4 ms·

I thought this was someone else providing an anonymized dns proxy at first, but it's just how to set up your own proxy. Not sure this saves anything over just u

by kylek 7y ago

I thought this was someone else providing an anonymized dns proxy at first, but it's just how to set up your own proxy. Not sure this saves anything over just using DoH to one of the listed providers directly (the requests still come from something you own and can technically be traced back to you, albeit with more effort?) edit: I'm wondering what the ideal setup actually is. Would the root servers need to provide DoH endpoints?

jkingsman 7y ago
The "more effort" part was what I was going for -- no nation state or warrant-holding organization is going to be stymied by this, but as a personal/home user, I'd rather DoH resolvers not be able to tie my lookups to my personal IP which is doubtless held in many other cross-referencable locations (in my case, home-network wide proxying or Tor isn't feasible).
- Ajedi32 7y ago
  I wonder if it'd be feasible to proxy only the DNS requests over Tor. Maybe set up your network-level DNS proxy to route upstream queries through a Tor tunnel to a different DNS-over-HTTPS resolver. Perhaps even have the DNS proxy cache DNS records and proactively revalidate commonly used ones to avoid most of the latency overhead of Tor.
  - ignoramous 7y ago
    Unbound does prefetch [0]. Not sure abt the tor split tunnel, but is easy to setup one over WireGuard. [0] https://en.m.wikipedia.org/wiki/Unbound_(DNS_server)#Features https://en.m.wikipedia.org/wiki/Unbound_(DNS_server)#Feature...
- laforge 7y ago
  I‘m wondering if the effort and costs are worth it. I‘d like to think that my DoH provider (cloudflare) is probably one of the more trustworthy parties involved when browsing the web. Every website is still tracking and selling your ip and services like google analytics combine them to build a profile. Correct me if I‘m wrong
- anon9001 7y ago
  It's definitely feasible. Old hardware + 2 network cards + pfsense makes a router that can do network-wide VPN. Even a lot of prosumer routers can do VPNs now, but I'm not sure how well it works.
mercora 7y ago
In my opinion it would be ideal if all namerservers (including the root servers) would respond to DNS over TLS (DoT?) traffic which seems like it could be easily adopted but would probably increase the load considerably in some cases (i guess root servers see some massive amount of traffic)... i dont think this will happen anytime soon with DoH or DNS over TLS
- kylek 7y ago
  I agree, I think I like the idea of DNS over TLS more than the other options, but DoH seems to be the one that's taking off. I don't feel it's quite a betamax situation, though

by kylek 7y ago

jkingsman 7y ago

The "more effort" part was what I was going for -- no nation state or warrant-holding organization is going to be stymied by this, but as a personal/home user, I'd rather DoH resolvers not be able to tie my lookups to my personal IP which is doubtless held in many other cross-referencable locations (in my case, home-network wide proxying or Tor isn't feasible).

Ajedi32 7y ago
I wonder if it'd be feasible to proxy only the DNS requests over Tor. Maybe set up your network-level DNS proxy to route upstream queries through a Tor tunnel to a different DNS-over-HTTPS resolver. Perhaps even have the DNS proxy cache DNS records and proactively revalidate commonly used ones to avoid most of the latency overhead of Tor.
- ignoramous 7y ago
  Unbound does prefetch [0]. Not sure abt the tor split tunnel, but is easy to setup one over WireGuard. [0] https://en.m.wikipedia.org/wiki/Unbound_(DNS_server)#Features https://en.m.wikipedia.org/wiki/Unbound_(DNS_server)#Feature...
laforge 7y ago
I‘m wondering if the effort and costs are worth it. I‘d like to think that my DoH provider (cloudflare) is probably one of the more trustworthy parties involved when browsing the web. Every website is still tracking and selling your ip and services like google analytics combine them to build a profile. Correct me if I‘m wrong
anon9001 7y ago
It's definitely feasible. Old hardware + 2 network cards + pfsense makes a router that can do network-wide VPN. Even a lot of prosumer routers can do VPNs now, but I'm not sure how well it works.

mercora 7y ago

In my opinion it would be ideal if all namerservers (including the root servers) would respond to DNS over TLS (DoT?) traffic which seems like it could be easily adopted but would probably increase the load considerably in some cases (i guess root servers see some massive amount of traffic)... i dont think this will happen anytime soon with DoH or DNS over TLS

kylek 7y ago
I agree, I think I like the idea of DNS over TLS more than the other options, but DoH seems to be the one that's taking off. I don't feel it's quite a betamax situation, though