What are we looking at here?
Also, might be a good time to look into a Raspberry Pi or even an old laptop and learning how to turn an adblocking Pi-Hole into a full fledged DNS resolver so you’re not sending your requests outside of your own network.
Either that or use DNS-over-HTTPS.
Your DNS history is metadata in the same way your phone call history is. The government may not be listening to your calls, but they can figure out a lot by seeing you made a three hour call to a Suicide Hotline. Similarly, they may not see your data-in-transit, but they may be able to see your DNS requests and glean a lot about what sites you’re visiting.
Also, might be a good time to look into a Raspberry Pi or even an old laptop and learning how to turn an adblocking Pi-Hole into a full fledged DNS resolver so you’re not sending your requests outside of your own network.
Not sure if I’m misunderstanding you, but pi hole doesn’t stop your DNS requests from leaving your network. All it does is filter the requests you send before relaying the requests that aren’t in the filter list to it’s upstream/next hop server.
Either that or use DNS-over-HTTPS.
DoH is a reasonable option, but it only protects your metadata if you’re using a resolver you trust not to keep records. If the resolver keeps records, DoH or not, they’ve got the metadata of where you’re going.
Not sure if I’m misunderstanding you, but pi hole doesn’t stop your DNS requests from leaving your network. All it does is filter the requests you send before relaying the requests that aren’t in the filter list to it’s upstream/next hop server.
Yes, that’s Pi-Hole with it’s default rollout. By default it’s a DNS forwarder that, as you said, after filtering locally, sends a request to an upstream DNS server (like say, Google 8.8.8.8 or Cloudflare 1.1.1.1) to search for the IP for the domain name you have entered into your browser.
Using unbound, you turn a Pi-Hole from a mere forwarder to a Recursive DNS Server. From my link (the one you quoted):
What is a recursive DNS server?¶
The first distinction we have to be aware of is whether a DNS server is authoritative or not. If I’m the authoritative server for, e.g., pi-hole.net, then I know which IP is the correct answer for a query. Recursive name servers, in contrast, resolve any query they receive by consulting the servers authoritative for this query by traversing the domain. Example: We want to resolve pi-hole.net. On behalf of the client, the recursive DNS server will traverse the path of the domain across the Internet to deliver the answer to the question.
And why does this matter? From the same link:
Benefit: Privacy - as you’re directly contacting the responsive servers, no server can fully log the exact paths you’re going, as e.g. the Google DNS servers will only be asked if you want to visit a Google website, but not if you visit the website of your favorite newspaper, etc.
So while it’s not as nice as having a DNS root server in your own home (which is a whole different beast and highly improbable for an individual to roll out) it effectively spreads its search so diffusely among DNS root servers, Top Level Domain DNS servers, and authoritative DNS servers that none of them have a full picture of what you searched for. The link I sent also breaks down the difference in steps:
A standard Pi-hole installation will do it as follows:
- Your client asks the Pi-hole Who is pi-hole.net?
- Your Pi-hole will check its cache and reply if the answer is already known.
- Your Pi-hole will check the blocking lists and reply if the domain is blocked.
- Since neither 2 nor 3 is true in our example, the Pi-hole forwards the request to the configured external upstream DNS server(s).
- Upon receiving the answer, your Pi-hole will reply to your client and tell it the answer to its request.
- Lastly, your Pi-hole will save the answer in its cache to be able to respond faster if any of your clients queries the same domain again.
After you set up your Pi-hole as described in this guide, this procedure changes notably:
- Your client asks the Pi-hole Who is pi-hole.net?
- Your Pi-hole will check its cache and reply if the answer is already known.
- Your Pi-hole will check the blocking lists and reply if the domain is blocked.
- Since neither 2 nor 3 is true in our example, the Pi-hole delegates the request to the (local) recursive DNS resolver.
- Your recursive server will send a query to the DNS root servers: “Who is handling .net?”
- The root server answers with a referral to the TLD servers for .net.
- Your recursive server will send a query to one of the TLD DNS servers for .net: “Who is handling pi-hole.net?”
- The TLD server answers with a referral to the authoritative name servers for pi-hole.net.
- Your recursive server will send a query to the authoritative name servers: “What is the IP of pi-hole.net?”
- The authoritative server will answer with the IP address of the domain pi-hole.net.
- Your recursive server will send the reply to your Pi-hole which will, in turn, reply to your client and tell it the answer to its request.
- Lastly, your Pi-hole will save the answer in its cache to be able to respond faster if any of your clients queries the same domain again.
Interesting, I haven’t followed pihole in a long time. Thanks for educating me!
Couldn’t they just get that info from the IP addresses anyway?
Someone from DHS trying to cause trouble?
They just changed their policies to specifically allow surveillance on the basis of sexual orientation and gender identity
Which is funny: Hey, you’re now under surveillance for being straight! What, you’re gay? Hey you’re now under surveillance for being gay!
The rules disallowing them to spy on people because they’re LGBTQ+ were removed.
That’s what I like to see.
