Cloudflare 1.1.1.1 iOS app

Configuring with iOS settings sends unencrypted DNS requests to 1.1.1.1 and, as a result, the sites you access can be seen in your internet traffic by people like your Mobile provider (when using mobile internet) or the local cafe (when using their WiFi) or your home ISP (when using your home WiFi).

This app enables your DNS requests to be encrypted. Your requests are still seen by Cloudflare, of course.

zackbloom7• 8 years ago

We try to hold on to as few logs as possible, the goal of the project is improving privacy. You can read the full policy here: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

tuananh• 8 years ago

dns over https as well

rabboRubble5• 8 years ago

That setting change only changes DNS while on Wifi. IOS offers no direct method of changing DNS while on cellular. Without something like Terminal on an iPhone, pretty difficult to tell which DNS is being used by the iPhone unless the phone is jailbroke. I use an app called Net Analyzer to check various networking configs. I'm not sure even the Cloudflare app is actually changing DNS. Need to do a bit more poking about to figure out what exactly is going on.

Edit: After playing around a bit, with the CloudFlare app alongside Net Analyzer, DNS on cellular appears to modified from my cell provider to what I think is the CloudFlare VPN profile on the device with IP addresses 192.0.2.2, 192.0.2.3, 192.0.2.4.

zackbloom7• 8 years ago

It installs a VPN policy to do it, that's the only viable method on non-managed devices. There is another big difference as well, the app enables DNS-over-HTTPS which encrypts your DNS traffic.

dnh44• 8 years ago

You can’t specify your DNS server at all on iOS when you’re not on WiFi.

hendry• 8 years ago

Yay! Centralisation

AckSyn• 8 years ago

it's just a service

you can run your own easily

just connect to roots

saagarjha• 8 years ago

It's cute that the time in the screenshots is 11:11.

lenocinor• 8 years ago

I get the joke, but I wonder if some folks will believe it's for a different reason: https://en.wikipedia.org/wiki/11:11_(numerology)

johnklos3• 8 years ago

I'm not quite so sure why everyone is happy to just blindly trust Cloudflare. These are the people who play games when Adobe Flash "updater" sites which are clearly, obviously and unambiguously hosting Trojans are hosted via their services.

I don't trust them one tiny bit.

whorleater• 8 years ago

You shouldn't, but there's some vague notion that giant corporations have taken over the net and fighting against it is actively harming your privacy more than it helps. Is cloudflare better than your {ISP, self hosted, Google, etc} DNS servers? That's probably for an individual to decide.

eridius7• 8 years ago

What do you mean, you don’t trust them? Cloudflare provides services to scummy websites, yes. But Cloudflare isn’t doing anything to promote these websites, trick users into visiting them, or otherwise aide them in any way other than providing the exact same services they provide to everybody else.

I fully understand disagreeing with Cloudflare’s decision to turn a blind eye towards what their customers are doing. I just don’t understand why this behavior means you “don’t trust them”. What do you think Cloudflare is going to do?

slededit3• 8 years ago

Its just weird they are willing to censor legal speech but not illegal things like malware.

johnklos3• 8 years ago

Something is clearly and obviously illegal. Nobody can say there's ambiguity about the legitimacy of these sites. Yet Cloudflare not only does nothing even when these sites are reported to them, they help make sure the sites continue to run.

Would the problem here be more clear if Cloudflare did nothing when people use them to provide hosting services for child porn sites? Why do you think it's OK for Cloudflare to decide when to ignore the law and when to do something about obviously illegal content?

rabboRubble5• 8 years ago

Do you trust your cellular carrier more?

I am not saying you are wrong, but the decision is which provider do I trust the least? I personally do not trust Verizon Wireless at all and they know my real name, mobile phone number, address, and credit card number. Cloudflare does not have these validated data points about me, so maybe they are using my data in a nefarious way, but they don't have the other PII to go along with it. Perhaps they have a method to match my data requests to publicly purchased PII, but their matching is not already validated by me, so there is a chance for error fuzzing.

polycaster• 8 years ago

This might be true if you're from the US. Being situated in Europe (or elsewhere on the map) might very well change the perspective towards Cloudflare a bit.

judge20202• 8 years ago

Have they ever explicitly not taken down one of these sites? https://www.cloudflare.com/abuse/form

eps• 8 years ago

A lot of cracking- and RE-related websites sit now behind CF and, no, they are not taking them down, because apparently flaunting one's cracks (while linking to them on other sites) is not an abuse of their terms.

wild_preference• 8 years ago

Unless your site involves something particularly terrible, their abuse form is only good for the fact that it gets forwarded to the underlying web host.

Most web hosts are going to be more strict than CloudFlare is, but you'll notice that most scummy sites use scummy hosts.

rajacombinator• 8 years ago

They’ll take your site down if they don’t like your political views though.

tomschlick3• 8 years ago

Been using this since the beta on testflight and it has beeen awesome. The only thing it needs IMO is the ability to whitelist WiFi networks not to run it on. I run a PiHole instance at home that does DoH through CF already so I have to remember to turn it off/on all the time to get the ad blocking.

krispbyte• 8 years ago

On Android I use DNS66 [0], it creates a VPN server in my phone, redirects DNS traffics through it and filters it. This way I get adblock all the time even if I don't have a PiHole. Edit: I see now this app by CloudFlare does the same. However DNS66 let's you choose your own hosts filters and your own DNS servers.

[0] https://f-droid.org/en/packages/org.jak_linux.dns66/

tomschlick3• 8 years ago

Yeah iPhone user here so thats probably a no go.

I've considered just creating a VPN back to my gigabit connection at home (running R715 in a homelab rack) but not super keen about the data making a round trip back home first, especially when travelling.

ChrisAtWork• 8 years ago

Same. My home Unifi network is all integrated with PiHole and does DNS over HTTPS to CF.

Having the 1.1.1.1 on my phone is great except when I'm at home and want it disabled.

NamTaf• 8 years ago

It would be a good use of the VPN-on-demand features of iOS. Assuming you only connect to wifi at home, I guess.

seanp2k22• 8 years ago

Thanks for the DoH (DNS over HTTP) tip re: pihole. Here's the setup guide: https://docs.pi-hole.net/guides/dns-over-https/

sbarre• 8 years ago

The whitelist feature would be great because our work wi-fi network seems to be incompatible with this app somehow.

bart3r• 8 years ago

If you install this on iOS, you'll see a little 'VPN' icon in the top bar of your phone. Not sure if you can hide that though.

dividuum• 8 years ago

Same on Android. It's also implemented as a VPN.

asasidh• 8 years ago

Trust us, not them?

jonny_eh• 8 years ago

I'd trust one organization that I trust a bit (Cloudflare), rather than random wifi hotspots or my cell & ISP providers which have proven themselves untrustworthy.

ashishb4u• 8 years ago

From their play store description:

"Best of all: No upsells, no in-app purchases, and free for life. Website owners pay us to make your Internet faster so you don’t have to."

That sounds totally against net neutrality to me. Unless website owners are not getting preferential speed up.

eridius7• 8 years ago

The description does not mean website owners are paying so that users of this app can get a faster connection to them. It just means website owners pay Cloudflare already, Cloudflare’s business model is selling services to website owners, and so this dinky app for consumers has no need to make money and therefore is free.

brians2• 8 years ago

Wellll.... paying Cf customers will get lower latency service using this, just as Cloudfront gives better service to AWS users.

That’s part of why this app is in CF’s interests.

nyolfen• 8 years ago

so, it's a vpn -- the other vpn app i use is local hosts file adblocker that apple removed from the app store last year for the following reason:

According to Apple, Future Mind's AdBlock app violates section 4.2 of the App Store Review Guidelines, which dictates that apps must be useful, unique, and "app-like."

‾\_(ツ)_/‾

rconti• 8 years ago

It's not a VPN. Unless you mean "it's a VPN for your DNS traffic only". Which is an odd distinction.

ebeip90• 8 years ago

It's implemented on iOS as a VPN, of which you can only have one active at a time.

Some Ad Blockers are implemented as VPNs. This is unfortunate, and they should use the Safari Content Blockers interface instead. Content Blockers cannot intercept or sell your content, since the code is sandboxed and doesn't get network access. NeverAds seems to work well for me.

scarface743• 8 years ago

Well, VPN software is one place you don’t have to use Apple’s “walled garden”. They could sell thier service outside of the App Store and publish instructions on how to set it up within settings on the iPhone.

sigjuice• 8 years ago

Not quite. iPhone VPN settings are limited to the protocols that Apple has built into iOS (primarily IPsec). If you want something different like WireGuard, you need a separate app.

dschuetz• 8 years ago

Don't use that. Don't use 1.1.1.1 or 8.8.8.8 or any other DNS service which have clear conflicts of interest on both sides. Don't ever trust DNS servers you don't have any control over.

Gaelan3• 8 years ago

Any specific thing that either of them are doing wrong, or just hypothetical? Not a huge fan of a lot of things Google does, but they do seem to run 8.8.8.8 quite responsibly. (I don't have much against Cloudflare, and they also seem to good a job.)

foota• 8 years ago

What? Who has complete control over their DNS?

judge20202• 8 years ago

Yep. Too untrustworthy. My isp's DNS which shows me Yahoo ads instead of a NXDOMAIN error is much safer.

jrockway2• 8 years ago

I don't have control over the root domain name servers, so I guess I shouldn't use DNS?

slimsag• 8 years ago

Just run your own root name server! I only use my own self-hosted internet, because it is safe and only contains things that I myself have set up.

gt640k• 8 years ago

How do I test this is working correctly?

social_quotient• 8 years ago

Connect your phone to desktop via adhoc network and run Wireshark. You’ll see the dns lookups and be able to confirm the tcp traffic afterwards.

This SO post seemed to give a lot of details if you need it

https://stackoverflow.com/questions/9555403/capturing-mobile...

Good luck!

jen729w2• 8 years ago

So the app shows you your DNS logs, without any sort of protection.

I imagine this is a trivially simple way of snooping on an unsuspecting target. Let’s say you don’t trust your spouse. You install this app – showing them the security benefits as advertised by the application, letting them do their own research if necessary – then a day later come back and scroll through their DNS logs looking for cheatonmypartner.com.

seanp2k22• 8 years ago

physical access = device owned in almost every case

laumars2• 8 years ago

This app changes nothing. If you've got access to install software on someones handset then there isn't much they can do to prevent you from installing tracking tools - aside having to trust that you wouldn't.

jen729w2• 8 years ago

All good points in response, I hadn't thought this through.

- You need to be able to unlock their device without their knowledge to view the DNS logs.

- Therefore you know their PIN or have your fingerprint loaded (as I do on my partner's phone and vice versa).

- Therefore you can just install [any other tracking malware] and hide the icon in a folder somewhere. And now you don't have a VPN icon in the toolbar.

But does [any other tracking malware] actually exist for iOS?

benbristow• 8 years ago

Might raise some flags with the 'VPN' icon in the corner of the device.

imagetic2• 8 years ago

It's super slow for me. I'm on AT&T fiber at home. Which I can't even set my DNS to without taking everything down. But when using the Cloudfare app it appears to work, but it's 10+ seconds to load a page.

Mistri3• 8 years ago

I've actually had a noticeable increase in speed, not sure why that's happening to you.

imagetic2• 8 years ago

I'm jealous. It's still incredibly slow for me. I assume it's an AT&T thing since I'm on wifi working from home. I am unable to use 1.1.1.1 with AT&T at all still. So I use Google's 8.8.8.8 until they fix the issue. But it's been 6 months and I doubt it will ever be resolved at this point.

Down_n_Out2• 8 years ago

On IOS there's also DNSCloak[0], which goes even further and has the option to choose for ad-filtering (eg, via PiHole) in combination with no-logging and using 1.1.1.1 as DNS.

[0] https://itunes.apple.com/us/app/dnscloak-dnscrypt-doh-client...

Mistri3• 8 years ago

Does it encrypt DNS queries like the 1.1.1.1 app though?

ripdog• 8 years ago

The URL includes 'doh', which means 'dns over https'. That is the encryption layer which 1.1.1.1 uses.

Down_n_Out2• 8 years ago

As others have replied already, it does, depending on which solution you pick out of the list. I'm a happy user of this app, no affiliation at all in case someone was wondering.

jedisct13• 8 years ago

Yes, DNSClock only supports encrypted DNS.

codetrotter• 8 years ago

Until I set up PiHole, does anyone know a good blocklist to use with DNSCloak for blocking ads?

jedisct13• 8 years ago

See https://github.com/jedisct1/dnscrypt-proxy/wiki/Public-black...

As well as the configuration file for the script that comes with dnscrypt-proxy: https://github.com/jedisct1/dnscrypt-proxy/blob/master/utils...

EZ-E• 8 years ago

This app works by connecting to a VPN. From experience, user experience on these kind of apps using a VPN is pretty poor (for example, ad blockers)

I believe keeping VPN connected drains the battery because some of the device's chips cannot "sleep"

A VPN-based app also disconnects when going from Wi-FI to cellular.

Worse, when going from cellular to WiFi (ie: going back home) with a VPN on, the iPhone just keeps using the mobile network until the VPN is disconnected

These apps usually try to auto-connect to VPN but when your connection is spotty, it becomes a very annoying, you have to kill the app, disconnect the vpn manually etc

As user you're left manually putting the VPN on/off constantly if you're on the move

It's definitively not a "set and forget thing". I wish Apple could give a way for ad-blockers and this kind of apps to function normally without using a VPN as a crutch

Gaelan3• 8 years ago

It’s not a “real” VPN. I’m not sure exactly how much it does, but everything but the actual DNS queries happen on-device, with other network connections not touching CloudFlare servers.

dzek69• 8 years ago

It just acts as both server and client. The issues described still apply

nothrabannosir• 8 years ago

I’ve been using openvpn on iOS for about a year, and this 1.1.1.1 app for a day now, and I can guarantee that most of the connectivity issues described are not true. [edit: for me, of course. sorry, didn't mean to discredit parent comment like that. just wanted to add my perspective.]

- it automatically switches networks, both to and from WiFi

- it does not disconnect when switching

- the 1.1.1.1 app does not make anything more spotty or unreliable; it’s just DNS. Openvpn yes, but this app clearly not.

As for the battery issue: could very well be true, I have no idea how to test it.

The difference between this app and an actual VPN are clear from using it.

aneidon• 8 years ago

You’re right, that’s because (I think) this is an “on-demand” VPN, which basically only connects as needed, and allows for switching between Wi-Fi and cellular. It also shouldn’t drain more battery, since it’s not keeping the connection alive when the device is asleep.

philamonster• 8 years ago

I wish there was an option in OpenVPN to not use connection on SSID/network xyz. I have static IP at home and use dyndns for DNS resolution with service specific subdomains. Then, using forwarder at home I create split DNS to point to local device for public domain. It currently doesn't work as I combined domain for VPN and another service out of laziness after moving VPN to physical box.

All that said, I don't need to VPN while at home to home network and prefer a little more granularity instead wifi or cell only. I believe this could be where battery drain would come from, at least in my case as the client constantly retries at home though it will never resolve the proper host internally cause I am lazy admin.

jlgosse• 8 years ago

'the 1.1.1.1 app does not make anything more spotty or unreliable; it’s just DNS. Openvpn yes, but this app clearly not.'

Not entirely true, in my experience it really fucks with your ability to connect to public hotspots (ex. airports, airplanes, trains, coffee shops) which took me a while to realize

brians2• 8 years ago

Because it obscures the source address for DNS queries, it will mess with split-horizon DNS and other systems that give different answers in different places. You might be surprised how many that is.

donogh• 8 years ago

Having tried it, my biggest gripe is the DNS query log stored in the app. This should be optional.

zackbloom7• 8 years ago

It can be a privacy feature. It allows you to see exactly what the apps on your device are connecting to.

odedregev• 8 years ago

Can someone please help me understand something please? I understand that the main feature of 1.1.1. is privacy from the ISP, however, after the DNS resolution when my device will actually go to the destination, lets say to www.example.com domain - my ISP will know about this too, so what exactly am I hiding here?

Gaelan3• 8 years ago

Many sites these days are hosted on cloud services not owned by the company owning the site, and in these cases it can fairly hard to find the actual domain from the IP address. In other cases, however, you’re right—the ISP can still figure out where you’re going.

homero• 8 years ago

Encrypted sni will add some plausible deniability

nly• 8 years ago

IIRC, a prerequisite for the confidentiality of eSNI is in fact secure DNS.

dingaling• 8 years ago

I think this is mainly a USian mindset.

I trust my UK ISPs ( Goscomb, AA.net ) to whom I pay a monthly fee for service more than I do some US-based company who wants to provide me a critical service for 'free'. And yet which at other times prevents me reaching websites with a 'One more step...' blocker page.

kasey_junk3• 8 years ago

In conjunction with tls your ISP loses the ability to know the domain. IP then becomes the thing they can track but in many cases that will just route to big IP blocks for hosting providers.

Having netflix.com is a lot more revealing than having an AWS block.

z3t42• 8 years ago

ISP DNS servers will always be closer, eg have less latency then third party DNS servers. And after one query, the result will be stored locally, eg no DNS servers will be used for following lookups. The thing with expensive DNS solutions is they only speed up the very first lookup, which might be cached on your ISP anyway. DNS is already a distributed system, which is much larger then any single private entity. Some third party DNS services might also sacrifice resiliency for performance, they will for example not try secondary DNS if primary is down. The reason why private organizations want you to use their DNS service is because they want to know every site you visit, then sell that information.

growse• 8 years ago

This is a perfect line of reasoning, assuming:

a) your ISP can competently run a secure DNS service correctly (latency is not the whole story of 'performance')

b) it's acting entirely in your interests and not attempting to hijack your DNS service to insert ads etc.

Personally, I've had ISPs where neither of these things have been true.

kasey_junk3• 8 years ago

Cloudflare is on record saying they will not sell the information. You can trust that or not but your ISP is almost certainly selling it if it is one of the major US ISP.

Verizon owns Oath, Att owns App Nexus, Comcast has a whole suite of adtech companies & owns gigantic publishers. Time Warner literally started out in the sell side of advertising.

scarface743• 8 years ago

CloudFlare can say anything and have all the good intentions in the world. But, on Android, they are using a third party bug tracking software that they don’t have source control for (Instabug). That third party binary blob requests camera and microphone access.

z3t42• 8 years ago

I think ISP selling user data is outrageous and should be illegal. Thankfully where I live (EU) I got 20 ISP's to choose from, allowing me to vote with my wallet.

vegardx• 8 years ago

I imagine they don't want anyone to find the app with that name, given how notoriously bad AppStore search is.

blablabla123• 8 years ago

I still need to understand how that is going to be faster and more private

jedisct13• 8 years ago

For something with way more features, check out DNSCloak, probably the best DNS app for mobile devices: https://itunes.apple.com/us/app/dnscloak-dnscrypt-doh-client...

DNSCloak supports Cloudflare (among many other options), and has since day one. It will also let you choose how to steer DNS traffic, what domains to block and when, has a built-in cache to reduce latency, and more.

elithrar3• 8 years ago

Is there a trustworthy third-party review of DNSCloak?

Short of installing & packet sniffing myself, or breaking apart the package; neither of which I have time to do.

(edit: to be clear, I’d love more options, including one that allows me to use Google’s DoH DNS, but I won’t blindly instal an app that intercepts my traffic, even if ‘just’ DNS)

natch4• 8 years ago

Will they rent/lease/lend/share my data out to partners/non partners/anyone? I understand they clearly state they won’t sell the data or use it (themselves) for ad targeting, but their wording doesn’t cover rental to others.

CoryG89• 8 years ago

Maybe I'm a little naive, but to me, "renting" data sounds a lot like just selling data.

natch4• 8 years ago

Right... but it’s a known dark pattern for companies to make deceptive-but-technically-true assurances, so I’m not so sure. They do it because it works, as evidenced by what you say. I do tend to trust Cloudflare to do what they say, but they should say it with full clarity.

zackbloom7• 8 years ago

No. We (Cloudflare) barely even store the data, we get rid of it as fast as we can.

natch4• 8 years ago

OK, that's great. Just as feedback to the company, if you're able to pass it on to someone, as a potential user I would feel more confident in the service if they would clarify the wording (not just from a Hacker News account, I mean). From a user's perspective outside the company it's hard to distinguish between weasel words, and the mere appearance of weasel words.

kevinSuttle2• 8 years ago

According to a comment on ProductHunt:

“Cloudflare will never sell your data or use it to target ads. Period.".

https://www.producthunt.com/posts/the-1-1-1-1-app#comment-69...

natch4• 8 years ago

"Sell" does not cover rent, trade, share, lease, give, etc. Period.

chrisweekly• 8 years ago

Related tangent: does this (or any other similar app or service) provide a straightforward way to bind a static IP address to outbound HTTP requests? Use case: persistent IP address that can be whitelisted by a secured endpoint.

gigatexal• 8 years ago

It’s not a real VPN from what I think of a VPN in that my IP is still from my ISP (checked at whatismyip.com) just the DNS requests are encrypted. Still cool though.

cntlzw• 8 years ago

For what it's worth I think this is a beautifully designed app. The usability and user experience is great. Yes, it does just one simple thing but it does so in a smooth and elegant way.

kevinSuttle2• 8 years ago

I want to believe this is a good thing, but I can’t get that whole “we block Tor users” campaign out of my mind.

kodablah• 8 years ago

I'm quite the opposite as I appreciate the work towards supporting Tor with easy-to-setup onion fronts as alt-svc's and their work towards limiting their DDOS mitigation for Tor users. These are usually thankless efforts that don't affect their bottom line, or maybe even are a net negative depending upon the level of effort they expend.

znpy• 8 years ago

33.6 MB? to change the dns ?

Klonoar• 8 years ago

Sounds like a React Native app (and feels like one, sadly?).

I could be wrong, though, since the NetworkExtension would have to be written in Swift, so I don't see why they wouldn't just write the rest in Swift and/or ObjC... would be happy to be wrong actually.

auslander• 8 years ago

It is a bad idea for several reasons.

1. You won't be able to configure real VPN, iOS allows only one VPN profile. Get a real VPN for native IKEv2 client you have.

2. It gives CF golden mine of your browsing history. It already has your traffic to many sites in plaintext, emails and passwords included

3. You trust the third-party app without the source code, probaly with access all your traffic

Cloudflare 1.1.1.1 iOS app

Related Stories