nextdns

Yes, this breach is awful because of its massive scale, its inherent irreversibility and the uniqueness of the data (phone numbers).

We try to shine a light on the implications of this on the website itself (you may need to scroll down a bit).

Short term, just being aware of it should make things better, as there is going to be a massive surge in phishing and other types of attacks.

Unlike other similar (and often suspicious) websites:

- you do not enter your phone number (or email). You just search yourself (or your close ones) by name, the same way you would Google or Facebook yourself or your friends.

- even if that shouldn't be the only trust signal, we (the folks at NextDNS) work around security and privacy every day for the benefits of the users. And while we are still a startup, we are used by many, including experts in the security industry.

Following the release of the 533 million phone numbers (acquired through the 2019 Facebook vulnerability), we wanted to bring awareness to the security & privacy implications of a public worldwide mobile phonebook.

You can check yourself, your family, friends and colleagues and inform them.

Disclaimer: we do not display (or even store) the phone numbers, we only show the last 2 digits so you can confirm it's yours.

Happy to answer related security and privacy questions.

---

A few Persons of Interest:

Mark Zuckerberg https://facebookbreach.com/4

Didier Reynders (EU Privacy Chief) https://facebookbreach.com/100011885742964

Emmanuel Macron (President of France) https://facebookbreach.com/100026099615243

Xavier Bettel (Prime Minister of Luxembourg) https://facebookbreach.com/901110787

We made an online generator for (signed) Apple Configuration Profiles that let you use the new system Encrypted DNS feature of iOS 14/iPadOS 14/tvOS 14 and macOS Big Sur, without the need for an app.

The Configuration ID field is entirely optional and if left blank, you will be using our no-logs non-blocking DNS resolver (the one included in Firefox and soon Google Chrome). For reference, here is a map of our anycast network: https://i.imgur.com/doL6nkr.png

Feedback welcome!

Note: Having a NextDNS account is entirely optional. You can install this beta if you just want to try the new Encrypted DNS feature.

It's a "fake" VPN, it only captures the DNS traffic (that's just the cleanest/most efficient way to do it).

I meant this:

https://i.imgur.com/tZh6p0x.png

As far as we know, it's slowly being rolled out and not behind any flag (unfortunately).

Google Chrome (and some Chromium forks) will also be supporting custom DNS-over-HTTPS providers very soon (it's already being rolled out to some users).

Looks like a case of bad anycast routing, as we have a PoP in Toronto! It happens and is usually easily fixable, can you talk to us via the chat on our website (or at support@nextdns.io)?

A map of our network for anyone interested:

https://i.imgur.com/2uenEAZ.png

- Encrypted DNS (DNS-over-HTTPS)

- Ideal routing (low DNS latency)

- Bypass DNS-level censorship (inside a country, from your hotel Internet provider, your school, etc.)

- Being able to identify your device in the logs (if you choose to)

- Hardened Privacy Mode (if you are into that)

Edit: this goes for all our apps (iOS/Android/macOS/Windows/Router client), not just macOS.

This is a v1 of our analyzer, but it's already doing a lot of things to mimic a real user (like using a real browser, moving the mouse, scrolling, etc.).

Yes, for Adobe Experience Cloud, see: https://docs.adobe.com/content/help/en/core-services/interfa...

A few websites that are disguising third-party trackers:

Fox News: https://trackingthetrackers.com/site/foxnews.com

CNN: https://trackingthetrackers.com/site/cnn.com

BBC: https://trackingthetrackers.com/site/bbc.co.uk

WebMD: https://trackingthetrackers.com/site/webmd.com

ESPN: https://trackingthetrackers.com/site/espn.com

Ars Technica: https://trackingthetrackers.com/site/arstechnica.com

Go.com (Disney): https://trackingthetrackers.com/site/go.com

Washington Post: https://trackingthetrackers.com/site/washingtonpost.com

Walmart: https://trackingthetrackers.com/site/walmart.com

Weather.com: https://trackingthetrackers.com/site/weather.com

Apple: https://trackingthetrackers.com/site/apple.com

NFL: https://trackingthetrackers.com/site/nfl.com

T-Mobile: https://trackingthetrackers.com/site/t-mobile.com

State Farm: https://trackingthetrackers.com/site/statefarm.com

Fixed, not sure why we did that in the first place.

https://trackingthetrackers.com/site/news.ycombinator.com

It's probably the map + the chat thing (only things that are third party, and won't stay there for long), we will fix.

Please reach out to us in the future, we will definitely have some discount, or be free, for serious non-profits.

Edited, thanks!

Right now it's disabled for everyone, it will be supported with an option to disable it.

Could be a routing issue (this things need to be tweaked over time). Can you talk to us via the chat on the website so we can debug?

It's not the spike, it's probably a combination of:

- a routing imperfection (this things need to be tweaked over time).

- the fact that we didn't deploy our PoP in India yet (coming this month).

Can you talk to us on the chat if you have some time? It would help to do some debugging.

It's free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.

Thanks!

> Auto-detect OS and suggest specific setup instructions right on the landing page?

It should already pre-select your OS tab on my.nextdns.io on the Setup page? If that's not the case, then it's probably a bug.

> The website goes blank when I block third-party JavaScript from loading. Can you please see if you can fix that?

Weird, we will have a look.

> simplednscrypt has been handy for me to DoT/DoH/DNSCrypt with AdGuard DNS on PC. You could include instructions in the Windows section for that? https://dnscrypt.info/implementations/

You can use your custom sdns:// endpoint listed on the Setup page, we assumed users using dnscrypt clients would know what this means. Good point, we will add setup instructions for it.

> Provide a generic DNS endpoint like AdGuard does?

We already have them, we decided to not show them on the website as it may confuse users. We may add them back.

> What's the backend that fronts DoH, DoT, and DNSCrypt queries? Is it simply relayed to Cloudflare underneath the covers? How do you do that?

It's a custom-made backend, and we recurse using unbound (we don't forward to cloudflare or anything like that).

> Re: Privacy Policy: "We store user data following modern security standards". What user data is stored using what modern standards? I like the terse policy document, but I feel there needs to be a fine print detailing data collection and data retention.

We will definitely improve that, we had to make some calls on priorities for the launch.

Confirming that we are not using Pi-hole, the title is just a catchy way of explaining the service.

The service is free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.

Selling data is against what we believe in and would also be counter-productive (everybody would stop using the service instantly).

Them getting bought by Cisco has greatly hindered their ability to innovate and stay current I guess.

Motivations: like most tech startups, scratching your own itch :)

Funding: Free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.

Thanks!

Free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.

Thanks! Simple is definitely what we were aiming for.

Damn you're right, we have no idea why.

Clicking this link in iOS will work though, for some reason: https://testflight.apple.com/join/AFDFPLP3

We've been working super hard on nextdns.io, a cloud-based private DNS service that gives you full control over what is allowed or blocked on your devices.

Here is a few things you can do with it:

- Block malicious websites, trackers, ads, and more by combining the most popular blocklists out there, all updated in real-time (100+ lists to choose from).

- Set your own privacy requirements: you decide what type of logs are kept (and for how long) depending on the level of analytics you want. Down to absolutely NO logs.

- Automatically use DNS-over-HTTPS on all networks (including cellular) with our apps for Android, iOS, Windows and macOS. They are all tiny, tightly integrated with the OS and have negligible battery usage. (Some of them are still being worked on.)

- Bypass nearly all forms of government/ISP censorship without the need for a slow/costly VPN, and make it way harder for your ISP to know what you are doing on the Internet.

- Get in-depth analytics and real-time query logs so you can measure the efficiency of your blocking strategy, see when the apps on your devices are calling home, etc. And choose what is logged down to absolutely no logs, you decide.

- Easily protect your family (you can create as many configurations as you want on one account, each with different settings, and you can use multiple different configurations while being on the same network).

It also supports all the latest DNS technologies (DNS-over-HTTPS/TLS, Query Name Minimisation, DNSSEC validation, etc.), and it's fast (for most countries, we are or will very soon be as low-latency as Google DNS, Cloudflare and the likes).

There are tons of other cool stuff we built into that service (like the fact that each configuration gets its own DoH/DoT endpoint and IPv6) but that post is already way too long :)

We recorded a short GIF of us browsing through the interface: https://gfycat.com/LinedVerifiableBellfrog

You can create your first configuration and test it right away without signing up (you can sign up later and "save" it).

We would really appreciate if you could try the service, tell us what you like, what you don't like, what you would add, etc. We will happily answer all questions (even the technical ones).

Cheers, and thanks!