What do lainons use for DNS

Unbound: Positives: >You don't rely on CF, Google or Quad9 >Slightly makes it harder for someone to connect the dots by shuffling >QNAME minimization Negatives: >All queries are unencrypted. ISP (or anyone) can easily snoop >Even with QNAME, you're still putting all your trust into a single company like VeriSign DoH/DoT: Positives: >All queries are encrypted >You get to choose who can snoop on you (by choosing your DNS resolver) >Better for anti-censorship if DNS-based Negatives: >ISP can still easily see Client Hello SNI >Quite easy to correlate your traffic since it's all goes to a single resolver I know it's an entry-level thing and you should already relay your traffic using VPN/Tor at this point, but I'm surprised that there aren't any choices left for a normal law-abiding citizen.

stop thinking about it and use your default isp dns. don't be a schizo and invest your time into something useful instead.

why not both? you can put a forward rule in unbound to get DNS from another server over TLS, eg. quad9 if you're really schizo you can proxy unbound's queries to other servers over Tor, maybe add a cronjob to throw queries for random domains too for obfuscation

>>88772 >put a forward rule in unbound to get DNS from another server over TLS, eg. quad9 That would defeat the whole idea of hosting a recursive DNS resolver. The idea is to not rely on third-party DNS servers like Quad9 and go through the whole DNS hierarachy by yourself Root->TLD->Authoritative Name Server. Those servers don't have any built-in encryption support. In theory IDK how querying TLD server hosted by VeriSign is any different from what people already do anyway. I'd rather at least prefer my DNS traffic to be encrypted/obfuscated via DNSCrypt. I couldn't find any real solution to this dilemma. DNS itself is deeply flawed when it comes to privacy. Maybe things will change with ECH/QUIC for better or worse. Only thing that came close was GNUnet's GNS. Distributed DNS built on DHTs. But it's specifically built for GNUnet stack. >if you're really schizo you can proxy unbound's queries to other servers over Tor I'm not, just curious about the system itself. Other than experimental stuff I'm nearly always on clearnet anyway.

Make your own DNS resolver that holds a list of domain names and resolves them in a loop on specified intervals. When you do any internet query, your system goes to this resolver, it adds domain name into the list, and performs the resolution immediately. But on all next subsequent requests when you perform query to the same site, your resolver returns the last known IP from its list instead of doing a lookup. Which means it's impossible to correlate your browsing queries with DNS resolution queries.

It's pretty easy to set up dnsmasq to build its local dns cache from queries through tor. You get your requests resolved by whatever dns server your current tor exit node is using, which changes every ten minutes. The requests are obviously encrypted and untracable to you. Once dnsmasq builds up a good cache, most of your requests are resolved locally so you're not even using tor much.

>>88780 i'm pretty sure unbound supports DoT, or at the very least DoH https://unbound.docs.nlnetlabs.nl/en/latest/topics/privacy/dns-over-https.html >That would defeat the whole idea of hosting a recursive DNS resolver. The idea is to not rely on third-party DNS servers like Quad9 and go through the whole DNS hierarachy by yourself Root->TLD->Authoritative Name Server. my bad, didn't realize, thought it was about running an unbound instance on your desktop for caching queries >I'd rather at least prefer my DNS traffic to be encrypted/obfuscated [..] routing through tor would probably be the best approach then, might as well share my setup: unbound listening on loopback, forward zone for quad9 in /etc/tor/torrc: TransPort 9040 iptables -A OUTPUT -p tcp -m owner --uid-owner [$ id unbound] -j REDIRECT --to-ports 9040

Today I decided to try an experiment: what if I increase DNS cache time in browser from 60 seconds to something totally utterly unreasonable, like 24 hours. It's been ~10 hours and not a single website broken. If it keeps going well for a few days I'll try setting it to a week or more. If it breaks once a few days for just a site or two, I'll try to manually reset DNS for particular sites.

>>88790 You don't need a resolver for this, it's just basic caching. Besides personally I wouldn't use my own resolver over Tor or DoH to a third party for bulk querying. That'd be the equivalent of periodically announcing what sites you often visit (in plain text) to everyone in between (plus TLD/Authoritative servers). That said, I heard people doing similar things with Bulk queries + ODoH + random DNS probes... etc combined (dnscrypt-proxy is useful for this). Though at that point it becomes a half-baked mess and routing dns through Tor/i2p would be a better choice like >>88793 >>88794 do, which would be much more secure overall. >>88802 I remember responses having some kind of TTL value, not sure whether they matter in practice though. I'm curious how things will change when (or if) QUIC/ECH becomes a thing. Storing public keys in DNS records is a weird concept.

>>88803 > equivalent of periodically announcing what sites you often visit True, but it does provide obfuscation of browsing time, so you can't really prove anything about what person is doing at the sites they visit and when exactly they visit those sites. No other solution does this. And it can be combined with Tor or whatever.

I've been using OpenNIC happily for many years now.

>I'm surprised that there aren't any choices left for a normal law-abiding citizen Choices for what? What is even the objective here? Privacy? Using any unique DNS server will give you a unique fingerprint. >>88771 Cool DNS servers? OpenNIC >>88813

>>88857 Is that “Nikocado Avocado’s” asshole?

Unbound + Adguard Home on a Raspberry Pi 3. Blocks ads and trackers.

>>88770 I configured Quad9 in my Router, works great

Could someone explain Oblivious DNS over HTTPS to me if it is best there is or just an unpoven gimmick?

>>88814 Privacy, anonymity, and security are 3 different (and often mutually exclusive) goals. You're complaining about the anonymity aspect. But I agree that OP should have stated his goals more clearly

I don't get it. Can't you just use your ISP's DNS? They already know what sites you're visiting from the IP addresses anyway.

That's an interesting toothpick so as a rather novice in such matters specifically, I will ask what is the point of using a different DNS if it funnels the data through a major company or agent that I should be weary of? Is there a GUI tool (say a frontend) that could manage this, from the most simple setup to the most convoluted one with plenty of intermediary steps? A tool that's rather intuitive and which makes it clear if the data is encrypted? Actually, what do I need to check to get the best setup possible, depending on what my goals are? Are all DNS compatible with the Tor network too? >>88793 mentions dnsmasq. How good is it and how does it work (succinct reply pls, I'll check myself for deeper know how when needed)? How does it work with i2p? Other question. Is the point of bulk queries to create confusion about what usual path you go through by using a shotgun solution, and then cycling a periodic intervals through a list of DNS to reach and go through to make yourself harder to follow?

>>89144 >Are all DNS compatible with the Tor network too? man tor you set DNSPort it resolves stuff. according to manual A, AAAA and PTR. whatever the hell that means normal browsing should work. >How good is it think of sliced bread >how does it work it takes your dns query fingers it until orgasm, then forwards it to the next dns resolver. unless you're configuring a router using dnsmasq only makes sense for the cache, because it's orders of magnitude easier to set up than unbound or bind9 in my experience

Get a VPS in another country, host BIND on it as a recursive resolver, host BIND on your local network as a caching forwarder, forward all DNS queries through a self-hosted Wireguard VPN between your local caching server and the VPS server. Your local ISP can only see a Wireguard connection to a foreign VPS provider. The VPS provider can still know you from payment details, and see what you're resolving, and the IPs you're visiting of course. Chain if desired with another VPN to a VPS you get anonymously using Monero perhaps in another jurisdiction, to obfuscate your personal payment details from the final exit point, as the anonymous edge VPS provider only sees your queries and IPs, but doesn't know who you are, or where you're really connecting from (they see it as a connection from another VPS provider in another country). This is a random cute recipe I've used before, a real answer for you would completely depend on your goals, and your threat model, there's no "perfect", no system is safe, there's only "good enough" for specific use-cases, circumstances, and own / adversary resources.

>>88770 Local Unbound resolver. For things it can resolve. Then use dnscrypt-proxy for stuff it can't. Block all #53 external requests.

>>89099 It is basically Tor for DNS queries, shame it's adoption is low.

>>89518 >doesnt bat an eye at the fact that the concept makes no sense y do u autistic linux losers, EVERY SINGLE ONE OF YOU, have the EXACT SAME misconceptions. >wow we can have some kind of authenticated or confidential or anonymous or decentralized DNS and what about the fact that i can just connect to the ip address of somewhere i care about? it can even have a static ip for basically same cost as a domain. like why would i need any of the 4 buzzwords (they are good properties, just not useful for dns) when DNS just maps to an IP? and dont tell me u rely on CAs. lets pretend CAs dont exist (since their worthless). tell me, why would i need any or all of the 4 buzzwords for my DNS queries? all you did is answer, "indeed i am a fuarrrking retard" to the guy who asked

>>90272 >and what about the fact that i can just connect to the ip address of somewhere i care about? presumably you are using DNS because you don't know or don't want to memorize the IP addresses of every website you visit to.

I use dnscrypt-proxy+dnsmasq. is that a good idea?

>>88770 >image No soykaf, Sherlock. Most every connection you make to some basic service is going to be seen by someone. This isn't /sec/ so I wont get into it but you just have to choose who to trust in these situations. Your ISP will definitely sell your browsing data, already correlates it to you, and will be slow as soykaf. Some other DNS provider might sell your data and correlate it to you, but it is probably faster and provides a layer of abstraction. If you're using this thread to beg for a way around this, configure ODoH/Anonymized DoH on dnscrypt-proxy and leave us alone. > I'm surprised that there aren't any choices left for a normal law-abiding citizen. ...where does "law breaking" occur anywhere in the post you just made? >>88771 >schizo Ah, the new "autism" word. It takes two minutes to change your DNS settings in windows and one to change it in your hipster Linux/*BSD distro.

>>89099

What exacly is the point of hiding your DNS queries from your ISP when they already know which addresses and ports you connect to and can easily do a rDNS lookup if they really want to know which sites you visit?

>>90628 Good point, you'd definitely need at least a VPN or Tor if you want to hide your internet activity from your ISP. Rolling your own DNS makes sense if you just want to circumvent DNS-level domain bans though.

>>90628 Some sketchier ISPs like to inject their own crap like bill reminders or promotions through DNS.

>>90628 plausible deniability in visiting an IP versus having that IP resolve to a definite website. Also it's quicker and they see less soykaf. HTTPS + DNSCrypt does a better job at hiding things than people give it credit for

>>90628 If there's one thing I know about ISPs, it's that they will do anything to avoid putting effort in to their infrastructure.

>>90638 Domain is still exposed through TLS handshake (client hello). If your ISP is barely motivated to do that they can see your traffic through SNI or just reverse DNS lookups like someone mentioned earlier.

My threat model doesnt cover it so I dont care about it. I think if any sufficiently large "They" wanted my traffic they'd just open my PC using factory backdoors or zerodays that need a team of phds to understand. Unique DNS give me a unique fingerprint, and they're useless for this. I dont trust funny resolvers, sorry. DNS is too important to be left to volunteer operators that may or may not patch or care about security beyond the basics. You care about Google snooping and collaborating with feds but you dont factor in individual operators being ass garbage at their hobby-jobs and being compromised by the same state actors you're trying to avoid. >How do you defend against a MQ-9 Reaper orbiting above your house I don't, actually. I simply hope it doesnt get to that. Pretending I can do anything about a novel APT owning me is LARP and a waste of time. Focus on what you can do, this is security ricing. There's no many choices for a normal law-abiding citizen because it's useless. You don't need this at all.

>>90649 >>90786 I've been seeing a lot more "just give up lole" posts lately. It seems suspicious. Giving up for philosophical reasons is still giving up. Giving up because the current solutions aren't perfect is also still giving up.

>>90909 Properly modelling your adversaries and allocating your time and resources is not "giving up". Does your threat model really include your ISP to such a malicious degree? Is DNS metadata really one of your primary concerns, or are you just larping? Do you trust your VPN provider? Your OS? There's so many thing that come before your DNS. This only really matters if you're in a country with DNS poisoning or some sort of legal risk associated with DNS queries, or if your ISP actually is that hostlie or gov-compromised (then this is the wrong thread and the wrong way to ask this question I think). Non-standard resolvers defend against your ISP doing passive DNS logging and that's it. They do nothing against endpoint compromise, browser fingerprinting, telemetry, targeted surveillance,... Once you're on a hardened OS with proper browser configuration and a VPN/Tor it fundamentally doesnt matter unless, again, your threat model includes your ISP or DNS poisoning, but then you have significantly bigger problems. >"but why cant I do it anyway" Because it balloons your attack surface. Small resolvers have weaker security (weaker patches, less monitoring, less people on configs, no real IR) and a compromised resolver is a thousand times worse than Alphabet logging your queries. DNS is CRITICAL infrastructure. Also as others have pointed out it shrinks your anonymity net. You're one of maybe 200 people that use that specific resolver that behaves different and has different timing, it makes you more identifiable. Again this only makes sense if youre under a repressive regime where your ISP is assumed compromised (and in this scenario wouldnt you be putting a target on your back by using an alternative resolver?) or very specific scenarios like weird infra red teamers. Everything else is either ideological or hard larp security theater. It doesnt defend against serious threats and unserious threats were already sufficiently curtailed by a good VPN and proper OS leakage prevention, its minuscule ROI for multiplying your attack surface. >"perfect or nothing" is bad True for anything that isnt security. DNS is not amateur hour low stakes playgroud. Doing a soykaf job is actually worse than doing the default and using one dot one for everything. You call it learned helplessness giving-up-ism but Im just triaging. Yes I'd actually rather Google and the NSA log my DNS than having to care about complete anons on a telegram group being popped by 8 different APTs week 3 because the three man team that was in charge of security didnt care enough. It's not on my threat model, I dont care.

>>90971 >Is DNS metadata really one of your primary concerns, or are you just larping? Do you trust your VPN provider? Your OS? So what if I'm larping? It takes fifteen minutes to take care of the problem, then I never have to think about it again unless something breaks. Increasing your "threat model' every time there's something you need to hide is inherently telling, so having best practices at all times makes you and everyone else safer. >There's so many thing that come before your DNS. Do what you can before you do what you should. >if your ISP actually is that hostlie or gov-compromised Pretty much all ISPs sell your data with your "consent" and will turn anything and everything over to anyone who hints at asking if there's something even slightly off. I want to expose as little to them as I need to. That's my """threat model""" >Also as others have pointed out it shrinks your anonymity net. In this case privacy is preferable over anonymity >complete anons on a telegram group being popped by 8 different APTs week 3 because the three man team that was in charge of security didnt care enough. That's not on my threat model, I dont care.

>>90976 > Increasing your "threat model' every time there's something you need to hide I dont know what you mean by this. A threat model is when you identify and understand the threats to a system. If it's your threat model, the modelling of threats for you as a person, realistically it's not going to change much* unless you move tax brackets or do something important. * much except for law enforcement changes, new technical capabilities and so on but these are more or less environmental, not something you can control. If I have something I need to hide my threat model is probably going to remain the same. >Having best practices at all times >its 15 minutes why not Using a custom DNS is not best practice. For your usecase is probably pessimal actually. You're increasing your attack surface and opening yourself to actually catastrophic failure if the retards running your DNS fuarrrk up, for close to zero gain. I'd sooner disable VPN than let random volunteer complete anons handle critical opaque infrastructure. DNS is upstream of everything and has infinite blast radius, its not something you "just do anyway". >"Do what you can before you do what you should." Normally I'd agree but it's genuinely bad advice in this particular case. >"I assume my ISP itself is explicitly hostile and malicious, logs everything and sells it to whoever will harm me the most. Every packet that passes through the internet is assumed compromised." Then why are you worried about the resolver, are you retarded? Do you think an ISP-level threat cares about where you resolve dick when it can see where your packets go? Why wouldnt they coordinate to trace your packets across AS boundaries? Why wouldn't they run their own TOR nodes to deanon people using their infra? Shouldn't you apply this to your VPN and your OS, and assume your whole stack is compromised end to end? In fact if you're planning on using a large, professionally ran resolver, why not apply this logic to them, wouldn't they be forced to lawful intercept aswell? Why would the *DNS resolver* specifically change anything in this? Also if you hold ISPs to this level of omnipotent and malicious there's nothing stopping them from correlating DNS from the sites you visit anyways. >privacy is preferable over anonymity Ok but I dont see how the resolver changes much if you think everything else is completely hostile. >"I care deeply about my ISP collaborating with NSA-APT-1 but I dont care at all about my resolver being backdoored by NSA-APT 2 through 8, on top of also complying with NSA-APT-1 when they bother to ask." See below. >So what if I'm larping? Then you're unserious about a critical topic and your worldview doenst make any sense. It's like someone thinking someone for sure cut their brakes but they're worried about tire pressure because its easier to fix. Beyond that, there's nothing wrong with LARPing as if you were actually running from the feds, outside of high blood pressure. It's fine. I LARP as a super cool tier 1 operator every time I shoot, I dont care. You should pick whatever has the cooler name and makes you look the most technowizard hackermans, or whatever makes you feel personally the safest, instead of pretending you care about security.

>>90978 >Do you think an ISP-level threat cares about where you resolve dick when it can see where your packets go? The packets go to a reverse proxy, fcuktard >You're increasing your attack surface and opening yourself to actually catastrophic failure if the retards running your DNS fuarrrk up, for close to zero gain My DNS resolver is an entity that could fuarrrk up my connection, slow it down, and use the results of resolving said connection to fuarrrk with the data I put out. This is all known. Switching it to another provider that has better support for the networks I use and does what I want is better than the alternative, even if they somehow fuarrrk up something like nameserver resolution, which has never happened to me. I know I'm exchanging a definite "we're going to hand over your soykaf to whomever wants it" for a promise that it wont happen, but that's what makes it a reasonable decision. >DNS is upstream of everything and has infinite blast radius, its not something you "just do anyway". Even if they do fuarrrk up that's what blacklists are for. >Why wouldnt they coordinate to trace your packets across AS boundaries? Why wouldn't they run their own [blah blah I know so much about networking blah] lawful intercept aswell? You're stuck back in this retarded "all or nothing" idea you seem to fetishize. There are steps to take and they should be taken. >Ok but I dont see how the resolver changes much if you think everything else is completely hostile I never said that. I said ISPs are hostile and implied that certain people can become hostile >"I care deeply about my ISP collaborating with NSA-APT-1 but I dont care at all about my resolver being backdoored by NSA-APT 2 through 8, on top of also complying with NSA-APT-1 when they bother to ask." Again, it's a "they definitely have it" versus "they might have it" situtation >There's nothing wrong with LARPing as if you were actually running from the feds Hey, fuarrrking dumbass, I am running from my ISP, which I am assuming is just motivated enough to either see my name resolution results and other traffic or to not see it because it's been obscured. > I LARP as a super cool tier 1 operator every time I shoot, I dont care. That explains why you're being such a flaggot. You have to feel special in your dumbass little costume just to pull a trigger at a paper target 50 yards away, the same way a cyclist needs his lycra to bike to the party store. Get off the milsurp teen-y LARPer bandwagon, it's over with.

>>90984 You're a LARPing retard with a way below average knowledge of networking. You genuinely don't know what you're talking about on DNS and it might well be the most important part of your setup. Just the TLS handshake alone invalidates any potential gains from this. This is the last post I'll waste on you. >I'm exchanging a definite "we're going to hand over your soykaf to whomever wants it" for a promise that it wont happen No, you're exchanging a promise it wont happen from your ISP for a promise it wont happen from @RetardHobbySolver on pleroma. You're exchanging a competent but compromised resolver with an incompetent and compromised resolver. Again just pick the one with the coolest name for your particular aesthetic to put on whatever glitterboy collages or whatever you do with these. It wont actually matter to you. >all or nothing My first post in this thread, the one that got you assmad because its about security and not neocities larping, is about not pretending you can do or defend against everything. I just hope I dont ever get important enough that my country starts snooping around. I dont have any defence against it and pretending I do is idiotic and signals the wrong thing to people that are new to security. >"ISPs are compromised by default but other major links in the chain might not I dont know it depends" Thats really funny. 5eyes autologs everything from my dirt league ISP but didnt bother doing the same with my massive alternative resolver or my VPN, why? > it's a "they definitely have it" versus "they might have it" situtation Not really. If your resolver is large enough they definitely have it through LI and collaboration, and if its not large enough then you're a moron for using them and they *definitely* heve it via whatever other means. I dont care if you want to pipe everything through some romanian retard's servers because it makes you feel better, dont pretend it's doing anything for your security posture or that everyone should be doing it, that's when you become a retarded glitterboy instead of just a larper. You're doing it for your own peace of mind even though its not improving security at all though. This is neither a real defense nor best practice. >"I think my ISP is hostile but not that hostile and will only care about the things that using an alt resolver will solve specifically. I dont know what TLS or SNI means and I dont care." Then what's the problem? Why do you take offense at people telling you their threat models are different, or that this wouldnt work? If you just really really want to use a non-zogged resolver for some reason, that's fine. I still have a pihole connected to my router even though I use a VPN, I still donate to EFF even though they do nothing. Why are you replying at all when your needs are ideological and not technical? >LARP is bad but only when you do it Personally I think doing killhouses in gear is pretty gay, yes, but its less gay than not knowing cock about cybersecurity and pretending to be mr robot (TM) hackerman on the run from the feds, on lainchan of all places. At least I'm getting some cardio in, you're just wrong about DNS and a glitterboy about it. >the same way a cyclist needs his lycra to bike to the party store That you think like this but you're trying to defend alt resolvers is really cute. You're buying the helmet before the bike because "at least im buying something".

>>90909 The correct approach is minimizing trust that you have to externalize. If you have to, relay DNS queries through Tor. Picking a random DoH/DoT DNS resolver is like putting two more deadbolts on your front door when a thief can just break in through your window (SNI). It does not improve your security posture in any way and give you a false sense of security. That is more dangerous than using a system that you know is insecure.

>>88770 Theres no options for a "normal law-abiding citizen" because its a retarded new point of failure that improves nothing. Just jot down the IPs to your child porn boxes on notepad if you think your dns is cyberhumped. local dns with dnsmasq + vpn or tor already solves this problem, it has no use. theers no threads on entry level topics because they fill with entry level retards upset if u dont validate one way or the other. useless noise.