What DNS do you use?

Hey lainons, what DNS do you recommend and use? I was using OpenDNS but I would like to change to something more respectful of privacy.

everyone knows 8.8.8.8 is a joke, let's not discuss it further right now I use 1.1.1.1 because they support dns over tls, but i'm sure cloudflare is not the best for privacy either.

>>9252 I think they are still better than OpenDNS. So I heard about DNSCrypt, I do not know what to think about it. I will test

I use server closest to my shadowsocks virtual server location since I already send all my traffic to it, it is run by same histing company. I use default gateway DNS for accessing captive portals. There is no need to look for third party DNS resolver and worry about it's latency (I already had a hard time choosing lowest latency data centers in jurisdiction not so cooperating with my local government). There is no practical need to use standard-breaking placebos like "tls dns" or whatever google-cloudflare honeypot advertised by "tech bloggers" this season. Apply common sense.

Quad9 9.9.9.9 149.112.112.112 UncensoredDNS 91.239.100.100 89.233.43.71 OpenNIC 192.95.54.3192.95.54.1 SmartViper 208.76.50.50 208.76.51.51 Dyn 216.146.35.35216.146.36.36 FreeDNS (Austria) 37.235.1.17437.235.1.177 puntCAT (Spain) 109.69.8.51 Hurricane Electric 74.82.42.42  Orbot (tor) 127.0.0.1:5400

>>9255 >data centers in jurisdiction not so cooperating with my local government Everyone's cooperating nowdays. Even russia have history of helping the US/Europe catch cybercriminals they somehow don't like. Same goes for other countries who had good "offshore hosting" opportunities in the past. I think the only way I can trust a data center nowdays is if I was colocating in it, having IRL access to the actual server to make sure it's not logging anything and setting counter-raid measures. Datacenters are targets for intel/law enforcement agencies so even if it was in a totally not cooperating jurisdiction I wouldn't trust it with my life If I was not able to physically access the server. (and it poses a whole new kind of OpSec problems) Just use cloudflare for normal browsing. They will not burn a huge honeypot operation just to catch you downloading Britney Spears MP3s torrents. Better than using your ISP DNS who WILL sell it to spammers. Your setup sound useless (sorry nothing personal, love you!) and expensive for little to no results. If you really want to avoid mass surveillance/google-cloudlfare honeypots etc you'll have to take way more steps than just owning a box in a "not so cooperating jurisdiction". You need to move physically without your phone and use a 4G dongle bought with a fake identity with the same IRL OpSec measures. And you'll need to use it exclusively at remote locations, not using it for too much time and moving often. (This, and pwning boxes you don't own) One of the 3 Wall street market admin was using a similar setup but got caught when police traced the signal of the 4G dongle coming from his home. They used a van to track it lol, like Kevin "Put him back" Mitnick.

>>9257 Thank you I will see >>9258 >Everyone's cooperating nowdays. Even russia have history of helping the US/Europe catch cybercriminals they somehow don't like. Same goes for other countries who had good "offshore hosting" opportunities in the past. Yeah that's the sad truth, countries help each other at times to catch or censor some cyber criminal

On the other hand some "Cyber criminals" are just whistleblowers criticizing the power set up

>>9257 hey cool

dnscrypt-proxy

nextdns.io seems interesting for some use cases

>>9259 This happens because the ruling class has almost perfect solidarity. I mean you see it when world rulers are so chummy despite having huge differences in every other factor; ideology, economics, personal background, whatever. They see through all that and always stick together with others who exercise power. They help each other against any who oppose them anywhere. We've got to do a lot better at keeping our team together and sticking to the fight despite differences if we're ever gonna beat that.

>>9258 >And you'll need to use it exclusively at remote locations, not using it for too much time and moving often. (This, and pwning boxes you don't own) One of the 3 Wall street market admin was using a similar setup but got caught when police traced the signal of the 4G dongle coming from his home. They used a van to track it lol, >like Kevin "Put him back" Mitnick. LOL! he does seem like a bit a of a turd so he plugged the wifi dongle into his computer while at home, is that the story? i love reading these stories of how people get caught.

>>9265 Not exactly; He was using the 4G dongle to connect his computer (bought with cash) to Tor. When LEO found the Wall Street market server, they found the 4G dongle IP address since the guy was too dumb to make a killswitch if his tor connection crashed. From that they asked the 4G ISP from what cellphone towers the dongle was connected to nd they just took a van and drove around in the zone. If you like stories like this one you can take a look at a Defcon presentation from a few years ago (2014 iirc) where someone talked about "how criminals get caught using tor" or something like that. Like the story of the student who made a fake bomb thread because he wasn't feeling like taking his exam; but got caugh because he was the only one on campus using Tor at the time (they had personal logins on the network so all the Tor traffic was under his name basically)

>>9258 This post must be a paid corporate trolling, or I just don't believe you. You say that >regular hosting datacenter in Ukraine is more likely to be backdoored by NSA and cooperative with my local thought police than >cloudflare Are you fuarrrking serious? >your ISP DNS who WILL sell it to spammers *citation needed*, who will cloudflare sell my DNS info to, jehovah's witnesses? >move without phone >and use a 4G dongle /0 This must be a trolling post, I swear. None of the imageboard posters mean what they say, fuarrrking postmodern underage larping cunts.

>>9271 That's absolutely not what I said. I said use cloudflare for normal browser. Nobody cares if you download animes with limewire. IF you actually need to use anything more than cloudflare you need to also separate your normal daily internet browsing from it. If you mix everything and actually do "something serious" you'll end up in jail like every dumbass on hackforums. And you just gave away another info on your setup: Your box is in Ukraine. Totally not cooperating with the rest of the world lol. They raided UAnet not long ago. And yes, you can use a 4G dongle on a computer and you can actually make sure it's powered off during transport unlike a phone.

>>9272 My "normal" use includes avoiding cloudflare sites, if I must visit one, I do it over Tor at the expense of speed. Yes, I download animes over limewire with second VPN on top of that one because who knows when the copyright trolls will start sending death squads to pirate's apartments, and if they are local to my country, one VPN won't save me since they can see both ends. We live in a bizarre world where you can land in jail for writing illegal combinations of 1s and 0s on your hard drive. >Totally not cooperating with the rest of the world Well, that region is territoriality Ukraine, but jurisdictionally is not so, kind of a literal grey zone. I'm calling it Ukraine to avoid attracting butthurt poltards to this thread. First off, they are less cooperating with whoever there is contrary to cloudflare who participates in data mining by default. I simply do not want my thoughts to be written and catalogued somewhere in Utah. Until this hosting company joins cloudflare/amazon/google botnet farm, I assume them to be reasonably trusted. >you can actually make sure it's powered off during transport unlike a phone Ever heard of this thing called battery? Phones take their electricity from one. You disconnect the battery, the phone disconnects from the network too since if ceases operating. Why would you even use 4g modem instead of wifi which is more free, both in software and monetary senses? For 4g modem you need non-free firmware in your OS kernel which is basically a backdoor that can execute commands sent from the network, that's a feature, not a bug btw :) To make it half-secure, you'd need a router with usb port to access the modem over Ethernet, additional costs for what exactly? A wifi dongle/card with libre drivers costs 2 dollars/piece.

>>9252 if 8.8.8.8 is a joke then 1.1.1.1 is just as much as a joke Personally I avoid it if i can, but its so goddamn easy to remember its usually the first to come to my mind when setting stuff up in a hurry.

> For 4g modem you need non-free firmware in your OS kernel which is basically a backdoor that can execute commands sent from the network You. Are. Dumb. We don't care if the 4G modem firmware is open source or not if you are using a throw-away laptop. You sir, are just copy pasting things you overheard on privacy related forums; -Closed source bad, open source good. You don't understand your basic threat model. Nobody cares if you use something open source with nothing can link you to your real identity. Imagine someone send commands to the 4G dongle, then what? "Oh we can start his webcam" --> tape over it "Bu..but we can also activate your mic!" --> take literally 5min to trash the mic(s) when you buy the laptop "I... can reveal your real IP!" --> No, you can reveal the 4G modem IP which isn't linked to my real identity "Ok... then I can compare your material serials or whatever!" --> Just buy a throw away laptop on Craigslist. Just make sure to follow basic OpSec practices. > Well, that region is territoriality Ukraine, but jurisdictionally is not so, kind of a literal grey zone. I'm calling it Ukraine to avoid attracting butthurt poltards to this thread. First off, they are less cooperating with whoever there is contrary to cloudflare who participates in data mining by default. I simply do not want my thoughts to be written and catalogued somewhere in Utah. Until this hosting company joins cloudflare/amazon/google botnet farm, I assume them to be reasonably trusted. You just hate Cloudflare, we got it. But do you really think your random super l33t Ukraine but not Ukraine hosting provider isn't a target to intel agencies? lol Do you even OpSec bro? I told you to use cloudflare when doing normal/innocent browsing. Why the fuarrrk would cloudflare or even intel agencies care if I'm watching a cat video on YouTube? Please don't answer "for privacy" cause it's dumb. You little sketchy Ukraine host (which I'm sure is cooperating with every LEA in the world btw, I know and have experience with most Eastern Europe hosters..) will not protect anything. Use cloudflare for dumb-innocent browsing: it's fast and better than your ISP DNS. Not saying it's the best solution, it's just the fastest/simplest for NORMAL/INNOCENT internet browsing. If you think just owning a box or two in Eastern Europe is gonna save you from mass surveillance, think again. You act like a big cybercriminal fearing for his safety yet I bet the most serious thing you did was downloading pirated content or have a 50 peers botnet. That's why you can't make a threat model; you don't even know who you are how are you gonna know who's your ennemy? I really hope the comment about death squads is a joke. I literally picture you screaming at (closed source) clouds. Oh and how is a mobile phone without battery more secure than a non-powered 4G modem? Are you schizophrenic? Phones are so most closed source hardware around... Go back to whatever skid forum you came from. Let the adults manage adult stuff (OpSec)(Read the rules again. Don't spill the soykaf.)

>9258 >Just use cloudflare for normal browsing This advice is going to age about as well as people saying "just use google" from 15 years ago. Don't trust businesses whose goal is to MitM half the internet.

(WiFi dongle are a solution but I find it dumber than 4G; Why the fuarrrk would I limite myself to pwned WiFi's when I can connect from everywhere using 4G? We don't care about open source if you are not too dumb.)

>>9281 Ok, so you CAN'T read after all. Yes, I'm telling you to use cloudflare. But I'm also telling you to use it only for innocent/dumb internet browsing. If you want to watch a cat video will I use my personal laptop without much OpSec measures or am I gonna watch it on a super secure setup which takes more than 10min to turn fully on and be ready? Yeah I'm sure NSA will jerk off knowing they got my ass watching cat video! :) Stop trying to make me say what I did not. Read the entire post, moron.(Read the rules again. Don't spill the soykaf.)

>>9281 If you think you can achieve great OpSec from your home just connecting to your Ukraine box and just because you don't use cloudflare... Tell me right know what taste you want for the cake I'm gonna bring you in jail.

>>9250 I don't know about privacy but right now I'm using cloudfare dns 1.1.1.1 and 1.0.0.1.

My VPN's DNS, then 1.1.1.1 as a backup. Check out nixnet.xyz if you don't trust Cloudflare but trust a random Euro bro.

>>9283 There is no "innocent" web browsing anymore. When you search for cat videos, visit cat-related sites, the big corporations (Cloudflare, Google, Facebook, Amazon, related to US DARPA's project LifeLog and NSA's PRISM) all know about this, then they exchange this data with each other to build a detailed profile of your virtual identity, link it to your real person when enough data is gathered, and shape your behavior through modified search results and recommended videos/articles/websites. Cloudflare also acts as a DDoS racketeer putting down websites who refused to install their "DDoS protection". To be put exactly: a) I did not consent to be datamined for eternity, I did not subscribe to thought policing and filter bubbles, I want my information to be free. b) I do what you call "dumb browsing" through a VPS in Ukraine, they obviously answer to subpoenas from police, though a very long bureaucratic process, but they do not sell my cat searching data to the highest bidder, neither they do accumulate this data at their servers for user manipulation because they are a small hosting company, not Cloudflare who MiTM's 30% of Internet traffic, and apparently now also gathers metadata from another 30% for just using their "secure" DNS resolver. c) ISP DNS is faster and more private alternative to Cloudflare DNS when your enemy is Cloudlfare, DNS resolver within the network of my virtual hoster is fastest and most sane DNS option for use with VPN/shadowsocks on their server, there is no need to feed a third party, be int Cloudflare or else, with my domain metadata. d) Learn more about cellular hardware and how it communicates with your computer and cellular network, what sort of commands it can execute, sent from anywhere in the world, without you knowing it (silent SMS ping as one of them). It's nowhere as secure or anonymous or cheap as plain wifi card with spoofed MAC address, cantenna and random open or wpa wireless network.

>Cloudflare also acts as a DDoS racketeer putting down websites who refused to install their "DDoS protection". lolwut? Are you drunk?

I used to use Chaos Computer Club, but I don't know if those are still up.

I've been using OpenNIC for a long time.

I personally use Mullvad's non-logging DNS. http://archive.is/tstTj OpenNIC is also worth checking out. Also, I wouldn't trust Cloudflare's DNS for obvious reasons. Look up crimeflare.

>9312 OpenNIC is only /cyber/-schway choice. OpenNIC with dnscrypt proxy and non-logging server.

I currently use Cloudflare DoH until I can get my own DoH provider running.

>>9250 >privacy What's the point? ISP has to know where you want to go to send the packets.

>>9656 IP isn't a single website. Low hanging fruit for pervasive mass surveillance is DNS queries and host headers. ISPs care so much about DNS that ATT routers will not let you change DNS, and comcast is lobbying against DOH. >https://archive.is/M8KUj >Comcast fights Google’s encrypted-DNS plan but promises not to spy on users

>>9649 I have a pihole using opennic, how do I setup dnscrypt? I thought it was a cloudflare only thing?

>>9815 https://github.com/DNSCrypt/dnscrypt-proxy/wiki

Do people selfhost DNS? What does it take to create your own and is it worth it?

Any DNS that is fast and doesn't filter your results. If you worry whether it is tracking your traffic or not, I recommend xanax.

>>10937 >If you worry whether [DNS] is tracking your traffic or not, I recommend xanax. Could you point to that project? Cursory websearch yold irrelevants. Why is xanax more secure than other DNS software?

>>10929 If by "selfhost DNS" you mean... >run your own public nameserver for your website I've always just used my host's DNS but I'm actually planning to try this on my VPS because doing dynamic DNS with my current host's api is a pain in the ass. I'll try to remember to update here if I get it working. >run a DNS resolver/forwarder and a private nameserver on your LAN Yeah running unbound on your gateway is really nice. Lets you cache DNS queries yourself, and set hostnames for your LAN resources. This lets you change things around without going through all your config files to update IPs, among other benefits. Also, if you do anything remotely complicated with a personal VPN you can do a split horizon/split tunnel setup where your connections to LAN resources work the same whether or not you are on your LAN, without routing everything through your VPN all the time. If you aren't doing anything complicated and just want an emphasis on host blocking and caching, then a pi-hole might be what you're looking for, although I have never personally used it.

>>10968 Lainon was implying you need medication for your caring-about-privacy problem.

>>10937 Are you actually that ignorant or just trolling? If DNS queries are used for censorship in the UK, you can be absolutely certain they're also logged.

>>10937 >>10986 https://www.ispreview.co.uk/index.php/2019/04/google-uk-isps-and-gov-battle-over-encrypted-dns-and-censorship.html https://www.ispreview.co.uk/index.php/2019/04/government-propose-to-setup-uk-regulator-for-internet-censorship.html https://www.theregister.co.uk/2019/06/10/iwf_dns_https/ (See the transparent manipulation attempt) related

>>10986 They could have setup a DNS sinkhole without access logs to save money on storing the logs to derezzed domains, only having basic caching which is always done by sane admins regardless of whether censorship is present or not. Unless they plan on prosecuting people who accessed derezzed addresses in the future, which we will never know beforehand, there is nothing to worry about. You clicked an obfuscated short link somewhere without malicious intent, and it sent you to a derezzed domain name, the name was filtered by ISP sinkhole and you were presented with placeholder captive page, you understood your failure, and will not open such links in the future, or open them in Tor browser on maximum security setting if you're curious enough. Btw, is there a official full list of sites derezzed in UK?

I use the ones from cryptostorm.is

>>9250 Like a good paranoid prepper, i use opennic.

It's pretty easy to just route your system's dns queries through Tor. Then they go through some random exit node that changes every few minutes. They can log the exit nodes all they want, you're anononymous. Adding a local dns caching server makes it lightning fast.

https://applied-privacy.net/services/dns/ And there logo is a cyber turtle. And as you know cyberpunk is turtle (I don't really have the reference, but it's on the homepage of lainchan.org so it might probably besomething...)

DNScrypt is good, DNScrypt-proxy has a good server selection mechanism that lets you choose adaptively based on ping and server features. It's a bit buggy when used along with OpenVPN, you may have to restart it multiple times.

>>11543 I'm currently testing the product. It seems to do good work. A bit harsh to use it for a beginner but there are good docs.