5 ms·

Sending all DNS requests to Cloudflare isn't enhancing privacy and security. It's centralizing a decentral network.

by dna_polymerase 5y ago

sschueller 5y ago
A nightmare. Why do we have to make DNS worse? Who benefits?
- kazen44 5y ago
  large tech. Mind you, this entire arms race exists because every single bit of data is being used for data mining.
______- 5y ago
> Sending all DNS requests to Cloudflare I like to combine DoH with a VPN. The VPN doesn't see my DNS queries, and Cloudflare just sees a vague IP based in some vague colocation center. There is still plaintext SNI[0] to worry about though, which is being mitigated with something called ECH[1]. `Oblivious DoH`[2] is worth reading about too. [0] https://www.cloudflare.com/learning/ssl/what-is-sni/ https://www.cloudflare.com/learning/ssl/what-is-sni/ [1] https://blog.cloudflare.com/encrypted-client-hello/ https://blog.cloudflare.com/encrypted-client-hello/ [2] https://blog.cloudflare.com/oblivious-dns/ https://blog.cloudflare.com/oblivious-dns/
- anjbe 5y ago
  Cloudflare also provides DNS over a Tor hidden service: https://developers.cloudflare.com/1.1.1.1/fun-stuff/dns-over-tor https://developers.cloudflare.com/1.1.1.1/fun-stuff/dns-over...
anjbe 5y ago
It can be both give and take. Just like a VPN, DoT/DoH is sensible if you trust your ISP less than your encrypted DNS operator. Someone will inevitably pop in and remark, “I trust my ISP with my DNS queries due to regulations in my country!” Good, I’m happy for you. But some of us are stuck with Comcast.
commoner 5y ago
Cloudflare is not the only DNS over HTTPS provider. For instance, Mullvad provides both DNS over HTTPS and DNS over TLS free of charge, with optional ad blocking, even if you're not using their VPN service. They have instructions for configuring Firefox and Android with their DNS endpoints: https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/ https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/
taviso 5y ago
I don't really buy the "centralizing" argument, any organization can join the TRR program. The main difference is that you have to agree to a bunch of baseline privacy requirements to join. It turns out that not many organizations who operate a resolver are willing to agree to those requirements. Isn't calling that centralization like saying the health inspector is centralizing restaurants by shutting down dirty kitchens?
devwastaken 5y ago
Every website you've ever visited or DNS query perfored is logged by your ISP due to that "decentralized" behavior. It's not decentralized when there's very few companies involved and a very long history of happy dragnetting.
- entropyie 5y ago
  My ISP is subject to GDPR, has an office down the road, I know people who work there, and is answerable to the Data Protection Commissioner. They have a customer service department that answers my calls in person within 30 minutes tops. So yes I trust it more than google or cloudflare. With DNS I have visibility and the ability to block on my own home network on all devices. I can even do MITM on apps to see what they are sending up. All this without any configuration changes on the Endpoint. If I want more privacy I can use VPN or Tor. DOH will send my traffic to Cloudflare and I won't have any say, visibility or blocking capability. Not all phones, ebooks etc ... Will be configurable.... This is a USA centric big tech data grab, plain and simple.
  - devwastaken 5y ago
    Everyone is dragnetting. GDPR means nothing when it's government sanctioned collection. Germany for example has a known history of data center black boxes.

Sending all DNS requests to Cloudflare isn't enhancing privacy and security. It's centralizing a decentral network.

sschueller 5y ago

A nightmare. Why do we have to make DNS worse? Who benefits?

kazen44 5y ago
large tech. Mind you, this entire arms race exists because every single bit of data is being used for data mining.

______- 5y ago

> Sending all DNS requests to Cloudflare I like to combine DoH with a VPN. The VPN doesn't see my DNS queries, and Cloudflare just sees a vague IP based in some vague colocation center. There is still plaintext SNI[0] to worry about though, which is being mitigated with something called ECH[1]. `Oblivious DoH`[2] is worth reading about too. [0] https://www.cloudflare.com/learning/ssl/what-is-sni/ https://www.cloudflare.com/learning/ssl/what-is-sni/ [1] https://blog.cloudflare.com/encrypted-client-hello/ https://blog.cloudflare.com/encrypted-client-hello/ [2] https://blog.cloudflare.com/oblivious-dns/ https://blog.cloudflare.com/oblivious-dns/

anjbe 5y ago
Cloudflare also provides DNS over a Tor hidden service: https://developers.cloudflare.com/1.1.1.1/fun-stuff/dns-over-tor https://developers.cloudflare.com/1.1.1.1/fun-stuff/dns-over...

anjbe 5y ago

It can be both give and take. Just like a VPN, DoT/DoH is sensible if you trust your ISP less than your encrypted DNS operator. Someone will inevitably pop in and remark, “I trust my ISP with my DNS queries due to regulations in my country!” Good, I’m happy for you. But some of us are stuck with Comcast.

commoner 5y ago

Cloudflare is not the only DNS over HTTPS provider. For instance, Mullvad provides both DNS over HTTPS and DNS over TLS free of charge, with optional ad blocking, even if you're not using their VPN service. They have instructions for configuring Firefox and Android with their DNS endpoints: https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/ https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/

taviso 5y ago

I don't really buy the "centralizing" argument, any organization can join the TRR program. The main difference is that you have to agree to a bunch of baseline privacy requirements to join. It turns out that not many organizations who operate a resolver are willing to agree to those requirements. Isn't calling that centralization like saying the health inspector is centralizing restaurants by shutting down dirty kitchens?

devwastaken 5y ago

Every website you've ever visited or DNS query perfored is logged by your ISP due to that "decentralized" behavior. It's not decentralized when there's very few companies involved and a very long history of happy dragnetting.

entropyie 5y ago
My ISP is subject to GDPR, has an office down the road, I know people who work there, and is answerable to the Data Protection Commissioner. They have a customer service department that answers my calls in person within 30 minutes tops. So yes I trust it more than google or cloudflare. With DNS I have visibility and the ability to block on my own home network on all devices. I can even do MITM on apps to see what they are sending up. All this without any configuration changes on the Endpoint. If I want more privacy I can use VPN or Tor. DOH will send my traffic to Cloudflare and I won't have any say, visibility or blocking capability. Not all phones, ebooks etc ... Will be configurable.... This is a USA centric big tech data grab, plain and simple.
- devwastaken 5y ago
  Everyone is dragnetting. GDPR means nothing when it's government sanctioned collection. Germany for example has a known history of data center black boxes.