NextDNS logging is opt-out, not opt-in as stated on PG's DNS Resolvers recommendations page

[dngray (Daniel Gray)]

@ignoramous

@dngray

I think at the point you’re trusting NextDNS to do logging, it really doesn’t matter what platform they use.

Except that’s not what the PrivacyGuides website points out. It specifically calls out storage location without mentioning that logs are streamed worldwide via BigCloud:

- You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
+ You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
+ The only way to access the logs is either via nextdns.io dashboard which streams them over Cloudflare or via their API which uses (GCP/AWS?), and it is possible these providers have access to your logs in plaintext.

The reason we don’t mention “Big Cloud” is because it doesn’t really impact the threat model. If you don’t trust the Privacy Policy of NextDNS and their suppliers then you need to employ anonymization (Tor, VPN etc).

None of the encrypted DNS providers advertise themselves as being anonymous, simply that they do not log. This has been discussed elsewhere, but Privacy Guides doesn’t need to constantly keep an eye on every provider’s sub processors. The reason for this is there can be a variety of sub processors and it can be impossible for us to truly know depending on what they are used for. It can also change and we would have to constantly check every provider by essentially re-valuating every recommendation. Even then we only see the outside picture.

That being said we are attempting to encourage NextDNS to provide a little more detail in that regard. The data is still bound by NextDNS’s privacy policy, we’re up front that account usage has logging by default and you might need to disable it. They are very clear in their privacy policy that they don’t sell that data.

@ignoramous

We are public about it; for ex,

Mentioning if it was irrelevant to the conversation taking place regardless of if there is public evidence of it.

@ignoramous

Please stop gaslighting me on top of calling me dishonest / insinuating that I can’t prove my claims.

There were also some posts in the other thread about Cloudflare and the MiTM thing (when we don’t even use them as a CDN and only as nameservers). Then the goal posts moved to CF being able to change our DNS records, when that is not in our threat model. A lot of the posts you make have a authoritative tone ie: we should be doing this or that. Then there was the HPKP suggestion when it isn’t even a relevant security feature anymore.

Keep in mind as you’re flaired as RethinkDNS people might be willing to give your opinions more weighting in a debate, than some random forum user. The reason I did flair your account was because you do offer similar features to what NextDNS does with the RethinkDNS Android app and I think it’s important for people to know that. Also when people ask about RethinkDNS, you’re able to respond in some official capacity.

@ignoramous

@dngray

That is what people are going to really care about when they use these services.

Depends on the people and the threat model. If they trust PrivacyGuides and see “no logs” (a very strong guarantee), then they assume there’s absolutely no logs. I mean, words mean things. There’s a reason Mullvad goes to the extent they do with diskless servers, verified boot, no remote shell (which they’re working towards etc). To lump, Mullvad’s DNS as “no logs” in the same breath as other DNSes is really being disingenuous, imo.

Even with Mullvad it’s still a “promise”. It’s also worth noting that Mullvad’s main business is a VPN and their intention is to provide anonymity. They purposefully collect no data so they cannot be asked for it.

Most of these DNS providers don’t purport to offer anonymity, which I think is the key difference. The DNS page doesn’t suggest that using an encrypted DNS promises any kind of anonymity, only confidentiality with regard to queries. This is further made obvious on the “Learn more about DNS” page which provides demonstrations of where internet usage can leak in other ways.

@ignoramous

The relevance is for PrivacyGuides to do due diligence on dns0.eu before recommending it as “no logs”. Jonah gets that and created a github issue for it. So, it did have relevance.

If you see the further comment there, it will likely result in further clarification of what logging is. I think it’s fair to say in most people’s minds that is going to be association of queries with resolver IP address (PII - Personally Identifiable Information) and not some rough global metrics that don’t identify anyone.

@ignoramous

@dngray

That could be a simple integer value assigned with an account. Technically still no logging if they’re not keeping the contents of the query ie which domain.

More assumptions, and just a few comments ago, you accuse me of speculation? My only point was, why not ask them instead?

The dns0 privacy policy is quite clear at least in my opinion:

We do not log any Personally Identifiable Information (PII).

Our recursive DNS service, this website and other services we provide are fully compliant with the GDPR, and we welcome audits from reputable European entities.

While they don’t elaborate on what they do log, they are very careful to state they don’t log PII which has to be people’s IP addresses. A DNS query is quite a simple transaction. A query is made and an IP address is returned. There is no account based feature with dns0.eu so that simplified things somewhat.