Hacker News Reader

Comment by Maximus9000 | Hacker News Reader

> Is it to avoid your ISP collecting browsing data off you and selling it? Perhaps using 8.8.8.8 or 1.1.1.1 as your DNS might be good enough.

Wouldn't your ISP still see what IP's you are visiting? Then, your ISP could just reverse DNS that IP to get the domain name, right?

View on HN

Maybe, but most ISPs are lazy/cheap and can't do a full-take packet capture of all customers data at the same time. The ones that I have seen usually have a custom or logging DNS server that associates each domain request with a customer account. So yes, in many cases, changing your DNS server is enough to avoid the larger DNS sniffing operations. You should also use an IP check query to make sure that you are really using the DNS server you think, and that you're not being DNATed back to your ISP's DNS server.

DNS is super trivial to redirect. I've been on ISPs that redirect _all_ DNS traffic to their servers regardless of where it was sent. The best solution here is to switch to DoH. Of course then your DoH provider gets to log all of that sweet info instead.

Not if you run your own DoH endpoint on a VPS!

I have my own unbound running on a VPS. My network intercepts all port 53 traffic, filters out ad servers, and then forwards over wireguard to my VPS. I should probably enable DoH as well. I'm feeling kind of lazy about it though.

I think ceasing to use your ISP provider's unencrypted DNS services will already bring quite some boost in privacy for the average internet user. That's why I recently switched to using DNSCrypt (https://github.com/DNSCrypt/dnscrypt-proxy) with one of the public providers listed here: https://dnscrypt.info/public-servers (pick one run by some university or internet activism organization).

It also brings an increase in recaptcha puzzles lol

This time when I changed internet service providers from Cox to AT&t fiber, I was shocked to find that I could not change my DNS to point to the OpenDNS servers!

AT&T requires you to use their DNS? Did you try doing DoH to bypass?

Not necessarily, many sites are hosted on the same VPS, or the IP could just be one of 5000 CloudFlare servers serving up the page you requested.

Most ISP's wouldn't care... and they shouldn't

Reply on news.ycombinator.com