5 ms·
Just FYI just setting your DNS to 8.8.8.8 or 1.1.1.1 may not do that much. Not only is DNS in plaintext, but some ISPs simply redirect all port 53 DNS requests
by kd913 6y ago
Just FYI just setting your DNS to 8.8.8.8 or 1.1.1.1 may not do that much. Not only is DNS in plaintext, but some ISPs simply redirect all port 53 DNS requests to their own DNS.
If you want privacy with your DNS, you should setup DoH using dnscrypt-proxy or perhaps DNS over TLS.
Personally, I think a better strategy with this whole vpn aspect is to just setup a vpn with pis in various countries + pihole. At least that way I know what the setup is happening in each locations and what expectations of privacy I can expect.
- eli 6y agoT-Mobile US was definitely doing this at one point: silently rerouting popular third-party DNS services back to their servers
- __turbobrew__ 6y agoUnless you are using a VPN/Wireguard/Proxy your ISP can simply look at the source address on the IP packets and do a reverse IP lookup to find out what site you are accessing. Doesn't matter if you are using DoH, DNS over TLS, DNSCRYPT, etc.... At a conference I was talking to one of the OpenDNS engineers on the DoH project and when I asked "so how does DoH help snooping if people can just look at IP headers?" they conceded that it really doesn't help if someone is determined to snoop.
- xrisk 6y agoDoesn’t work with a large number of sites because of Cloudflare. Edit: it _is_ easy to read the destination address from TCP packets though.
- __turbobrew__ 6y agoYea, you are correct. I got it mixed up, your ISP would look at the destination address of outgoing packets from your home.