A few comments: 1. DNS lookups should preferably be done by the network stack in the operating system, not by the application, such as a browser. It might cause that different applications on your computer to connect to different IPs for the same site due to different IPs being returned by the DNS used by the browser and the DNS used by the OS. 2. So your ISP can't just look at your secure DNS requests to see what sites you're connecting to, but instead, Cloudflare gets to see all DNS your requests, so who to trust? 3. Some companies/organizations etc, use special domains and/or names for internal resources that are not resolvable by an external DNS provider like Cloudflare, so you might no be able to access them. Cloudflare's main business is hosting sites and data for other companies, accessible with high performance and protection from DDoS attacks globally. Using dynamic DNS resolvers that map a name to different IP addresses based on network and system load, your location, location of data needed to serve your request, and so on, is an important part of that service. Might they have additional motives to see as many DNS requests as possible? Let's say Bank A is a Cloudflare customer, would they be willing to pay for data on DNS requests for Bank B from a certain region for example? Of course, they would! I'm not saying that Cloudflare does it today, but we all know that there is immense value in data regarding customer behavior.
I'd say running your DNS requests through Cloudflare, a company with a pretty decent track record in regards to privacy, is a lot smarter than running it through your ISP's DNS servers, especially since most major ISPs are known to be doing anything they can to spy on their users and then sell their data. Is it a perfect solution? No, especially not if Cloudflare ever decides to go crooked, but like I said, it's better to go through a service run by a company with a good track record than go through a service run by an ISP that is almost certainly trying to sell your data.
Cloudflare can already read all the data unencrypted for all its customers. And it's quite a big prercentage of websites who are using cloudflare. So dns is not that big of a deal
Reason number 3: some countries like Australia have “metadata logging laws” where your ISP logs headers of your traffic and thus knows which websites you are visiting when you make requests via standard unencrypted DNS. If the DNS lookup is encrypted then this makes it harder for a third party (government, law enforcement etc) to track your browsing activities.
I run a small ISP, we don’t log headers of traffic if the customer has a public IP. Only ISPs using CGNAT where the end user has a private ip need their source, destination and port accessed logged
Yes they won't see your DNS traffic but they will see the ip address of the website you connect to. So it's not really stopping them. Only way I see is to use tor or vps/vpn/proxy. They will see the connection but have no information about specific activities.
Bro I am one of your old subscribers... I always liked each videos of yours. Always learnt something new! You are so easy to understand. Massive respect.
If you set DNS up on your router, all devices in the local network will use the same DNS. If you set DNS up on your browser, it will only use the DNS on your specific browser. If you set DNS up in the settings of your phone, it will use the DNS in all apps system-wide, but only and only on this particular phone.
Very good cursory discussion on the why this information is important. The browser demonstrations that you provided were easy to follow. Love that this video was short and got to the point.
@5:40 For android; Are you saying to choose 'automatic' then? but if 'automatic' can't be chosen then to choose 'private DNS provider name' instead? You just haven't specifically specified to choose automatic so I'm asking.
I have AdGuard DNS configured directly on my router. Greatly increases my connection speeds by automatically blocking spammy ad URLs from loading at all on my network.
Yes. Ech is still in draft stage and no software supports it. Even Firefox's implementation is currently broken afaik. Your best bet is to grab an older version of firefox for Android with working esni and use that for web browsing
I do this in Control Panel which gives a....'global effect' to this setting rather than effecting just one browser. It can also be changed in Settings under Network & Internet \ Ethernet - then click on Edit next to DNS Server assignment
Thank you, your videos are always so informative! Unfortunatly I came across this one too late as esni has been pulled from Firefox-esr and replaced with something else (which seems to be incomplete). There's now no protection for SNI....unless you know something I don't and I'm pretty sure you DO! 🙂
yH SAME. It says - you maybe using a secure dns but not OVER A SECURE CONNECTION. I dont know what that means.If it's my internet connection,then I use the same for my browser too but there it's enable(working fine).
Just a note to anyone doing this for iOS or iPadOS: You must do this in Safari, not in your preferred browser for the profile to be acknowledged by the system. Otherwise it’ll just downlload but won’t show up in Settings.
Turned DoT on for cloudflare in my router which has the option (The router node of an Asus XT8 mesh system). Cloudflare's browsing check says everything is secure except for the "Secure SNI" as mentioned near the end of the video. From my understanding this should work fine as long as the web browsers of each client on my network specifically direct all DNS queries to the router.
No pun at all, but of all the channels i watch across many sectors for flavor, education, fun, gaming etc there is pretty much just two that teaches me tech to be better at computer tech and keep learning new stuff i didn't even know. That's Linus and this channel. There is so much stuff to keep keeping up with there is just no way the average person can keep up with just Tech singularly. So cheers to Thio for helping us all to becoming at PC Tech/Tech. I had no damn idea about this browser setting. Thanks man!
Muchas gracias por el gran tutorial. Pero me quede en duda. Si es posible hacer una configuración del DNS del Router de la casa... podrías ayudarme con mi duda por favor...
After running tests, I can't seem to get any of the DNS Over HTTPS profiles to work on MacOS Big Sur 11.4 after installing the profile in SYSTEM PREFS > PROFILES. Installation DNS Over HTTPS worked fine on iOS 14.6.
Thank you very much for this video. I learned a lot today. It's a good thing I have a new Samsung. I followed your instruction for it. Thanks, ThioJoe.
Can my Anti Virus or spywareblaster cause me not to be able to use this? cause it says that it's can't enable on managed browsers.. I noticed awhile back that under chrome and edge when you to go the ... at the bottom it says "Managed by organization" which after researching it looked like bit defender and spywareblaster was causing it to show that cause it's putting cookies to block by url and activex to block by url in my registry editor/browser
Turn off privacy sandbox in chrome settings though so it doesnt send your (slightly anonymised but still gives them a good picture of what you do) browsing data to websites
Thank you for sharing this! Please forgive my ignorance as I’m no expert. Should someone do all of these things even though using a proper vpn? Thank you!
That is all good and great but I have the following question. I I set the dns of the browser or the device like this, that device will not be able to resolve internal hosts, correct? example it will not see my NAS etc by name.
seems to me if your router had already set to a version of the "DNSS", the handshake check gives false negative ( or if you have a another app like say a app manager app with a VPN, it also happens the same. disabling that VPN gives a postive)
Running your own rDNS server for your network that uses the same Authoritative servers that cloudflare, Google, etc do is a better way to go. Those big boys are data mining your lookups - is it really any of their business?
Very informative. Thank you ! Edit: uh...yea, I got lost. Hackers may intercept where you're going by reading an unencrypted name - I don't think it will ever be secure; just very, very complex.
If you can use goodbye dpi on windows or byedpi for android you can avoid DPI censorships but your IP will still be the same, you can use proxy or VPN and mullvad dns.
My browser is saying my browser is managed and will not allow me to turn on the DNS. How do I get to the manager settings to allow the DNS settings to be changed?
I have an older Samsung Orbit Pro running android 8.0.0. It can't be updated (I typically just buy a new phone). I can't seem to find the setting. Is my os just too old?
He's so powerful. He can slide buttons with his fingers no mouse required.
Haha
Very impressive technology. I believe it is called touchscreen
@@larsthestorf5630 There's no screen behind him. He literally pulled the image out of the PC to slide the button and put it back. Catch up.
@@KiickrOcksz yes.
He's had wizard training.
A few comments:
1. DNS lookups should preferably be done by the network stack in the operating system, not by the application, such as a browser. It might cause that different applications on your computer to connect to different IPs for the same site due to different IPs being returned by the DNS used by the browser and the DNS used by the OS.
2. So your ISP can't just look at your secure DNS requests to see what sites you're connecting to, but instead, Cloudflare gets to see all DNS your requests, so who to trust?
3. Some companies/organizations etc, use special domains and/or names for internal resources that are not resolvable by an external DNS provider like Cloudflare, so you might no be able to access them.
Cloudflare's main business is hosting sites and data for other companies, accessible with high performance and protection from DDoS attacks globally. Using dynamic DNS resolvers that map a name to different IP addresses based on network and system load, your location, location of data needed to serve your request, and so on, is an important part of that service.
Might they have additional motives to see as many DNS requests as possible? Let's say Bank A is a Cloudflare customer, would they be willing to pay for data on DNS requests for Bank B from a certain region for example? Of course, they would!
I'm not saying that Cloudflare does it today, but we all know that there is immense value in data regarding customer behavior.
I'd say running your DNS requests through Cloudflare, a company with a pretty decent track record in regards to privacy, is a lot smarter than running it through your ISP's DNS servers, especially since most major ISPs are known to be doing anything they can to spy on their users and then sell their data. Is it a perfect solution? No, especially not if Cloudflare ever decides to go crooked, but like I said, it's better to go through a service run by a company with a good track record than go through a service run by an ISP that is almost certainly trying to sell your data.
Cloudflare can already read all the data unencrypted for all its customers. And it's quite a big prercentage of websites who are using cloudflare. So dns is not that big of a deal
been using private dns a year already, so far so good it also improves my connection
who else misses the poll feature lol, I remember all his videos had a stupid poll at the beginning...
Yeah i do
wait it was REMOVED? i thought ppl just hardly used it
Yea it's a shame
@@flop-00 it was removed a long time ago
I didn’t know they were removed, I just thought it was a mistake when people said “You can vote in the poll” and there is no poll
Reason number 3: some countries like Australia have “metadata logging laws” where your ISP logs headers of your traffic and thus knows which websites you are visiting when you make requests via standard unencrypted DNS. If the DNS lookup is encrypted then this makes it harder for a third party (government, law enforcement etc) to track your browsing activities.
I run a small ISP, we don’t log headers of traffic if the customer has a public IP. Only ISPs using CGNAT where the end user has a private ip need their source, destination and port accessed logged
Yes they won't see your DNS traffic but they will see the ip address of the website you connect to. So it's not really stopping them. Only way I see is to use tor or vps/vpn/proxy. They will see the connection but have no information about specific activities.
Bro I am one of your old subscribers... I always liked each videos of yours. Always learnt something new! You are so easy to understand. Massive respect.
He didn't see my comment 💔
@@meowxgamingstuff He doesn't have to. Plus, he has stuff to do. Don't be offended.
I love the way he tries to dumb things down so even I can understand them. It didn't work, but I still appreciate the effort.
I do this the most secure method: I handwrite each DNS request, put it in an envelope, mail it, and wait for the reply.
Government can read your mail! Oh no!
That's a silly way - you should be using smoke signals. And they should be in encoded Klingon.
I use a track and field hamster team to courier those envelopes myself ..... those hamsters are a moving...!!!!
The ping must hit negative time then!
@@davidwallin7518 So many people know Klingon now, you have to encrypt it to be safe.
been doing DNS over TLS for a while at the router level
How??? Please share
Xd
i use quad at router lvl , sofar everything good
Thank you for splitting the spands of the video up to different chapters, this makes it allot easier.
Wow!! I'm so happy that I'm in this video. Thank you ThioJoe
10 hours ago...
How?
@@linr3v730 the video was unlisted
@@linr3v730 He is a member
Lol 10 hours ago😂🤔
What is the difference between changing DNS from WI-FI setting and chancing from browser or system settings.
If you set DNS up on your router, all devices in the local network will use the same DNS.
If you set DNS up on your browser, it will only use the DNS on your specific browser.
If you set DNS up in the settings of your phone, it will use the DNS in all apps system-wide, but only and only on this particular phone.
Thanks, bro.
You deserve more views :(
Very good cursory discussion on the why this information is important. The browser demonstrations that you provided were easy to follow. Love that this video was short and got to the point.
Me: So many work to do.
ThioJoe: *new video*.
Me: watches video anyway 😁.
Thanks Thio! I'm one step closer to getting my pc to *MAXIMUM* power.
Comodo Firewall with cruelsister settings
Bitdefender AV
O&O Shutup10
I just checked my firefox and it's already enabled. Nice.
@5:40 For android; Are you saying to choose 'automatic' then? but if 'automatic' can't be chosen then to choose 'private DNS provider name' instead? You just haven't specifically specified to choose automatic so I'm asking.
I think it means that if u have secure DNS set up on your router, then u select automatic.
Thank you for the helpful information & tutorial!
The best youtube channel.....thanks joe for sharing valuable knowledge :)
Thx you for clarifying this cdn affair and others! You are right: "certainly, more knowledge than you are bargaining for..."
Good vid, you can gain 2.67M subs, just keep doing what you're doing. 👏
Iaiao
He already has that amount of subs. Smh
@@AvoidTheseMemes r/woosh
4:08 Can you also just use your current service provider's DNS?
good video Quad9 is also another good one even better than Cloudflare when it comes down to security
6:00
There is actually another hostname for this, 'one.one.one.one', so you don't have to remember that long hostname.
ok lemme save this real quick
The long one kept giving me errors, but this one is actually working
@@derpyKitsu glad to help. 👍
Yeah same, one given in the video giving me error too. Yours is working but on the DNS test Page it is still showing Not Secured
Nice video Joe keep up the good job
thiojoe thank you for teaching us really good tips for windows! cant wait to see u get 3m subs!
Good vid thanks for the info
the video came out 16 minutes ago? this dude gone in the future and commented fr 😂💯
They got secret illuminati access
@@ThioJoe 😂
I have AdGuard DNS configured directly on my router. Greatly increases my connection speeds by automatically blocking spammy ad URLs from loading at all on my network.
Just setup NextDNS on my router and it's been flawless, ended up paying the $20 yearly fee because I easily topped out at the 300,000 queries mark
Thanks, Thio for this video it's really useful.
Thio joe is the best youtuber ever
I am one of the youtubers of all time
Tried this on iPhone ios 14 but I don't get the download dialog box (8:06) not sure where to go from here..
Make sure you’re in safari
Do I need to encrypt SNI too? Currently it is not.
EDIT: LOL you are already addressing it. Great.
Super helpful, especially for iOS. thank you 😃
"Wu Tang Lan" killed me
Hey ThioJoe: I got the cloud flare dns to work on my Android but am still vulnerable to SNI hacking?
Yes. Ech is still in draft stage and no software supports it. Even Firefox's implementation is currently broken afaik. Your best bet is to grab an older version of firefox for Android with working esni and use that for web browsing
I do this in Control Panel which gives a....'global effect' to this setting rather than effecting just one browser.
It can also be changed in Settings under Network & Internet \ Ethernet - then click on Edit next to DNS Server assignment
Is there any benefit to doing both? I have a private DNS setup on my network adapters.
Thanks for this wanted cloudflare on my iPhone
Always interesting, thanks.
Great channel, wish u had more mac stuff
Thank you, your videos are always so informative! Unfortunatly I came across this one too late as esni has been pulled from Firefox-esr and replaced with something else (which seems to be incomplete). There's now no protection for SNI....unless you know something I don't and I'm pretty sure you DO! 🙂
I just set my private dns in phone with cloudflare
Love this video❤️
I tried it on Chrome, my Phone and Firefox. But when checking, it says "You may not be using secure DNS"
yH SAME. It says - you maybe using a secure dns but not OVER A SECURE CONNECTION. I dont know what that means.If it's my internet connection,then I use the same for my browser too but there it's enable(working fine).
Don't bother with Cloudlflare's check, Cloudflare doesn't know what it's doing. If you have the setting enabled, then you're using Secure DNS.
Just a note to anyone doing this for iOS or iPadOS: You must do this in Safari, not in your preferred browser for the profile to be acknowledged by the system. Otherwise it’ll just downlload but won’t show up in Settings.
Also the Profiles setting doesn’t show until you have it downloaded in safari
Turned DoT on for cloudflare in my router which has the option (The router node of an Asus XT8 mesh system). Cloudflare's browsing check says everything is secure except for the "Secure SNI" as mentioned near the end of the video.
From my understanding this should work fine as long as the web browsers of each client on my network specifically direct all DNS queries to the router.
SNI is not yet supported by many routers and servers, however as long as your DNS is secure you should be fine.
No pun at all, but of all the channels i watch across many sectors for flavor, education, fun, gaming etc there is pretty much just two that teaches me tech to be better at computer tech and keep learning new stuff i didn't even know. That's Linus and this channel. There is so much stuff to keep keeping up with there is just no way the average person can keep up with just Tech singularly. So cheers to Thio for helping us all to becoming at PC Tech/Tech. I had no damn idea about this browser setting. Thanks man!
i bet you have to throw all this tech stuff in dustbin when ar and vr are the really and no buddy use keyboard or touch screen in daily use.
Great, great tips! I had never heard of it, thanks Joe
Muchas gracias por el gran tutorial. Pero me quede en duda. Si es posible hacer una configuración del DNS del Router de la casa... podrías ayudarme con mi duda por favor...
thanks bro..more power to your channel
It was already enabled on my Firefox browser, but thanks for the heads up.
Is there any reason to use cloudflare over any of the other DNS servers?
Cloudflare does a better job at privacy with it’s vpn and apps and all that.
After running tests, I can't seem to get any of the DNS Over HTTPS profiles to work on MacOS Big Sur 11.4 after installing the profile in SYSTEM PREFS > PROFILES.
Installation DNS Over HTTPS worked fine on iOS 14.6.
Thank you for the video!
Amazing channel! i have seen already your ssd failure video and this one and i can say that i am so benefited. Btw what about Linux machines?
Nice vid. It was very helpful. Thanks 👍🏻👍🏻
Thank you for the information!
3:59 That setting isn't there on chrome v91.0.4472.77 latest version(linux).
Thank you very much for this video. I learned a lot today. It's a good thing I have a new Samsung. I followed your instruction for it. Thanks, ThioJoe.
Thank you, your vids help alot.
Are you gonna make a video on Chrome 91?
For me this works on firefox but for some reason the setting is greyed out in chrome and it won't let me turn it on
Can my Anti Virus or spywareblaster cause me not to be able to use this? cause it says that it's can't enable on managed browsers.. I noticed awhile back that under chrome and edge when you to go the ... at the bottom it says "Managed by organization" which after researching it looked like bit defender and spywareblaster was causing it to show that cause it's putting cookies to block by url and activex to block by url in my registry editor/browser
I was waiting for this video but I fell asleep 😞. It's 12:30am here in the Philippines
How to download and install MI drivers ?
Please make a video of it 🙏
Would like to use the encryption but when enabled it serves ads that would normally be filtered by my Pihole DNS. Any suggestions?
Did it. I trust you man. Thanks.
Turn off privacy sandbox in chrome settings though so it doesnt send your (slightly anonymised but still gives them a good picture of what you do) browsing data to websites
Whenever I see a thumbnail with a person putting there fingers on a button or switch. I remember, ThioJoe
Thank you for sharing this! Please forgive my ignorance as I’m no expert. Should someone do all of these things even though using a proper vpn? Thank you!
In Simple Terms, Yes you should follow these steps even if you're using vpn as Secure DNS goes out of scope from VPN Tunnel.
Do you know how this can be set up without losing access to local IP addresses (like Router Interface etc.)?
Very informative, Thanks!
Would I need to do this if I already have Cloudfare set at the router level (to point to their DNS) ?
Nobody:
ThioJoe: Hearts a comment that says "Hi bro"
UNRELATED TO THE VIDEO.
@@the_player_2 and?
@@Everytwo_ WHY WOULD YOU COMMENT THIS HERE?
@@the_player_2 why not?
Why not just change the dns on your home router to use that as dns
That is all good and great but I have the following question.
I I set the dns of the browser or the device like this, that device will not be able to resolve internal hosts, correct? example it will not see my NAS etc by name.
I’ve heard that people won’t use HTTPS for DNS due to the fact that it forces your browser to resolve to a big-scale DNS rather than more local ones
seems to me if your router had already set to a version of the "DNSS", the handshake check gives false negative ( or if you have a another app like say a app manager app with a VPN, it also happens the same. disabling that VPN gives a postive)
I changed it like you mentioned but the test site still gives me a question mark for Secure DNS.
Pretty informative and usefull video.
Thanks!
What is the cool file thing on the top right of the monitor on your desktop?
Should I do both DoH and DoT? Also do I need to do a reboot on an iPhone after install?
Great video!
Running your own rDNS server for your network that uses the same Authoritative servers that cloudflare, Google, etc do is a better way to go. Those big boys are data mining your lookups - is it really any of their business?
I wish I could upvote this more than once.
man i like all ur videous thnks for these things
Very informative. Thank you !
Edit: uh...yea, I got lost. Hackers may intercept where you're going by reading an unencrypted name - I don't think it will ever be secure; just very, very complex.
Can ISP do DPI and see the data even if we have done what you have suggested.
If you can use goodbye dpi on windows or byedpi for android you can avoid DPI censorships but your IP will still be the same, you can use proxy or VPN and mullvad dns.
Should I be using "Public Network" or "Private Network"? I have a modem from my IPS & using Windows.
Hlo bro! You are my hero of computer science🖥️💻😊😊😇😉
Thank you Joe !
Yeah pretty dope can do anything just mostly keep it on.
What a fascinating video.
My browser is saying my browser is managed and will not allow me to turn on the DNS. How do I get to the manager settings to allow the DNS settings to be changed?
What about changing the DNS on the Modem?
Hi Theo, Vivaldi browser does not have that Setting correct?
So I enabled those in firefox, re run the check, whereas it said I was connected to the 1111 server it said no to DNS over http.
I have an older Samsung Orbit Pro running android 8.0.0. It can't be updated (I typically just buy a new phone). I can't seem to find the setting. Is my os just too old?
I've got the same problem (no such setting option) I'm using a Samsung G7.
>>---> UPDATE
Firefox also removed a crucial feature called WebRTC. Even disabling it via about.config ip will still show up.
Thanks bro