7

I use Whonix.

I am interested in making clearnet traffic as private from third parties other than the sites I visit, as possible. This not only includes the NSA, but also third-party DNS providers which may log, and even likely be willing to share this information with NSA (such as Google's DNS or OpenDNS), but even just by virtue of hte traffic being unencrypted over the Internet and thus, no matter how well-meaning, still sniffable by anyone on the pipes between you and the DNS provider(s) used by your particular Tor exit node at the time.

Whonix's wiki advice on running DNSCrypt within the VM makes a good point that using DNSCrypt for Tor browsing may not be as advantageous as one may first think.

But if you trust a DNS provider (or a rotating array of them, such as the DNSCrypt community), who not only promises to be logless/less logging and is smaller, security-focused, generally donation-based, AND uses a protocol that at least doesn't broadcast your queried sites with a megaphone on the wires while you communicate with it, wouldn't it still be better?

The question is: do I share what websites my (rotating) Tor IP addresses visit, with MANY highly insecure DNS providers (distributing the inevitable across many providers, even though it's totally sniffable, poisonable, and most likely logged), or with ONE highly secure DNS provider where the traffic is indeed far less likely to be leaked, logged, or sniffed?

It is mind-boggling to think through the ramifications of either choice, privacy and anonymity-wise. NSA would have more information with unencrypted DNS requests to later match to other inevitable clearnet metadata like HTTPS requests between your rotating Tor IPs and the servers you request to start HTTPS sessions with - and of course, all other unencrypted TCP traffic you may visit already. (like apt-get updates)

My idea is to make a simple script (in configuring and restarting dnscrypt-proxy) to rotate through different DNSCrypt providers each day or logon session (or activity that I want to seriously de-correlate to other ones, if uncomfortably close in time to each other), distributing the 'power' and required trust aptly warned on the Whonix wiki, to several providers and not just one.

Could that be combining the best of both worlds and be the very best solution for DNS privacy and security, on Tor?

Improve this question
4
  • The problem is not that we cannot rotate using DNSCrypt providers, but it is that those providers are relatively few comparing to other DNS providers.
    – Linostar
    Feb 2, 2015 at 15:07
  • I'm new to DNSCrypt, but thankfully, it appears it's solidly grown over the last 18 months. Ok, a small community, but a dedicated one and I can only see the number of DNSCrypt servers increasing over time, not decreasing. The need will only increase - just like the explosion in VPN providers we've seen. Ultimately, I'm guessing it probably comes down to trust. But to be honest there's not much to trust with unencrypted and log-hoarding normal providers already. I think it's a win-win doing a rotation of DNSCrypt providers in Whonix, but thought I'd post it here for some feedback.
    – Tor User
    Feb 2, 2015 at 16:53
  • Most of the time you want to behave as much as other Tor users to blend in. Anonymity loves company. Could be pseudonymous rather than anonymous. Because you could be one of the very few that only transmit TCP through Tor, but who's connection is not preceded by a DNS request. Seems more trackable to me than other connections. Also what would you gain? Instead of risk being mitm'd/logged of DNS request + TCP request, just mitm'd/logged of TCP request? Not much?
    – adrelanos
    Feb 2, 2015 at 23:11
  • Good point, but actually, I see now that's both yes and no: DNS caching is widespread (outside of DNSCrypt: the Tor exit node most likely, other node users' browser/systems, and also me using Unbound, as advised on DNSCrypt.org), so in fact, MANY TCP requests initiated by an exit node would not be preceded by a DNS request anyway! So, a good deal of mine will simply be cached like anyone else's - BUT, when I'm not drawing from my local cache, instead of my DNSCrypt activity showing as 'nothing' it'll actually be a unique HTTPS/VPN-like encrypted request to whatever DNSCrypt server I use.
    – Tor User
    Feb 3, 2015 at 12:25

1 Answer 1

Reset to default
1

I recommend looking into DNS over HTTPS for any clearnet traffic that you may be touching, including if you are running your own exit node: Here is an example along with instructions on running your own.

I am running my own at https://jcdns.fun to experiment with it and have both my Firefox Nightly browser and Chromium browsers pointed at it for all DNS requests.

Improve this answer
1
  • looks like you need to add a web page - the URL looks broken... need help? just drop me a line!
    – Alexey Vesnin ♦
    Oct 9, 2021 at 22:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .