15 ms·

My ISP is bound by robust privacy, telecommunications interception and other legislation. Cloudflare, on the other hand is based in a foreign jurisdiction that

My ISP is bound by robust privacy, telecommunications interception and other legislation. Cloudflare, on the other hand is based in a foreign jurisdiction that offers none of these protections.

zinekeller 1y ago
> My ISP is bound by robust privacy, telecommunications interception and other legislation. It really depends on which jurisdiction are you in, unfortunately. US ISPs are selling everything they can hover (including DNS information) to advertisers, and it is impossible to switch to another one unless you're lucky (because the monopoly is essentially maintained).
- waynesonfire 1y ago
  And until TLS is made secure they'll continue to rape privacy by scraping your https traffic.
- immibis 1y ago
  So is Cloudflare, which is a US ISP....
  - mixdup 1y ago
    Cloudflare is not an ISP. They have other services they sell. Maybe they're selling your data, maybe not. I honestly have not read their agreements and terms, but it's not nearly as obvious that you're the product as something like Google
    - ta1243 1y ago
      So this company based in the US which provides internet services is not an internet service provider. Given that they are funded and run by the same forces american parastical capitalism provides I would trust them as much as I'd trust google or alphabet. I'll continue to route my DNS to quad-nine over mullvad over my specifically chosen ISP, and everything on my network does that as I can easily intercept and redirect udp/53. The weak point are treacherous devices which use DoH which is a constant fight to block.
      - mixdup 1y ago
        They provide network services on the internet, but unless I'm missing some product they don't list on their website they do not provide actual basic IP internet connectivity for businesses, everything they sell is some service on top of your existing ISP services
        ta1243 1y ago
        And google don't provide actual basic IP internet connectivity for businesses. They are still an american company that provides internet services and uses and sells your data. Why would cloudflare, built from the same corporate background, be any more trustworthy?
        immibis 1y ago
        That's just one category of stuff that ISPs do. In the context of "who do I pay to get Internet at home", cloudflare is not an option, but in the context of the internet itself they are one. Hetzner, for example, is an ISP that mainly provides server hosting. There are companies that only provide Internet service at data centers too.
      - immibis 1y ago
        Why not run your own recursive resolver? It's very easy to set up - worried about leaking your IP address to authoritative DNS servers?
    - ranger_danger 1y ago
      Using the definition of "do they provide IP transit to anyone", yes, they offer services which do this, Tunnels is one, there may be others, but this would mean they are technically and legally classified as a service provider (and hence also enjoy Section 230 protection) in that case. Some may also consider reverse proxying/caching to be providing transit service, but I'm not sure if the majority of people would agree on that.
AshamedCaptain 1y ago
In addition, your ISP can also extract whichever metadata it wants from your communications, incl. a very likely perfect guess of the hostnames you visit at which times _even if you don't use DNS at all_, just by looking at IP traffic metadata such as addresses and packet sizes. So you already have to trust your ISP anyway -- but there was no need to trust Cloudflare *. DoH to Cloudflare is almost certainly a net loss in privacy compared to using your ISP's DNS over clear text. * Right until they became hosters of half of the WWW. So Cloudflare can pretty much also guess your activity even if you don't do DNS with them anyway.
- koakuma-chan 1y ago
  > IP traffic metadata such as addresses and packet sizes. Even if you use a VPN?
  - gruez 1y ago
    That just shifts the trust from your ISP to your VPN provider. Moreover if you're already using a VPN, your DoH requests to cloudflare is already anonymized.
    - mlhpdx 1y ago
      If you are using WireGuard between endpoints your traffic if opaque, but yeah if/where it exits it becomes (depending on the encapsulated protocol) visible.
- josephcsible 1y ago
  > In addition, your ISP can also extract whichever metadata it wants from your communications, incl. a very likely perfect guess of the hostnames you visit at which times _even if you don't use DNS at all_, just by looking at IP traffic metadata such as addresses and packet sizes. Big CDNs and ECH make that impossible.
  - AshamedCaptain 1y ago
mcpherrinm 1y ago
The most important part of DoH, etc is that it allows you to make a choice. You can choose a vendor in your country. As a Canadian, I might want to use the service offered by my national TLD operator https://www.cira.ca/en/canadian-shield/configure/firefox/ https://www.cira.ca/en/canadian-shield/configure/firefox/ Many ISPs explicitly sell DNS data, and are also advertising vendors. Cloudflare, on the other hand, doesn’t share or sell data and retains minimal data: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/ https://developers.cloudflare.com/1.1.1.1/privacy/public-dns...
- mlhpdx 1y ago
  > The most important part of DoH, etc is that it allows you to make a choice. So does UDP based DNS, and TLS based DNS. It’s all the same in that regard.
  - josephcsible 1y ago
    With insecure DNS, the choice isn't meaningful since your ISP will see all of the data no matter which DNS server you pick to use. And those kinds of ISPs will probably block DoT because they want to keep seeing it all, but they can't block DoH.
    - mlhpdx 1y ago
      I put my DNS service on a non-standard port. I’m the only one using it so standards be damned. Windows doesn’t allow setting a nonstandard port for DNS, but pretty-much everything else does. Do ISPs do deep packet inspection to get lookup data? Maybe, but it increases the cost of doing so and makes the business aspect of it less viable. Perhaps a minor win.
      - mcpherrinm 1y ago
        Yes, ISPs absolutely do deep packet inspection. With cleartext DNS, your queries may never reach your chosen server. Plenty of ISPs are configured to just answer any DNS query, regardless of its destination. Using a nonstandard port might help, but you’d be much better off deploying one of the DoH / DoT / DoQ / etc secure protocols.
j16sdiz 1y ago
ISP regularly captures NXDOMAIN. They know your government id when you subscribe to their service. CloudFlare, otoh, never have your identity. They only have the metadata
LtWorf 1y ago
Change it to mullivad like i did then?

My ISP is bound by robust privacy, telecommunications interception and other legislation. Cloudflare, on the other hand is based in a foreign jurisdiction that offers none of these protections.

zinekeller 1y ago

> My ISP is bound by robust privacy, telecommunications interception and other legislation. It really depends on which jurisdiction are you in, unfortunately. US ISPs are selling everything they can hover (including DNS information) to advertisers, and it is impossible to switch to another one unless you're lucky (because the monopoly is essentially maintained).

waynesonfire 1y ago
And until TLS is made secure they'll continue to rape privacy by scraping your https traffic.
immibis 1y ago
So is Cloudflare, which is a US ISP....
- mixdup 1y ago
  Cloudflare is not an ISP. They have other services they sell. Maybe they're selling your data, maybe not. I honestly have not read their agreements and terms, but it's not nearly as obvious that you're the product as something like Google
  - ta1243 1y ago
    So this company based in the US which provides internet services is not an internet service provider. Given that they are funded and run by the same forces american parastical capitalism provides I would trust them as much as I'd trust google or alphabet. I'll continue to route my DNS to quad-nine over mullvad over my specifically chosen ISP, and everything on my network does that as I can easily intercept and redirect udp/53. The weak point are treacherous devices which use DoH which is a constant fight to block.
    - mixdup 1y ago
      They provide network services on the internet, but unless I'm missing some product they don't list on their website they do not provide actual basic IP internet connectivity for businesses, everything they sell is some service on top of your existing ISP services
      - ta1243 1y ago
        And google don't provide actual basic IP internet connectivity for businesses. They are still an american company that provides internet services and uses and sells your data. Why would cloudflare, built from the same corporate background, be any more trustworthy?
      - immibis 1y ago
        That's just one category of stuff that ISPs do. In the context of "who do I pay to get Internet at home", cloudflare is not an option, but in the context of the internet itself they are one. Hetzner, for example, is an ISP that mainly provides server hosting. There are companies that only provide Internet service at data centers too.
    - immibis 1y ago
      Why not run your own recursive resolver? It's very easy to set up - worried about leaking your IP address to authoritative DNS servers?
  - ranger_danger 1y ago
    Using the definition of "do they provide IP transit to anyone", yes, they offer services which do this, Tunnels is one, there may be others, but this would mean they are technically and legally classified as a service provider (and hence also enjoy Section 230 protection) in that case. Some may also consider reverse proxying/caching to be providing transit service, but I'm not sure if the majority of people would agree on that.

AshamedCaptain 1y ago

In addition, your ISP can also extract whichever metadata it wants from your communications, incl. a very likely perfect guess of the hostnames you visit at which times _even if you don't use DNS at all_, just by looking at IP traffic metadata such as addresses and packet sizes. So you already have to trust your ISP anyway -- but there was no need to trust Cloudflare *. DoH to Cloudflare is almost certainly a net loss in privacy compared to using your ISP's DNS over clear text. * Right until they became hosters of half of the WWW. So Cloudflare can pretty much also guess your activity even if you don't do DNS with them anyway.

koakuma-chan 1y ago
> IP traffic metadata such as addresses and packet sizes. Even if you use a VPN?
- gruez 1y ago
  That just shifts the trust from your ISP to your VPN provider. Moreover if you're already using a VPN, your DoH requests to cloudflare is already anonymized.
  - mlhpdx 1y ago
    If you are using WireGuard between endpoints your traffic if opaque, but yeah if/where it exits it becomes (depending on the encapsulated protocol) visible.
josephcsible 1y ago
> In addition, your ISP can also extract whichever metadata it wants from your communications, incl. a very likely perfect guess of the hostnames you visit at which times _even if you don't use DNS at all_, just by looking at IP traffic metadata such as addresses and packet sizes. Big CDNs and ECH make that impossible.
- AshamedCaptain 1y ago

mcpherrinm 1y ago

The most important part of DoH, etc is that it allows you to make a choice. You can choose a vendor in your country. As a Canadian, I might want to use the service offered by my national TLD operator https://www.cira.ca/en/canadian-shield/configure/firefox/ https://www.cira.ca/en/canadian-shield/configure/firefox/ Many ISPs explicitly sell DNS data, and are also advertising vendors. Cloudflare, on the other hand, doesn’t share or sell data and retains minimal data: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/ https://developers.cloudflare.com/1.1.1.1/privacy/public-dns...

mlhpdx 1y ago
> The most important part of DoH, etc is that it allows you to make a choice. So does UDP based DNS, and TLS based DNS. It’s all the same in that regard.
- josephcsible 1y ago
  With insecure DNS, the choice isn't meaningful since your ISP will see all of the data no matter which DNS server you pick to use. And those kinds of ISPs will probably block DoT because they want to keep seeing it all, but they can't block DoH.
  - mlhpdx 1y ago
    I put my DNS service on a non-standard port. I’m the only one using it so standards be damned. Windows doesn’t allow setting a nonstandard port for DNS, but pretty-much everything else does. Do ISPs do deep packet inspection to get lookup data? Maybe, but it increases the cost of doing so and makes the business aspect of it less viable. Perhaps a minor win.
    - mcpherrinm 1y ago
      Yes, ISPs absolutely do deep packet inspection. With cleartext DNS, your queries may never reach your chosen server. Plenty of ISPs are configured to just answer any DNS query, regardless of its destination. Using a nonstandard port might help, but you’d be much better off deploying one of the DoH / DoT / DoQ / etc secure protocols.

j16sdiz 1y ago

ISP regularly captures NXDOMAIN. They know your government id when you subscribe to their service. CloudFlare, otoh, never have your identity. They only have the metadata

LtWorf 1y ago

Change it to mullivad like i did then?