4 ms·

Tin foil hat time but I can't help feeling a lot of things promoted as privacy solutions like VPNs and DoH are just aggregating data in a handful of locations s

by shirro 6y ago

Tin foil hat time but I can't help feeling a lot of things promoted as privacy solutions like VPNs and DoH are just aggregating data in a handful of locations so it is easier to intercept. Sure they have privacy policies but are they worth the paper they are written on when state actors are bound by a totally different set of rules? I recently changed my local dnssec resolver to forward to quad9 and cloudflare using DoT because I was sick of the high latency with DNS resolving on boot. I would forward to my own DoT server if there was some authentication built into it and I could deny other traffic. But I have gone from dns requests being aggregated at my ISP for easy inspection my the democratically elected government of my own country, to a my own dns resolver which while it isn't aggregated is still easy enough to intercept under warrant for local law enforcement (which I generally support) to aggregating my queries in a few logs which are likely in foreign countries where I have no say in how they are used or abused. I am not sure what problem we are trying to solve with this technology.

Santosh83 6y ago
Indeed. As it stands, trust is merely being shifted from one set of parties (ISPs) to another set (big DNS/CDN providers). Apparently that's attractive enough to a lot of people who prefer to send their queries to a foreign company than to their own ISP, but has it changed anything fundamental?
- MaxBarraclough 6y ago
  The hope is that it's a change away from an untrustworthy provider, toward a trusted provider. Not sure if it counts as being a fundamental change, but it seems worth doing.
tptacek 6y ago
If you're in the US, you can't trust your ISP (most of them farm DNS data), and shaking your fist at the clouds won't change that. If you don't Cloudflare or Quad9, stand up your own DoH server somewhere; it's trivial to do.
- bwoodcock 6y ago
  Actually, most Quad9 users (in so far as we know, since we only know from those who contact us) are already running their own local caching resolver, and many of them are doing QNAME minimization, which is excellent. They use us to keep their cache misses from going in the clear, and because many of them have small enough user populations that their resolver still exposes individual user behavior.

by shirro 6y ago

Santosh83 6y ago

Indeed. As it stands, trust is merely being shifted from one set of parties (ISPs) to another set (big DNS/CDN providers). Apparently that's attractive enough to a lot of people who prefer to send their queries to a foreign company than to their own ISP, but has it changed anything fundamental?

MaxBarraclough 6y ago
The hope is that it's a change away from an untrustworthy provider, toward a trusted provider. Not sure if it counts as being a fundamental change, but it seems worth doing.

tptacek 6y ago

If you're in the US, you can't trust your ISP (most of them farm DNS data), and shaking your fist at the clouds won't change that. If you don't Cloudflare or Quad9, stand up your own DoH server somewhere; it's trivial to do.

bwoodcock 6y ago
Actually, most Quad9 users (in so far as we know, since we only know from those who contact us) are already running their own local caching resolver, and many of them are doing QNAME minimization, which is excellent. They use us to keep their cache misses from going in the clear, and because many of them have small enough user populations that their resolver still exposes individual user behavior.