5 ms·

Thoughts on using services like these? Especially in relation to privacy and security. I ended up going for my own VPS with a WireGuard server for my home serv

by cgjohn 4y ago

Thoughts on using services like these? Especially in relation to privacy and security. I ended up going for my own VPS with a WireGuard server for my home server to connect to.

rovr138 4y ago
I don’t see much issues with privacy or security with a service like this. They don’t get traffic going through them. They mainly exist to point to an IP. With enough data they have information on how an ISP rotates IP’s and who they’ve gone to. In your case, with a WireGuard VPS, all traffic goes through the server. That’s a very different setup. In their case, a request goes to them at a regular interval and they update the IP the dns record points to. That’s it. When someone requests the domain, they simply respond with an IP. At most, if there’s little caching, they could get frequency of usage.
- ignoramous 4y ago
  > They don’t get traffic going through them. A rouge DNS can reply to select queries with an IP of a middleware that can TLS proxy and/or MitM that traffic. We built such a thing mostly for anti-censorship purposes (bypass IP blocks): https://github.com/celzero/midway#demo https://github.com/celzero/midway#demo
  - wink 4y ago
    I use duckdns and the only service I'm accessing through that CNAME is ssh, which checks host keys, so it doesn't have to be a problem.
  - drexlspivey 4y ago
    wouldn’t that invalidate the cerificate?
    - piperswe 4y ago
      If they control the domain, they can get a new valid certificate
Tajnymag 4y ago
There's no routing of the actual traffic, only basic DNS forwarding. Of course it's not meant for business production services, but it's decent for homelab. Especially considering for how long has DuckDNS been operating.
ryan29 4y ago
My biggest concern would be someone scanning CT logs to find hosts with hobbyist grade security. That’s not meant to insult hobbyists, but they might be a juicy target for immediately exploitation after a zero day hits. To be clear, it’s the same for any well known DynDNS domain. Besides that, I looked at every DynDNS system I could find back in the summer. There were only 3 that I was happy with; Hurricane Electric, Google Domains, and a pair of self hosted Bind servers. If you want the best, simple solution, and it doesn’t need to be completely free, register a domain with Google domains. If anyone knows of limitations, let me know. Namecheap maxes out at 150 DynDNS hosts :-(
- tssva 4y ago
  I prefer to use Cloudflare for my DNS including dynamic DNS. I happen to have my domains registered through them but it is not a requirement to use their free tier.
dr-detroit 4y ago
password4321 4y ago
Best to pay the money for your own domain name, and find a free service to point it where you need to. You can keep jumping to new gimmick first year deals on unusual TLDs but they are often considered spammy and always gouge on renewal pricing.

by cgjohn 4y ago

Thoughts on using services like these? Especially in relation to privacy and security. I ended up going for my own VPS with a WireGuard server for my home server to connect to.

rovr138 4y ago

I don’t see much issues with privacy or security with a service like this. They don’t get traffic going through them. They mainly exist to point to an IP. With enough data they have information on how an ISP rotates IP’s and who they’ve gone to. In your case, with a WireGuard VPS, all traffic goes through the server. That’s a very different setup. In their case, a request goes to them at a regular interval and they update the IP the dns record points to. That’s it. When someone requests the domain, they simply respond with an IP. At most, if there’s little caching, they could get frequency of usage.

ignoramous 4y ago
> They don’t get traffic going through them. A rouge DNS can reply to select queries with an IP of a middleware that can TLS proxy and/or MitM that traffic. We built such a thing mostly for anti-censorship purposes (bypass IP blocks): https://github.com/celzero/midway#demo https://github.com/celzero/midway#demo
- wink 4y ago
  I use duckdns and the only service I'm accessing through that CNAME is ssh, which checks host keys, so it doesn't have to be a problem.
- drexlspivey 4y ago
  wouldn’t that invalidate the cerificate?
  - piperswe 4y ago
    If they control the domain, they can get a new valid certificate

Tajnymag 4y ago

There's no routing of the actual traffic, only basic DNS forwarding. Of course it's not meant for business production services, but it's decent for homelab. Especially considering for how long has DuckDNS been operating.

ryan29 4y ago

My biggest concern would be someone scanning CT logs to find hosts with hobbyist grade security. That’s not meant to insult hobbyists, but they might be a juicy target for immediately exploitation after a zero day hits. To be clear, it’s the same for any well known DynDNS domain. Besides that, I looked at every DynDNS system I could find back in the summer. There were only 3 that I was happy with; Hurricane Electric, Google Domains, and a pair of self hosted Bind servers. If you want the best, simple solution, and it doesn’t need to be completely free, register a domain with Google domains. If anyone knows of limitations, let me know. Namecheap maxes out at 150 DynDNS hosts :-(

tssva 4y ago
I prefer to use Cloudflare for my DNS including dynamic DNS. I happen to have my domains registered through them but it is not a requirement to use their free tier.

dr-detroit 4y ago

password4321 4y ago

Best to pay the money for your own domain name, and find a free service to point it where you need to. You can keep jumping to new gimmick first year deals on unusual TLDs but they are often considered spammy and always gouge on renewal pricing.