Hacker News Reader

Comment by DavideNL | Hacker News Reader

> Please note that pretty much all the DNS leak detection tests by the VPN providers will be a false positive, as the only thing they check is if you are using their DNS servers. Rest assured that your DNS queries are well protected by the Portmaster and there is no need to be concerned." [1]

That's a confusing statement... does this mean they change your DNS server/provider by default, if you are using a VPN?

[1] https://docs.safing.io/portmaster/install/status/vpn-compati...

View on HN

I think it’s because SPN uses a different IP/node per connection you make. DNS leak detection tests will ask your browser to resolve unique subdomains. If the DNS server that requests the lookup is different from your connecting IP to the website, they will say you have a DNS leak.

https://security.stackexchange.com/questions/42752/how-does-...

That would be true if would be resolving all DNS yourself. Nowadays everyone uses a recursive resolver. See my other answer for details about this case.

Pretty much all VPNs use their own DNS servers. Their "DNS Leak Tests" just check if queries come from that DNS server.

Portmaster overrides any custom DNS server and enforces the ones the user set - or are set by default. This "breaks" the VPN leak test.

You'd need to use a leak test from the DNS provider for it to work.

Thanks for the feedback. I will look into improving the text.

> "overrides any custom DNS server and enforces the ones the user set - or are set by default"

If Portmaster "enforces DNS servers with the ones that are set", after installing Portmaster and without the user changing anything, i'd say that's a decrease of privacy;

Your VPN provider can see your traffic in any case (even when you're not using their DNS server.) So, if Portmaster would change this to whatever your default is (Cloudflare, Google, etc.), people are then suddenly sharing their DNS requests with yet another 3th party.

There is a welcome screen that informs you of Portmaster handling and securing DNS queries with the option to change the provider.

But especially with a VPN the privacy is increased as it effectively becomes DNS-over-TLS/HTTPS-over-VPN. The VPN still sees your destination IP addresses, so the privacy improvement is not increased by a lot, but still.

> with the option to change the provider.

Ah right, that sounds good. So the user is aware of it.

> But especially with a VPN the privacy is increased as it effectively becomes DNS-over-TLS/HTTPS-over-VPN.

I disagree; VPN providers use an internal IP as DNS server and your connection to this DNS server goes through a secured VPN tunnel anyway.

So, by sharing your DNS requests with an external 3th party you gain nothing, and it's even a decrease of your privacy since now Google/Cloudflare/etc collects all these requests.

Seems that there isn't an option to use the default ISP's DNS server. :(

You can use anything:

DNS Configuration Guide: https://docs.safing.io/portmaster/guides/dns-configuration

I found the option after completed the setup process.

The problem was that there isn't a "keep my DNS as is" option in the initial setup dialog (or not an obvious one), so we are forced to pick one from the four secure DNS.

Reply on news.ycombinator.com