> The absolute joy they had when I showed them how to set up 1.1.1.1 on their Android TV, phones, and laptops… so they could watch unrestricted gay porn in thei

> The absolute joy they had when I showed them how to set up 1.1.1.1 on their Android TV, phones, and laptops… so they could watch unrestricted gay porn in their heavily censored and state-controlled slice of the World Wide Web… I'd be very careful giving security advice to someone in that situation - in fact, I probably wouldn't do it, even though I am an experienced professional who knows more than most people in IT. Think about accuracy, which is correctness, completeness, and consistency: Giving security advice to buddies trying to watch out-of-country sporting events has a much different accuracy requirement than advice for someone whose liberty, life, or pursuit of happiness (assets) are at stake. If your advice is incorrect, incomplete (you don't know or account for the entire picture), or inconsistent (different pieces of your advice don't line up) - these people don't miss their favorite team, the might go to jail, get tortured, lose their children, their careers, etc. When I give professional security advice, I spend a lot of time on it. I make sure I know the whole picture, my advice is correct - rechecking old understandings, testing and retesting, etc. - and it's consistent. These people are trusting me. And then if I'm not sure of those things, I find someone who knows better than I do. I don't have time to do that at the Airbnb. In this case, it seems to risk incorrectness and incompleteness: It may be incorrect because setting up DNS lookups so there are no leaks is tricky - I'm not even sure how to do it reliably. For example, some apps and OSes have DNS servers hardcoded; IME some just bypass your configuration (maybe the dev just didn't care to integrate with the system DNS settings); IIRC some have hardcoded fallbacks; sometimes the client overrides your config with the local gateway or the servers it supplies; also, DNS has a complex federated infrastructure. (My first stab at secure DNS is a secure VPN that doesn't leak - that seems much easier). It's incomplete: the authorities might not see the DNS lookups but they will clearly see the IPs that the user accesses, including those of the porn websites. These people are trusting you and you told them they could safely look at porn. Yikes, I would not want that responsibility without some serious work.