Hacker News Reader

Comment by AdamGibbins | Hacker News Reader

So I should just send you all my DNS queries because you said so? Ur, I'd rather not, thanks.

Unless your using DNSCrypt or DNS over TLS (not much support, so you probably aren't), you're pretty much guaranteed to be sending queries in the clear. In fact if your using UDP, default in most cases, and not TCP, it's simple for anyone to respond to your queries (such as your ISP) and block the request to google.

This is common enough: http://www.ckollars.org/dns-intercepting.html

Aren't you doing exactly that with another recursive resolver?

I personally trust Google with my DNS queries a bit more than some guy on HN.

Maybe he's running his own non-recursive DNS server..

With many other providers I can make deductions about likely threat scenarios. For example I know about both my ISP and about Google that it is in their best interest to serve me correct DNS entries: they have no obvious motive to do otherwise. On the other hand I can be fairly certain that my DNS queries will be fed into Google's database if I use their DNS: they have an obvious motive, have the capability and no obvious disincentive. Etc.

With some new, unknown service with unknown associations I can't reason much about the threat model.

ISPs don't care much about correctness at all if it impacts performance on their side in any way. That's why many people can't actually change their DNS even if they want to (unless you run a local resolver)[1].

[1] - https://news.ycombinator.com/item?id=13037858

Many ISPs abuse DNS to serve ads. One method is to rewrite all NXDOMAIN responses to an ad server. Another involves injecting ads into HTTP responses by hijacking DNS.

Although your points about capability and motive are valid, I don't think that Google does feed DNS queries into a database. Given all the evil DNS servers out there, I think that it is in Google's best interest to provide a clean alternative and contribute to better internet infrastructure.

"After keeping this data for two weeks, we randomly sample a small subset for permanent storage."

https://developers.google.com/speed/public-dns/privacy

Reply on news.ycombinator.com