4 ms·
Without a VPN sure, with a VPN,highly recommended even with centralized DoH. Google,mozilla and cloudflare have open DoH resolvers. For a long time less than 1
by badrabbit 7y ago
Without a VPN sure, with a VPN,highly recommended even with centralized DoH.
Google,mozilla and cloudflare have open DoH resolvers. For a long time less than 13 orgs controlled the 13 TLD root zones. For such an infant of a protocol 3 stable open resolvers is not bad and even if it stayed this way it is noy centralized. What stops every ISP and company from hosting a recursive DoH resolver. I think people forget that open resolvers are provided at the generosity of the companies that host them. By design, your local network should provide name resolution recursively.
I really think VPN providers should also provide (open?) DoH resolvers,it helps with their privacy image and a good/fast resolver helps with their performance image.
- zrm 7y ago> Without a VPN sure, with a VPN,highly recommended even with centralized DoH. With a VPN, DoH is essentially redundant because the DNS query is already encrypted and authenticated by the VPN, assuming you're using your VPN provider's DNS resolver.
- badrabbit 7y agoIf you use your povider's resolver you're right. In my case, I prefer to use clodflare's resolver because that reduces the risk surrounding my VPN provider logging my DNS requests and being able to manipulate them (there were a few times when switching to an open resolver actually made a site accessible). You can say they still log IP and SNI,but shared hosting,eSNI help.
- zrm 7y agoYou get a little more information from the DNS queries than the IP headers because of shared hosting, but it's largely the same information, so using two different providers doubles your exposure. If they're different parties, either one could invade your privacy. So it seems to me that it's better to choose one provider you trust and use it for both. If your VPN provider is molesting your DNS queries, get a different VPN provider.
- badrabbit 7y agoProvider knows what IP/sni you go to but not the domains you query, DoH resolvers knows what domains you go to but they don't know your real IP.
- nieve 7y agoDue to the previously mentioned problem with session resumption your DoH resolvers now know what non-vpn ips you use as well as any vpn ones. This is a catastrophic failure mode if the DoH resolver is hostile - for example you might have just successfully linked home, work, and vpn ips to the same browser. Even if you only ever use different VPN endpoints it won't protect you, in fact if they're using timing information to try to narrow your location it's extra information about network distances tied to that convenient unique, persistent id.
- Legogris 7y ago> I really think VPN providers should also provide (open?) DoH resolvers,it helps with their privacy image and a good/fast resolver helps with their performance image. And now you're 1 step forward, 2 steps back with the VPN provider having the sum of what was previously divided between your DNS provider and your ISP. Major VPN providers become one-stop-shops for snoopers and I'd bet some of the less scrupulous ones are happy to market your data. There's unfortunately no free lunch but how's this? Run your own recursive resolver offsite (unbound is easy to set up), connect to that over private VPN, use DNSSEC when you can.
- keanzu 7y agoChange "VPN" to "no log VPN" and the problem is solved. Conveniently the most popular VPNs are no log. It isn't a free lunch though, these are paid services.
- badrabbit 7y ago