without Cloudflare or any other resolver DNS server. Every time you do a complete recursive resolution on the DNS names yourself locally and then only the DNS servers of the service you are using are going to know that you visited their service (and the adversary eavesdropping on the network between you and the service).