6 ms·

That instantly makes me feel dns encryption is something worth exploring in depth...

flatiron 7y ago
I do DoH with pi hole and cloudflare (followed arch wiki for all of that) but I think it’s silly. You don’t know what I’m resolving but you still know what ips I’m visiting and can just look up their host names. What does it really do?
- fweespeech 7y ago
  You can have multiple hostnames per IP. (i.e. If you are using a site that uses cloudflare) That fact will make it very difficult to resolve hostname to ip address for anyone behind a CDN. That is the reason Comcast is fighting it.
  - flatiron 7y ago
    Makes sense. Thanks. Then I’m glad I’m using it! I fell into the arch wiki black hole and an hour later had pi hole, DoH and OpenVPN all configured so all my devices including my iPhone go through my home internet and the pi hole. Pretty neat. No ads while mobile. I did have to do tcp on 443 since udp and t mobile did not play nice together. I was too lazy to debug that though.
- giggles_giggles 7y ago
  I thought DoH would defeat the pihole. Is this incorrect?
  - flatiron 7y ago
    Check out the pi hole arch wiki. Tells you how to use DoH with cloudflare. Takes 2 minutes.
- sliken 7y ago
  A fair chunk of internet content is hosted in the cloud. So while comcast knows exactly what IPs you are talking to they can't tell much else. This prevents them from tracking your habits, selling that data, and creating or marketing competition. It also makes it harder to crippling the network for some specific competitor like youtube or netflix. How else is Comcast going to hold it's users hostage so netflix has to pay extra to get the bits the customers paid to get?
- CydeWeys 7y ago
  The vast majority of relevant privacy-sensitive information is not IP addresses. The ISP can't read the full content of every page just from IP addresses.
ropiwqefjnpoa 7y ago
It makes me want to implement it immediately.
- tomschlick 7y ago
  You already can for your whole network: https://scotthelme.co.uk/securing-dns-across-all-of-my-devices-with-pihole-dns-over-https-1-1-1-1/ https://scotthelme.co.uk/securing-dns-across-all-of-my-devic... Or if you use firefox you can enable it for each browser.
Belphemur 7y ago
I have a full tutorial on how to setup DoH for yourself : https://www.aaflalo.me/2018/10/tutorial-setup-dns-over-https-server/ https://www.aaflalo.me/2018/10/tutorial-setup-dns-over-https...
- mindslight 7y ago
  Why would you do this instead of say the easier and more general, DNS over wireguard?
  - deleted 7y ago
    [deleted]
  - tptacek 7y ago
    You wouldn't. But Firefox and Chrome users might be happy to have this done for them.
    - mindslight 7y ago
      erm, how do you mean? DoH and DoWG have essentially the same security properties, no? With authoritative servers only responding in the clear, you have to trust some egress provider. If I'm understanding it correctly, the only use case for DoH is for end users that don't have a remote box to trust with their egress. Which certainly is a worthy segment. It just seems like any DIY network setup would be orthogonal to that. And so there's no point addressing DoH on your local network unless you're trying to mitigate DoH's effects on eg ad blocking.
      - deleted 7y ago
        [deleted]
      - tptacek 7y ago
        US ISPs are currently, actively, aggressively manipulating DNS. People shouldn't trust their ISP DNS. If they run normal DNS to a third-party resolver, their ISPs still see their queries. If they use DoH, they can't. If they use WireGuard, their ISP sees even less of their traffic, but WireGuard is harder to set up than DoH, which your browser will do for you.
hiccuphippo 7y ago
I set up doh using dnscrypt-proxy the other day and it was easy. And as a bonus, I enabled logging, so now I can tell what domains are being looked up by my computer.

I do DoH with pi hole and cloudflare (followed arch wiki for all of that) but I think it’s silly. You don’t know what I’m resolving but you still know what ips I’m visiting and can just look up their host names. What does it really do?

fweespeech 7y ago
You can have multiple hostnames per IP. (i.e. If you are using a site that uses cloudflare) That fact will make it very difficult to resolve hostname to ip address for anyone behind a CDN. That is the reason Comcast is fighting it.
- flatiron 7y ago
  Makes sense. Thanks. Then I’m glad I’m using it! I fell into the arch wiki black hole and an hour later had pi hole, DoH and OpenVPN all configured so all my devices including my iPhone go through my home internet and the pi hole. Pretty neat. No ads while mobile. I did have to do tcp on 443 since udp and t mobile did not play nice together. I was too lazy to debug that though.
giggles_giggles 7y ago
I thought DoH would defeat the pihole. Is this incorrect?
- flatiron 7y ago
  Check out the pi hole arch wiki. Tells you how to use DoH with cloudflare. Takes 2 minutes.
sliken 7y ago
A fair chunk of internet content is hosted in the cloud. So while comcast knows exactly what IPs you are talking to they can't tell much else. This prevents them from tracking your habits, selling that data, and creating or marketing competition. It also makes it harder to crippling the network for some specific competitor like youtube or netflix. How else is Comcast going to hold it's users hostage so netflix has to pay extra to get the bits the customers paid to get?
CydeWeys 7y ago
The vast majority of relevant privacy-sensitive information is not IP addresses. The ISP can't read the full content of every page just from IP addresses.

ropiwqefjnpoa 7y ago

It makes me want to implement it immediately.

tomschlick 7y ago
You already can for your whole network: https://scotthelme.co.uk/securing-dns-across-all-of-my-devices-with-pihole-dns-over-https-1-1-1-1/ https://scotthelme.co.uk/securing-dns-across-all-of-my-devic... Or if you use firefox you can enable it for each browser.

Belphemur 7y ago

I have a full tutorial on how to setup DoH for yourself : https://www.aaflalo.me/2018/10/tutorial-setup-dns-over-https-server/ https://www.aaflalo.me/2018/10/tutorial-setup-dns-over-https...

mindslight 7y ago
Why would you do this instead of say the easier and more general, DNS over wireguard?
- deleted 7y ago
  [deleted]
- tptacek 7y ago
  You wouldn't. But Firefox and Chrome users might be happy to have this done for them.
  - mindslight 7y ago
    erm, how do you mean? DoH and DoWG have essentially the same security properties, no? With authoritative servers only responding in the clear, you have to trust some egress provider. If I'm understanding it correctly, the only use case for DoH is for end users that don't have a remote box to trust with their egress. Which certainly is a worthy segment. It just seems like any DIY network setup would be orthogonal to that. And so there's no point addressing DoH on your local network unless you're trying to mitigate DoH's effects on eg ad blocking.
    - deleted 7y ago
      [deleted]
    - tptacek 7y ago
      US ISPs are currently, actively, aggressively manipulating DNS. People shouldn't trust their ISP DNS. If they run normal DNS to a third-party resolver, their ISPs still see their queries. If they use DoH, they can't. If they use WireGuard, their ISP sees even less of their traffic, but WireGuard is harder to set up than DoH, which your browser will do for you.

hiccuphippo 7y ago

I set up doh using dnscrypt-proxy the other day and it was easy. And as a bonus, I enabled logging, so now I can tell what domains are being looked up by my computer.