What's a good privacy respecting DNS over HTTPS provider? (lemmy.ml)

submitted 3 years ago* (last edited 3 years ago) by AgreeableLandscape@lemmy.ml to c/privacy@lemmy.ml

4 comments fedilink hide all child comments

Cloudflare DNS has DoH, but it's Cloudflare so... ew. Is there one that is more privacy respecting and also has DNS over HTTPS?

all 9 comments

sorted by: hot top controversial new old

[-] kevincox@lemmy.ml 0 points 3 years ago* (last edited 3 years ago)

This is controversial because they are "big bad" companies. But in some cases I think that is a plus because they have some responsibility to do as they say.

Use a resolver that is a part of Mozilla's Trusted Recursive Resolver Program. Mozilla makes them agree to a solid privacy policy: https://wiki.mozilla.org/Security/DOH-resolver-policy#Conforming_Resolvers
Google DNS. Obviously controversial but their privacy policy is very good. They keep "full" logs for at most 48 hours and only for debugging purposes.

The major concern for all of these is that they are allowed the keep anonymized logs forever. This means that if the hostname itself it sensitive then it can be recorded forever. (For example if you have "secret" subdomains).

The other option is running your own recursive resolver, this mostly nullifies the private subdomain issue as only the authoritative server will see it (other than network snoopers) however this has very real downsides.

It exposes your IP address to many authoritative servers with no guarantees about the logs they keep.
It can be slow as there is no shared cache.
Requests from your resolver to the internet are not encrypted.

Disclaimer: I used to work at Google (but not on Google Public DNS) and have no affiliation with other named or referenced companies.

[-] TheAnonymouseJoker@lemmy.ml -2 points 3 years ago* (last edited 3 months ago)

[removed by mod]

[-] kevincox@lemmy.ml 0 points 3 years ago

Just because it is not the advice that is expected does not make it bad advice. Obviously these names have some questionable behaviours but in this case they often have separate privacy policies for their DNS services (or the Mozilla endpoint for their DNS services) which makes it much better than the other Google products which are lumped behind a single privacy policy which isn't very privacy friendly.

Unfortunately it is impossible to know for sure they are complying with the privacy policy, but this applies to all providers, no matter how large or what businesses they have other than providing DNS. So while you shouldn't blindly follow some random post on the internet you should may give these providers a second look-over and consider that these large companies have some privacy benefits if their privacy policy is accurate.

[-] TheAnonymouseJoker@lemmy.ml -3 points 3 years ago* (last edited 3 months ago)

[removed by mod]

[-] southerntofu@lemmy.ml 0 points 3 years ago* (last edited 3 years ago)

He was making a good point. Huge multinationals often have departments with wildly different behaviors/policies. These departments are often in conflict with one another, or don't know so much about one another. I agree with you trusting anything remotely associated to Google is utterly stupid when it comes to privacy, but the argument exposed was not stupid.

It was in fact solid insider's advice, to know to exploit differences between branches of a given tentacular company in some circumstances. For example, Debian's cooperation with Lenovo for better hardware support is in fact a collaboration with a specific department within Lenovo, and has a lot of blocking points from other departments.

EDIT: Also another good point was that selfhosting services (eg. services just for "me") often leaks more metadata than using shared services which other folks connect to as well.

this post was submitted on 15 Mar 2021

1 points (100.0% liked)

Privacy

31550 readers

546 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

Chat rooms

[Matrix/Element]Dead
Discord

much thanks to @gary_host_laptop for the logo design :)

founded 4 years ago

MODERATORS