Hacker News Reader

Comment by jcgl | Hacker News Reader

- Personal details isn't the point (and while a VPN service may have those, a big DNS resolver certainly doesn't)--the point is that correlating DNS traffic with your source/home IP address is likely easier with a big DNS resolver. In any case, I don't see how the VPN approach is superior here.

- People may also live under regimes where VPN providers are blocked. Unless there's some order of magnitude more limitations on DNS resolvers, I don't see how the VPN approach is superior here.

View on HN

Anonymizing VPNs, especially multi-hop ones, and Tor in particular makes correlation much more difficult. Mullvad paid in crypto or cash is a very good option.

I agree about blocked VPN providers, but in the real world it’s usually possible to get around those blocks, even in places like China where there are sophisticated national firewalls.

These things you suggest incur significant latency. Also, can you simply pipe DNS over Tor? I don't see how, since Tor is TCP-only. I suppose DoT or DoH could potentially work, but not all authoritative servers may support those protocols. The TCP handshake will also add further latency.

Furthermore, even once you layer all that tunneling on top, it's still unclear how doing recursive resolution from your end of the tunnel is better than going through one of the big resolvers. The privacy benefits seem marginal at best. Overall, I don't think you have convinced me in the slightest of your original point that "really anyone who cares about bypassing national blocking orders should run a local caching recursive resolver."

If your centralized DNS server receives a blocking order, what are you doing to do? You’ll have to do something. Give me another alternative then. In the current geopolitical environment, this is not idle speculation, it’s a real threat.

Latency is a tradeoff, I mentioned there are tradeoffs. For an individual or home network, the latency should not be a problem especially with caching.

As for TCP/UDP, current RFCs say that DNS servers must accept TCP, but not all may follow the standard and some misconfigured firewalls may block it. But it doesn’t seem to be an issue when tunneling all traffic over Tor using something like Tails. So I don’t think this is really a problem.

Same thing as if something equivalent happens to your VPN service I guess? Switch to another one.

Oh yeah crap, you're right about DNS over regular TCP. I totally brainfarted on that.

Reply on news.ycombinator.com