3 ms·
Ok but if I don't want to use DOH then what? I'd previously used Cloudflare's DNS because I trusted it more than my ISP. Is disabling DoH going to enhance my
by clubm8 7y ago
Ok but if I don't want to use DOH then what?
I'd previously used Cloudflare's DNS because I trusted it more than my ISP.
Is disabling DoH going to enhance my privacy?
What action items can I take away from this article?
I see a lot of writing about how DoH is back, but rarely do I see the writers lay out a specific solution.
- the8472 7y agoRun an iterative resolver somewhere, then connect to it either via DoT or some VPN (wireguard, openvpn...) from your router or the OS stub resolver. Depending on your threat model you could also run the iterative resolver locally.
- mr__y 7y agoTo extend your idea, if that "resolver located somewhere" would be shared by more than one user then mapping a dns query to a specific user/IP would be much harder, hence further improving the privacy
- the8472 7y agoThen you're back to where they have to trust the operator. The purpose of this exercise is to reduce the number of parties that have to be trusted, not increase them. Ideally iterative resolver - autheoritative nameserver traffic would also be encrypted, then we wouldn't have to "hide in the herd" (as much).
- mr__y 7y agoI get the "trust the operator problem", I was thinking about sharing this for several devices I own or possibly with family assuming that "trust the operator" would not be an issue then, while increasing privacy a bit by disabling the ability to match a DNS query to specific user/IP. If this was to be shared publicly then of course you are right and this not only solves nothing but makes it worse as it introduces another node to be "trusted"
- clubm8 7y agoInteresting... or a simpler method is to always use a VPN. Or will the resolver somehow see the original IP?