Slashdot Mirror
Cloudflare's 1.1.1.1 Service Launches on Android and iOS (fastcompany.com)
harrymcc writes: Content-distribution network Cloudflare has introduced iOS and Android versions of 1.1.1.1, a free service which helps shield you from snoops by replacing your standard DNS with its encrypted (and speedy) alternative. The mobile incarnation of the PC service it launched last April, the apps don't require you to do anything other than downloaded and install them, give your device permission to install a VPN, and flip a switch -- making them approachable for the masses, not just geeks.
You really should read the article. If you have your own DNS or your own VPN this is a downgrade to your opsec. Most people don't, and they do use the ISP's DNS servers (or the telco carrier's DNS) ... and here is where the Cloudflare service really makes a difference.
It doesn't "Hijack" anything. You either affirmatively choose to install it... or you don't. If you don't, nothing changes.
Try reading the article for comprehension. /.reader#734
Hmn no. This service attempts to hijack my own dns. I have started blocking 1.1.1.1 on all my firewalls and routers. Both on company and personal machines.
Yes, I agree.
http://hightechforum.org/cloudflares-1-1-1-1-dns-does-nothing-for-privacy/
If they host a lot of the content, they know what you're looking at. Now they know.. what you're looking at. Problem is what?
We have a simple solution!
Install this app and give Cloudflare permission to access all of your network traffic and you can use our DNS server!
This isn't protecting traffic from snooping, it's exposing traffic to Cloudflare. The same company which makes a business model out of holding other people's private TLS keys. The same company which refuses to stop serving known spammers. The same company which was breaking half the internet for Tor users.
Cloudflare is the kind of centralization we need to get away from.
its funny how ass backwards our technology has been rather than how we live in our neighborhoods and walk down the streets. now technology is starting to behave like it should be like.... hey, a stranger someone lives there because the light is on, and don't know who, and what they have... unless i snoop in their mailbox and peep through their windows... no value in anonymous traffic other than traffic in itself.. ads should continue without alot of granular metrics like it used to be, much like tv and the neilsen ratings..... me likey...mikey likes it...
From your own link, the 1.1.1.1 isn't much use without also using a VPN to encrypt the IP calling it. Which... they now have added to the app, as above.
I'm curious about their altruism.
If you aren't blocking outbound DNS from everything but your authorized DNS servers on an enterprise network via your firewall, then you are grossly incompetent and oblivious to modern attack vectors.
And basic security principles like defense-in-depth.
How am I supposed to remember that IP address? If only there was a system to translate such IP addresses into more human-friendly names that are easier to remember...
I deny that I have not avoided attaining the opposite of that which I do not want.
Aren't they a content-providing, aka DRM type delivery vehicle?
Are you aware of the fact that Cloudflare has access to ALL of your DNS queries? If you do not trust your ISP, Google, etc., why would you trust Cloudflare?
Do not download this program for Linux or windows. I tried the Linux port and it opened up a command prompt and did a sudo rm -rf. I have no idea how it got my root password.
I then tried the windows version a couple days later. Same thing except I kept seeing deltree.
APK can not be trusted.
First off, he isn't an American. He is a foreign adversary living in the republic of congo. He makes his money from blood diamonds by using child labor.
Stay away from APK and all his software if you want a clean system. Beware anything that is made from APK is a virus or malware.
Yours truly,
Spruce Schneier
Fuck it, we are going with 5 DNS entries.
It's not as useful as it once might have been. HTTPS used to be 100% secure with only hole being DNS. This would plug that... except that browsers have been migrating to SNI, a system to allow a single IP address to service multiple HTTPS sites, which means that the domain name gets exchanged in a snoopable (MITM) manner.
With SNI becoming common, the Cloudflare service really doesn't provide much security.
You are not alone. This is not normal. None of this is normal.
Yes, we know that bit, what people here are saying that's a bad idea, given that if someone installs the Firefox plug in, they'll suddenly have problems accessing internal-wiki.myemployer.com, timeoff-booking-system.myemployer.com, and source-code-control-system.myemployer.com.
Sysadmins in general also like having control over their own networks, and having random employees use third party DNS, still worse to "protect their privacy" (prevent a sysadmin from determining what they were using the network for, something they have a legitimate reason for), undermines that.
You are not alone. This is not normal. None of this is normal.
As far as I know cf delivers any content their coustubers want them to (any legal content that is) the use of drm or not is the costumers Âchoice but then again I might be miss informed
Good point put until ipv6 is absolutly evrywhere we canâ(TM)t afford the ipv4 burn rate of having avry https site on their own ip esp niw that more and more browsers flash up scary messages if you try accessing anything over http.
This works only for ipv4 traffic (the vpn part) so if the network ypu connect to is dual stacked only 44 traffic will be secured and since most apps use ipv6 as defaulr when avalable a significant portion ofyour traffic will not use the vpn, how could cloudflare miss this? Itâ(TM)s not like these pople donâ(TM)t know about nerworking is it
You downloaded an VPN app that now has the gall to ask to install a VPN - inconceivable.
There are two rules for success:
1. Never tell everything you know.
Guess what?? It won't work if a competent sysadmin blocks all outgoing DNS queries from the LAN except the DNS server on the LAN that they should be using.
So, what will happen when random employee installs said App?
Their internet on their mobile device will not work after installing the app and they will then remove it. Problem solved.
[citation needed]
I use this on my Android 8.1 device simply because it's convenient. As for my home network, I run my own DNS servers so I really don't have to worry much about DNS traffic being snooped by my ISP. If I were so inclined, I could also run all of my home network traffic over a VPN to my own cloud servers. But this initiative by CloudFlare is nothing more than a gimmick to make money. Instead of your ISP selling your data, CloudFlare now gets the piece of the pie.
You need to insert the dns because you can't configure a custom dns on a gprs/2g/4g connection on phones. so what to do? well create a local vpn and intercept the dns there. the vpn doesn't need to "go" anywhere.
You cannot filter/block the dns requests otherwise on the phone itself. this situation sucks and is deliberate. this is a janky workaround to combat that.
This idea of doing filtering like this is years old. there's a bunch of apps like this on play store.
- on a related note, samsung for example has actual api's to configure the actual firewall, those apis aren't free to use but behind a licensing deal(your phone check the developers key when you use an app that has done the licensing with samsung).
or, of course, you could just root your phone. I mean that would be the most sensible thing to do. you can't configure these vpn's to be "always on" anyways - and fucking android lets some built in stuff bypass the always on vpn setting anyways.
world was created 5 seconds before this post as it is.
Because most people have to trust someone with their DNS queries, especially when on mobile networks. Given a choice of unencrypted DNS queries to your scummy mobile provider's servers or encrypted ones to Cloudflare, you are probably better off with the latter.
At least Cloudflare can't tie up the request with cell location data and sell that information to nearby businesses.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Isn't this just trading in one snoop with a different snoop?
Hey, Windows users, there is no such thing as "forward" slash, there is only slash and backslash.
I'm glad to hear that! I've been wondering if there would have been a way to at least use some form of adhoc encryption to exchange the hostname with the server, and then verified afterwards that the encryption wasn't compromised, eg:
Client: Send me the public part of an encryption key
Server: 1234
Client: (Encrypted using 1234)www.hostname.com
Server: (Key for www.hostname.com)
Client: (Creates session using www.hostname.com's key)You sent me 1234 to use to encrypt the hostname, was that valid?
Server: Yep, that's the one I use today.
The only problem I can see is if multiple servers serve the same site, then you'd have to make sure the key used to encrypt the hostname is the same on each server (if it allows different keys for different TCP sessions then the attacker can just break the connection the first time they try to connect after faking being the server to get the hostname.)
You are not alone. This is not normal. None of this is normal.
Because I have no idea who the ISP is when I travel.
If I'm at home, this is probably overkill.
If I use google without dnssec or dns-over-https, then it's easy to see which sites I visit.