4 ms·
The "more effort" part was what I was going for -- no nation state or warrant-holding organization is going to be stymied by this, but as a personal/home user,
by jkingsman 7y ago
The "more effort" part was what I was going for -- no nation state or warrant-holding organization is going to be stymied by this, but as a personal/home user, I'd rather DoH resolvers not be able to tie my lookups to my personal IP which is doubtless held in many other cross-referencable locations (in my case, home-network wide proxying or Tor isn't feasible).
- Ajedi32 7y agoI wonder if it'd be feasible to proxy only the DNS requests over Tor. Maybe set up your network-level DNS proxy to route upstream queries through a Tor tunnel to a different DNS-over-HTTPS resolver. Perhaps even have the DNS proxy cache DNS records and proactively revalidate commonly used ones to avoid most of the latency overhead of Tor.
- ignoramous 7y agoUnbound does prefetch [0]. Not sure abt the tor split tunnel, but is easy to setup one over WireGuard. [0] https://en.m.wikipedia.org/wiki/Unbound_(DNS_server)#Features https://en.m.wikipedia.org/wiki/Unbound_(DNS_server)#Feature...
- laforge 7y agoI‘m wondering if the effort and costs are worth it. I‘d like to think that my DoH provider (cloudflare) is probably one of the more trustworthy parties involved when browsing the web. Every website is still tracking and selling your ip and services like google analytics combine them to build a profile. Correct me if I‘m wrong
- anon9001 7y agoIt's definitely feasible. Old hardware + 2 network cards + pfsense makes a router that can do network-wide VPN. Even a lot of prosumer routers can do VPNs now, but I'm not sure how well it works.