Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by clubm8 | Hacker News Reader

Full thread

clubm8·

Ok but if I don't want to use DOH then what?

I'd previously used Cloudflare's DNS because I trusted it more than my ISP.

Is disabling DoH going to enhance my privacy?

What action items can I take away from this article?

I see a lot of writing about how DoH is back, but rarely do I see the writers lay out a specific solution.

View on HN

Run an iterative resolver somewhere, then connect to it either via DoT or some VPN (wireguard, openvpn...) from your router or the OS stub resolver.

Depending on your threat model you could also run the iterative resolver locally.

To extend your idea, if that "resolver located somewhere" would be shared by more than one user then mapping a dns query to a specific user/IP would be much harder, hence further improving the privacy

Then you're back to where they have to trust the operator. The purpose of this exercise is to reduce the number of parties that have to be trusted, not increase them.

Ideally iterative resolver - autheoritative nameserver traffic would also be encrypted, then we wouldn't have to "hide in the herd" (as much).

I get the "trust the operator problem", I was thinking about sharing this for several devices I own or possibly with family assuming that "trust the operator" would not be an issue then, while increasing privacy a bit by disabling the ability to match a DNS query to specific user/IP. If this was to be shared publicly then of course you are right and this not only solves nothing but makes it worse as it introduces another node to be "trusted"

Interesting... or a simpler method is to always use a VPN.

Or will the resolver somehow see the original IP?

Reply on news.ycombinator.com