Hacker News Reader

Let's say you set this up with the Tor Browser, all your DNS resolutions are done using this onion, then they're all linkable--whereas with the default they're unlinkable since two different circuits were used for different first-party domains. That's the point.

View on HN

I don't think that's much of a problem considering it's simply the DNS resolver. Linkable might be a problem if the site you want to reach is the site you want to visit.

On the other hand, I'm sure this is fixable in certain ways, just needs patches in the browser/proxy.

Right, if you don't trust CloudFlare or you think there is a flaw in Tor. Let's say you didn't set this up, the exit node can lie about the DNS resolution. Granted, to your point, unless I was worried about exit nodes, I probably would want my resolution on the same circuit/session as my access.

Doing so simply helps traffic analysis. It's how tor works, no flaw involved.

I don't think there's any reason you can't have both: for each site have a new circuit, and make a connection for that DNS resolution only, on that circuit or a separate one, using Cloudflare.

Reply on news.ycombinator.com