10 ms·

Anecdote: I stayed in the Airbnb of an (obviously gay) couple in the South-Eastern very conservative Turkish city of Mersin many years ago. The absolute joy th

Anecdote: I stayed in the Airbnb of an (obviously gay) couple in the South-Eastern very conservative Turkish city of Mersin many years ago. The absolute joy they had when I showed them how to set up 1.1.1.1 on their Android TV, phones, and laptops… so they could watch unrestricted gay porn in their heavily censored and state-controlled slice of the World Wide Web… I still get a virtual greeting card from them once in a while.

not_a_dane 3y ago
UK is also censoring porn sites...
- 77pt77 3y ago
  At this point Turkey is probably more free than the UK.
  - levidos 3y ago
    Can you elaborate please? The UK isn't blocking gay porn sites for example.
    - imwillofficial 3y ago
      I think freedom of speech is an obvious example.
      - rsynnott 3y ago
        … You think freedom of speech is worse in the UK than in Erdogan’s Turkey? Just what do you think is going on in the UK?
        fullspectrumdev 3y ago
        I’ve noticed Americans get some… extremely weird and biased reporting about free speech in the UK. Extreme outlier cases like that Count Dankula guy get reported as the norm.
      - fullspectrumdev 3y ago
        I think you are smoking crack if you think Turkey has more freedom of speech than the UK.
        deleted 3y ago
        [deleted]
        imwillofficial 3y ago
        Do you have any data to support your assertion or are you just making things up?
        fullspectrumdev 3y ago
        Start here: https://en.m.wikipedia.org/wiki/Censorship_in_Turkey https://en.m.wikipedia.org/wiki/Censorship_in_Turkey
        imwillofficial 3y ago
        Thanks!
- sph 3y ago
  Only with crappy ISPs like Virgin, which has court-mandated DNS bans for many websites (like ThePirateBay) I use Zen which has no such restriction. Though for safety all my illegal activity is done via VPN because this is still a Five Eyes country.
  - PaulDavisThe1st 3y ago
    EE also does this by default (you can turn it off, but you have to contact them) EDIT: or is it Three? I can never remember which company provided the last "burner" SIM I got for each trip to the UK.
    - sph 3y ago
      It's Three that asks for credit card numbers before watching the nudes. I actually switched to EE and they have no such restriction.
- gambiting 3y ago
  Friendly reminder that all ISPs in the UK are required to store your entire browsing history for a full year, and 17 government agencies, including the Department of Agriculture, can access it without a warrant. Snoopers Act has been passed and lives on for years now, and I'm yet to meet a person who is even slightly bothered by it.
  - chgs 3y ago
    Except that’s not right https://decoded.legal/blog/2021/06/must-all-uk-internet-access-providers-keep-records-of-which-websites-i-visit/ https://decoded.legal/blog/2021/06/must-all-uk-internet-acce...
    - Footkerchief 3y ago
      > Don’t all ISPs have retention notices? Probably not (for the reasons above), but this is not public information, and ISPs and others subject to retention notices face statutory prohibitions on disclosure. > If all Internet access providers were subject to retention notices, wouldn’t it be easier to say that? There would be no need to dance around issues of secrecy, or explain why the list of notice recipients cannot be published. The fact that the Home Office chooses to take this approach undermines the claim that all providers have notices. This source appears to be engaging in wishful thinking.
      - chgs 3y ago
        The people at my isp insist they don’t store anything other than bandwidth use (which is exposed to me so I know that already) I don’t keep much data at work for that long If it is a thing it’s either a massive conspiracy across thousands of network engineers or you could point to some technical details on how it’s implemented.
        gambiting 3y ago
        It's not a conspiracy, they just can't say by law. Did you expect them to tell you if they have an order from the Home Office telling them to not divuldge this information under the threat of massive fines and jail time?
chpatrick 3y ago
That way the ISP still sees what you're doing though.
- deleted 3y ago
  [deleted]
- acchow 3y ago
  Only the DNS lookups. Not the content of what you’re viewing over https. Everything after domain name is encrypted
  - freedomben 3y ago
    The DNS lookup are often enough. You can try to claim you were shopping for new shoes on pornhub.com, but not many people will buy it
    - nurettin 3y ago
      There is no law against going to pornhub.com, the law is only concerned with dns blocking.
      - alhadrad 3y ago
        [flagged]
      - godelski 3y ago
        Supposing this was 100% accurate, I'm sure that you could understand that going to pornhub.com or definitelynotgayporn.net would arouse suspicion in a government that is banning such behavior and could cause a person to be under higher scrutiny. So even if you're right that the DNS bypass isn't what would technically get them in trouble, I think you can understand the motivation to encrypt your DNS traffic to ensure that you don't get a target painted on your back. And given this, I hope how you can understand that your comment does very little to contribute to the actual conversation and can even potentially mislead others. A lot of communication is implicit (otherwise it'd be incredibly cumbersome)
heavyset_go 3y ago
Set them up with some form of DNS over TLS.
samatman 3y ago
Reminds me of a... peculiarity in Turkey. Men are required to serve a mandatory term in the military, but are exempt if they're homosexual. However, to prevent this being used as a loophole to evade service, the men in question must prove that they're gay. This has resulted in the Turkish military having a very large collection of amateur gay porn.
- leeoniya 3y ago
  this is basically that family guy episode where Quagmire tries to get out of his marriage to a hooker.
- superb_dev 3y ago
  So they’re forced to choose between military service or having sex on camera? I’m not sure I’d call that “amateur porn” if it’s not consensual
  - Dylan16807 3y ago
    Wanting to get out of a pre-existing obligation that every man has, and most don't get out of, should not qualify as lack of consent.
    - noman-land 3y ago
      The obligation itself already lacks consent so anything you feel forced to do to get out of it is similarly non-consentual.
      - Dylan16807 3y ago
        If by "similarly" you mean "equally bad at most", then I can agree with that. But I think most people would rate non-consensual sex as significantly worse than a non-consensual day job. So if you say the sex on camera is not consensual, you're implying a very different kind of consent violation than is actually happening.
noman-land 3y ago
This story is oddly wholesome.
- rrr_oh_man 3y ago
  Thanks haha
kornhole 3y ago
Configuring 1.1.1.1 is a great option for people outside the US whose countries are unable to pressure Cloudflare for information. A better option for those of us in the US is to run our own DNS resolvers. My DNS resolver runs on a little PFSense box that also has DNS blocking and a ton of other features.
- envy2 3y ago
  Let's be realistic. Porn, the subject of this discussion, is not illegal in the US; this is about age verification laws that apply to the website operators, who then self-block users from particular states. No one is going after Cloudflare for this information as there is no crime committed by the user. Given Cloudflare's logging policy (https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/ https://developers.cloudflare.com/1.1.1.1/privacy/public-dns...) and data disclosure practices, the only way US authorities would get anything worthwhile is if they had a specific individual target and a valid legal process. Cloudflare, like most of the big tech companies, is actually very good on this front; they have robust processes and are transparent (https://cf-assets.www.cloudflare.com/slt3lc6tev37/Q1INAiyBubYSlfGdUhthU/8cc0e3de0f160e2765af4f514991ef6c/Transparency-Report-H2-2022.pdf https://cf-assets.www.cloudflare.com/slt3lc6tev37/Q1INAiyBub...) about the limited cases in which they do hand over any user data. (I don't work at Cloudflare, but do work on these issues for another big US tech company.)
  - deleted 3y ago
    [deleted]
  - thejazzman 3y ago
    The US is not the subject of this thread... > [a] couple in the South-Eastern very conservative Turkish city of Mersin
  - outside1234 3y ago
    Let’s be realistic - this is not about age verification but about restricting people from their rights to view a particular type of content because of how one religion feels about it. The age verification is just the smoke screen the Republicans use to take away your freedoms.
BiteCode_dev 3y ago
Hopefully their country doesn't outlow watching porn itself, because in that case they are just accumulating evidences against them.
godelski 3y ago
> how to set up 1.1.1.1 I just want to mention a few things: Fallback, other DNSs like 1.* and Mullvad's free DNS with more options # Standard 1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001 # Block Malware 1.1.1.2 1.0.0.2 2606:4700:4700::1112 2606:4700:4700::1002 # Block Malware & Adult Content (not useful for this case) 1.1.1.3 1.0.0.3 2606:4700:4700::1113 2606:4700:4700::1003 You can find cloudflare information here[0], and remember to make sure you setup DNS over DoT (TLS) or DoH (HTTPS). Especially for them they will want to have encrypted DNS. Mullvad also offers *free* DNS[1], which also supports encrypted DNS # DoH is port 443 and DoT is port 853 # Standard dns.mullvad.net 194.242.2.2 2a07:e340::2 # Block Trackers adblock.dns.mullvad.net 194.242.2.3 2a07:e340::3 # Block Trackers + Malware base.dns.mullvad.net 194.242.2.4 2a07:e340::4 Mullvad also has block for Adult + gambling and social media (so there are 6 total configurations). You don't need the Mullvad VPN to use these. I should also mention, as this frustrated me a bit, that your browser may implement its own DNS and so just setting these in your router (or pihole) may not completely resolve the issue. In Firefox, go to Settings > Privacy & Security > (scroll all the way down) Enable DNS over HTTPS using > then under either "Increased Protection" or "Max Protection" you can set a DNS resolver (or turn it off). They have defaults for Cloudflare (default!) and NextDNS. While you're there, also check your settings at the top of that page about "Enhanced Tracking Protection" I am *NOT* a network/security person and would greatly appreciate replies to this comment with additional information. Especially about setting up things like piholes, TVs, browsers, encrypted DNS (especially this!), host files, and so on. Technical forum, so let's get technical and learn ^__^ [0] - https://developers.cloudflare.com/1.1.1.1/ip-addresses/ https://developers.cloudflare.com/1.1.1.1/ip-addresses/ - https://developers.cloudflare.com/1.1.1.1/setup/#dns-over-https-doh https://developers.cloudflare.com/1.1.1.1/setup/#dns-over-ht... [1] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls https://mullvad.net/en/help/dns-over-https-and-dns-over-tls
- Terretta 3y ago
  And AdGuard ... which also blocks ads. Plain DNS: # Default servers # AdGuard DNS will block ads and trackers. IPv4: 94.140.14.14 94.140.15.15 IPv6: 2a10:50c0::ad1:ff 2a10:50c0::ad2:ff # Non-filtering servers # AdGuard DNS will not block ads, trackers, or any other DNS requests. IPv4: 94.140.14.140 94.140.14.141 IPv6: 2a10:50c0::1:ff 2a10:50c0::2:ff # Family protection servers # AdGuard DNS will block ads, trackers, adult content, # and enable Safe Search and Safe Mode, where possible. IPv4: 94.140.14.15 94.140.15.16 IPv6: 2a10:50c0::bad1:ff 2a10:50c0::bad2:ff Adguard DNS-over-HTTPS (DoH) # Default server # AdGuard DNS will block ads and trackers. https://dns.adguard-dns.com/dns-query # Non-filtering server # AdGuard DNS will not block ads, trackers, or any other DNS requests. https://unfiltered.adguard-dns.com/dns-query # Family protection server # AdGuard DNS will block ads, trackers, adult content, # and enable Safe Search and Safe Mode, where possible. https://family.adguard-dns.com/dns-query DNS-over-TLS # Default server # AdGuard DNS will block ads and trackers. tls://dns.adguard-dns.com # Non-filtering server # AdGuard DNS will not block ads, trackers, or any other DNS requests. tls://unfiltered.adguard-dns.com # Family protection server # AdGuard DNS will block ads, trackers, adult content, # and enable Safe Search and Safe Mode, where possible. tls://family.adguard-dns.com See more: https://adguard-dns.io/en/public-dns.html https://adguard-dns.io/en/public-dns.html
jgalt212 3y ago
isn't 1.1.1.1 of limited utility from this perspective? The ISP can still see the IP address, and I know more than one IP address can map to a single domain, but you're still leaking information that would allow one's adversaries to guess at one's intent.
wolverine876 3y ago
> The absolute joy they had when I showed them how to set up 1.1.1.1 on their Android TV, phones, and laptops… so they could watch unrestricted gay porn in their heavily censored and state-controlled slice of the World Wide Web… I'd be very careful giving security advice to someone in that situation - in fact, I probably wouldn't do it, even though I am an experienced professional who knows more than most people in IT. Think about accuracy, which is correctness, completeness, and consistency: Giving security advice to buddies trying to watch out-of-country sporting events has a much different accuracy requirement than advice for someone whose liberty, life, or pursuit of happiness (assets) are at stake. If your advice is incorrect, incomplete (you don't know or account for the entire picture), or inconsistent (different pieces of your advice don't line up) - these people don't miss their favorite team, the might go to jail, get tortured, lose their children, their careers, etc. When I give professional security advice, I spend a lot of time on it. I make sure I know the whole picture, my advice is correct - rechecking old understandings, testing and retesting, etc. - and it's consistent. These people are trusting me. And then if I'm not sure of those things, I find someone who knows better than I do. I don't have time to do that at the Airbnb. In this case, it seems to risk incorrectness and incompleteness: It may be incorrect because setting up DNS lookups so there are no leaks is tricky - I'm not even sure how to do it reliably. For example, some apps and OSes have DNS servers hardcoded; IME some just bypass your configuration (maybe the dev just didn't care to integrate with the system DNS settings); IIRC some have hardcoded fallbacks; sometimes the client overrides your config with the local gateway or the servers it supplies; also, DNS has a complex federated infrastructure. (My first stab at secure DNS is a secure VPN that doesn't leak - that seems much easier). It's incomplete: the authorities might not see the DNS lookups but they will clearly see the IPs that the user accesses, including those of the porn websites. These people are trusting you and you told them they could safely look at porn. Yikes, I would not want that responsibility without some serious work.
- m3kw9 3y ago
  If they aren’t technical enough to know your setup, they won’t know their current setup either. No big deal, keep it relaxed.
- tawai 3y ago
akdev1l 3y ago
I wouldn’t be breaking the law under a repressive government without at least a VPN in the middle. DNS queries still leak the domain unless the client is using DoH.
tawai 3y ago
Some people are reaching to really wrong conclusions from this post, so a couple of pointers 1. Gay porn is not specifically blocked in Turkey, porn is; so gay porn watchers would be mostly indistinguishable from any porn watchers via their evasion techniques 2. Not that it matters as you are free to be gay in Turkey 3. Not that it matters again, because access to blocked content is never prosecuted. No one ever receives letters from their ISP even for pirating 4. Calling the internet state controlled is a bit far imo, smaller ISPs don’t even apply some blocks and comparatively USDoJ can do domain seizures which is not too different from what happens there (websites being blocked via court orders and “administrative preventative measures”). Although I’d agree that the line for blocking is drawn too close. 5. I also wouldn’t call Mersin very conservative, the left CHP just won the municipal election with ~60% of the votes One last thing, ISPs have moved on to using DPI to block websites so you might wanna suggest something like green-tunnel so they can up their game.
- rrr_oh_man 3y ago
  Have you registered just to say that everything is a-ok in Turkey? Not to be overly suspicious, but it sounds very much like government-sponsored astroturfing.
  - tawaii2 3y ago
    I had just contacted hn support to de-associate my posts from my username so I’d feel guilty about posting with my regular account again. Now it’s only posting with throwaways that I don’t even keep track of the passwords of (hence a new username now). Everything is not ok in Turkey, there’s lots and lots of stuff that needs to be fixed re: gay rights and acceptance in general public plus millions more of other things which led me to leave the country; but having to hide gay porn habits from the government/my isp was not one of them. Again, it’s not Iran or Russia.

not_a_dane 3y ago

UK is also censoring porn sites...

77pt77 3y ago
At this point Turkey is probably more free than the UK.
- levidos 3y ago
  Can you elaborate please? The UK isn't blocking gay porn sites for example.
  - imwillofficial 3y ago
    I think freedom of speech is an obvious example.
    - rsynnott 3y ago
      … You think freedom of speech is worse in the UK than in Erdogan’s Turkey? Just what do you think is going on in the UK?
      - fullspectrumdev 3y ago
        I’ve noticed Americans get some… extremely weird and biased reporting about free speech in the UK. Extreme outlier cases like that Count Dankula guy get reported as the norm.
    - fullspectrumdev 3y ago
      I think you are smoking crack if you think Turkey has more freedom of speech than the UK.
      - deleted 3y ago
        [deleted]
      - imwillofficial 3y ago
        Do you have any data to support your assertion or are you just making things up?
        fullspectrumdev 3y ago
        Start here: https://en.m.wikipedia.org/wiki/Censorship_in_Turkey https://en.m.wikipedia.org/wiki/Censorship_in_Turkey
        imwillofficial 3y ago
        Thanks!
sph 3y ago
Only with crappy ISPs like Virgin, which has court-mandated DNS bans for many websites (like ThePirateBay) I use Zen which has no such restriction. Though for safety all my illegal activity is done via VPN because this is still a Five Eyes country.
- PaulDavisThe1st 3y ago
  EE also does this by default (you can turn it off, but you have to contact them) EDIT: or is it Three? I can never remember which company provided the last "burner" SIM I got for each trip to the UK.
  - sph 3y ago
    It's Three that asks for credit card numbers before watching the nudes. I actually switched to EE and they have no such restriction.
gambiting 3y ago
Friendly reminder that all ISPs in the UK are required to store your entire browsing history for a full year, and 17 government agencies, including the Department of Agriculture, can access it without a warrant. Snoopers Act has been passed and lives on for years now, and I'm yet to meet a person who is even slightly bothered by it.
- chgs 3y ago
  Except that’s not right https://decoded.legal/blog/2021/06/must-all-uk-internet-access-providers-keep-records-of-which-websites-i-visit/ https://decoded.legal/blog/2021/06/must-all-uk-internet-acce...
  - Footkerchief 3y ago
    > Don’t all ISPs have retention notices? Probably not (for the reasons above), but this is not public information, and ISPs and others subject to retention notices face statutory prohibitions on disclosure. > If all Internet access providers were subject to retention notices, wouldn’t it be easier to say that? There would be no need to dance around issues of secrecy, or explain why the list of notice recipients cannot be published. The fact that the Home Office chooses to take this approach undermines the claim that all providers have notices. This source appears to be engaging in wishful thinking.
    - chgs 3y ago
      The people at my isp insist they don’t store anything other than bandwidth use (which is exposed to me so I know that already) I don’t keep much data at work for that long If it is a thing it’s either a massive conspiracy across thousands of network engineers or you could point to some technical details on how it’s implemented.
      - gambiting 3y ago
        It's not a conspiracy, they just can't say by law. Did you expect them to tell you if they have an order from the Home Office telling them to not divuldge this information under the threat of massive fines and jail time?

chpatrick 3y ago

That way the ISP still sees what you're doing though.

deleted 3y ago
[deleted]
acchow 3y ago
Only the DNS lookups. Not the content of what you’re viewing over https. Everything after domain name is encrypted
- freedomben 3y ago
  The DNS lookup are often enough. You can try to claim you were shopping for new shoes on pornhub.com, but not many people will buy it
  - nurettin 3y ago
    There is no law against going to pornhub.com, the law is only concerned with dns blocking.
    - alhadrad 3y ago
      [flagged]
    - godelski 3y ago
      Supposing this was 100% accurate, I'm sure that you could understand that going to pornhub.com or definitelynotgayporn.net would arouse suspicion in a government that is banning such behavior and could cause a person to be under higher scrutiny. So even if you're right that the DNS bypass isn't what would technically get them in trouble, I think you can understand the motivation to encrypt your DNS traffic to ensure that you don't get a target painted on your back. And given this, I hope how you can understand that your comment does very little to contribute to the actual conversation and can even potentially mislead others. A lot of communication is implicit (otherwise it'd be incredibly cumbersome)

heavyset_go 3y ago

Set them up with some form of DNS over TLS.

samatman 3y ago

Reminds me of a... peculiarity in Turkey. Men are required to serve a mandatory term in the military, but are exempt if they're homosexual. However, to prevent this being used as a loophole to evade service, the men in question must prove that they're gay. This has resulted in the Turkish military having a very large collection of amateur gay porn.

leeoniya 3y ago
this is basically that family guy episode where Quagmire tries to get out of his marriage to a hooker.
superb_dev 3y ago
So they’re forced to choose between military service or having sex on camera? I’m not sure I’d call that “amateur porn” if it’s not consensual
- Dylan16807 3y ago
  Wanting to get out of a pre-existing obligation that every man has, and most don't get out of, should not qualify as lack of consent.
  - noman-land 3y ago
    The obligation itself already lacks consent so anything you feel forced to do to get out of it is similarly non-consentual.
    - Dylan16807 3y ago
      If by "similarly" you mean "equally bad at most", then I can agree with that. But I think most people would rate non-consensual sex as significantly worse than a non-consensual day job. So if you say the sex on camera is not consensual, you're implying a very different kind of consent violation than is actually happening.

noman-land 3y ago

This story is oddly wholesome.

rrr_oh_man 3y ago
Thanks haha

kornhole 3y ago

Configuring 1.1.1.1 is a great option for people outside the US whose countries are unable to pressure Cloudflare for information. A better option for those of us in the US is to run our own DNS resolvers. My DNS resolver runs on a little PFSense box that also has DNS blocking and a ton of other features.

envy2 3y ago
Let's be realistic. Porn, the subject of this discussion, is not illegal in the US; this is about age verification laws that apply to the website operators, who then self-block users from particular states. No one is going after Cloudflare for this information as there is no crime committed by the user. Given Cloudflare's logging policy (https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/ https://developers.cloudflare.com/1.1.1.1/privacy/public-dns...) and data disclosure practices, the only way US authorities would get anything worthwhile is if they had a specific individual target and a valid legal process. Cloudflare, like most of the big tech companies, is actually very good on this front; they have robust processes and are transparent (https://cf-assets.www.cloudflare.com/slt3lc6tev37/Q1INAiyBubYSlfGdUhthU/8cc0e3de0f160e2765af4f514991ef6c/Transparency-Report-H2-2022.pdf https://cf-assets.www.cloudflare.com/slt3lc6tev37/Q1INAiyBub...) about the limited cases in which they do hand over any user data. (I don't work at Cloudflare, but do work on these issues for another big US tech company.)
- deleted 3y ago
  [deleted]
- thejazzman 3y ago
  The US is not the subject of this thread... > [a] couple in the South-Eastern very conservative Turkish city of Mersin
- outside1234 3y ago
  Let’s be realistic - this is not about age verification but about restricting people from their rights to view a particular type of content because of how one religion feels about it. The age verification is just the smoke screen the Republicans use to take away your freedoms.

BiteCode_dev 3y ago

Hopefully their country doesn't outlow watching porn itself, because in that case they are just accumulating evidences against them.

godelski 3y ago

> how to set up 1.1.1.1 I just want to mention a few things: Fallback, other DNSs like 1.* and Mullvad's free DNS with more options # Standard 1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001 # Block Malware 1.1.1.2 1.0.0.2 2606:4700:4700::1112 2606:4700:4700::1002 # Block Malware & Adult Content (not useful for this case) 1.1.1.3 1.0.0.3 2606:4700:4700::1113 2606:4700:4700::1003 You can find cloudflare information here[0], and remember to make sure you setup DNS over DoT (TLS) or DoH (HTTPS). Especially for them they will want to have encrypted DNS. Mullvad also offers *free* DNS[1], which also supports encrypted DNS # DoH is port 443 and DoT is port 853 # Standard dns.mullvad.net 194.242.2.2 2a07:e340::2 # Block Trackers adblock.dns.mullvad.net 194.242.2.3 2a07:e340::3 # Block Trackers + Malware base.dns.mullvad.net 194.242.2.4 2a07:e340::4 Mullvad also has block for Adult + gambling and social media (so there are 6 total configurations). You don't need the Mullvad VPN to use these. I should also mention, as this frustrated me a bit, that your browser may implement its own DNS and so just setting these in your router (or pihole) may not completely resolve the issue. In Firefox, go to Settings > Privacy & Security > (scroll all the way down) Enable DNS over HTTPS using > then under either "Increased Protection" or "Max Protection" you can set a DNS resolver (or turn it off). They have defaults for Cloudflare (default!) and NextDNS. While you're there, also check your settings at the top of that page about "Enhanced Tracking Protection" I am *NOT* a network/security person and would greatly appreciate replies to this comment with additional information. Especially about setting up things like piholes, TVs, browsers, encrypted DNS (especially this!), host files, and so on. Technical forum, so let's get technical and learn ^__^ [0] - https://developers.cloudflare.com/1.1.1.1/ip-addresses/ https://developers.cloudflare.com/1.1.1.1/ip-addresses/ - https://developers.cloudflare.com/1.1.1.1/setup/#dns-over-https-doh https://developers.cloudflare.com/1.1.1.1/setup/#dns-over-ht... [1] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls https://mullvad.net/en/help/dns-over-https-and-dns-over-tls

Terretta 3y ago
And AdGuard ... which also blocks ads. Plain DNS: # Default servers # AdGuard DNS will block ads and trackers. IPv4: 94.140.14.14 94.140.15.15 IPv6: 2a10:50c0::ad1:ff 2a10:50c0::ad2:ff # Non-filtering servers # AdGuard DNS will not block ads, trackers, or any other DNS requests. IPv4: 94.140.14.140 94.140.14.141 IPv6: 2a10:50c0::1:ff 2a10:50c0::2:ff # Family protection servers # AdGuard DNS will block ads, trackers, adult content, # and enable Safe Search and Safe Mode, where possible. IPv4: 94.140.14.15 94.140.15.16 IPv6: 2a10:50c0::bad1:ff 2a10:50c0::bad2:ff Adguard DNS-over-HTTPS (DoH) # Default server # AdGuard DNS will block ads and trackers. https://dns.adguard-dns.com/dns-query # Non-filtering server # AdGuard DNS will not block ads, trackers, or any other DNS requests. https://unfiltered.adguard-dns.com/dns-query # Family protection server # AdGuard DNS will block ads, trackers, adult content, # and enable Safe Search and Safe Mode, where possible. https://family.adguard-dns.com/dns-query DNS-over-TLS # Default server # AdGuard DNS will block ads and trackers. tls://dns.adguard-dns.com # Non-filtering server # AdGuard DNS will not block ads, trackers, or any other DNS requests. tls://unfiltered.adguard-dns.com # Family protection server # AdGuard DNS will block ads, trackers, adult content, # and enable Safe Search and Safe Mode, where possible. tls://family.adguard-dns.com See more: https://adguard-dns.io/en/public-dns.html https://adguard-dns.io/en/public-dns.html

jgalt212 3y ago

isn't 1.1.1.1 of limited utility from this perspective? The ISP can still see the IP address, and I know more than one IP address can map to a single domain, but you're still leaking information that would allow one's adversaries to guess at one's intent.

wolverine876 3y ago

> The absolute joy they had when I showed them how to set up 1.1.1.1 on their Android TV, phones, and laptops… so they could watch unrestricted gay porn in their heavily censored and state-controlled slice of the World Wide Web… I'd be very careful giving security advice to someone in that situation - in fact, I probably wouldn't do it, even though I am an experienced professional who knows more than most people in IT. Think about accuracy, which is correctness, completeness, and consistency: Giving security advice to buddies trying to watch out-of-country sporting events has a much different accuracy requirement than advice for someone whose liberty, life, or pursuit of happiness (assets) are at stake. If your advice is incorrect, incomplete (you don't know or account for the entire picture), or inconsistent (different pieces of your advice don't line up) - these people don't miss their favorite team, the might go to jail, get tortured, lose their children, their careers, etc. When I give professional security advice, I spend a lot of time on it. I make sure I know the whole picture, my advice is correct - rechecking old understandings, testing and retesting, etc. - and it's consistent. These people are trusting me. And then if I'm not sure of those things, I find someone who knows better than I do. I don't have time to do that at the Airbnb. In this case, it seems to risk incorrectness and incompleteness: It may be incorrect because setting up DNS lookups so there are no leaks is tricky - I'm not even sure how to do it reliably. For example, some apps and OSes have DNS servers hardcoded; IME some just bypass your configuration (maybe the dev just didn't care to integrate with the system DNS settings); IIRC some have hardcoded fallbacks; sometimes the client overrides your config with the local gateway or the servers it supplies; also, DNS has a complex federated infrastructure. (My first stab at secure DNS is a secure VPN that doesn't leak - that seems much easier). It's incomplete: the authorities might not see the DNS lookups but they will clearly see the IPs that the user accesses, including those of the porn websites. These people are trusting you and you told them they could safely look at porn. Yikes, I would not want that responsibility without some serious work.

m3kw9 3y ago
If they aren’t technical enough to know your setup, they won’t know their current setup either. No big deal, keep it relaxed.
tawai 3y ago

akdev1l 3y ago

I wouldn’t be breaking the law under a repressive government without at least a VPN in the middle. DNS queries still leak the domain unless the client is using DoH.

tawai 3y ago

Some people are reaching to really wrong conclusions from this post, so a couple of pointers 1. Gay porn is not specifically blocked in Turkey, porn is; so gay porn watchers would be mostly indistinguishable from any porn watchers via their evasion techniques 2. Not that it matters as you are free to be gay in Turkey 3. Not that it matters again, because access to blocked content is never prosecuted. No one ever receives letters from their ISP even for pirating 4. Calling the internet state controlled is a bit far imo, smaller ISPs don’t even apply some blocks and comparatively USDoJ can do domain seizures which is not too different from what happens there (websites being blocked via court orders and “administrative preventative measures”). Although I’d agree that the line for blocking is drawn too close. 5. I also wouldn’t call Mersin very conservative, the left CHP just won the municipal election with ~60% of the votes One last thing, ISPs have moved on to using DPI to block websites so you might wanna suggest something like green-tunnel so they can up their game.

rrr_oh_man 3y ago
Have you registered just to say that everything is a-ok in Turkey? Not to be overly suspicious, but it sounds very much like government-sponsored astroturfing.
- tawaii2 3y ago
  I had just contacted hn support to de-associate my posts from my username so I’d feel guilty about posting with my regular account again. Now it’s only posting with throwaways that I don’t even keep track of the passwords of (hence a new username now). Everything is not ok in Turkey, there’s lots and lots of stuff that needs to be fixed re: gay rights and acceptance in general public plus millions more of other things which led me to leave the country; but having to hide gay porn habits from the government/my isp was not one of them. Again, it’s not Iran or Russia.