3 ms·

> Without a VPN sure, with a VPN,highly recommended even with centralized DoH. With a VPN, DoH is essentially redundant because the DNS query is already encryp

• badrabbit 7y ago
  If you use your povider's resolver you're right. In my case, I prefer to use clodflare's resolver because that reduces the risk surrounding my VPN provider logging my DNS requests and being able to manipulate them (there were a few times when switching to an open resolver actually made a site accessible). You can say they still log IP and SNI,but shared hosting,eSNI help.
  • zrm 7y ago
    You get a little more information from the DNS queries than the IP headers because of shared hosting, but it's largely the same information, so using two different providers doubles your exposure. If they're different parties, either one could invade your privacy. So it seems to me that it's better to choose one provider you trust and use it for both. If your VPN provider is molesting your DNS queries, get a different VPN provider.
    • badrabbit 7y ago
      Provider knows what IP/sni you go to but not the domains you query, DoH resolvers knows what domains you go to but they don't know your real IP.
      • nieve 7y ago
        Due to the previously mentioned problem with session resumption your DoH resolvers now know what non-vpn ips you use as well as any vpn ones. This is a catastrophic failure mode if the DoH resolver is hostile - for example you might have just successfully linked home, work, and vpn ips to the same browser. Even if you only ever use different VPN endpoints it won't protect you, in fact if they're using timing information to try to narrow your location it's extra information about network distances tied to that convenient unique, persistent id.