<p>Bitcoin running with <code>onlynet=onion</code> is <strong>severely</strong> insecure, nobody should ever be running the software in this mode. There is no sybil protection, it is completely feasible to operate an unlimited number of HS peers and prevent a node from ever connecting to one which will give them a true vision of network consensus. There is no cost to performing this attack whatsoever.</p>
<blockquote>
<p>one has to either leave DNS queries enabled (which could potentially reveal a user is running Bitcoin)</p>
</blockquote>
<p>DNS queries can be proxied as well.</p>
<blockquote>
<p>Does (hypothetically) using the ODOH protocol for the initial node discovery make any sense from the privacy perspective?</p>
</blockquote>
<p>I doubt it makes any meaningful difference, especially as seeding is typically only something which happens for initial startup of a node and likely never again. You're almost never going to be able to hide that you're running a Bitcoin node from your ISP, even by using a proxy the traffic patterns are very obviously Bitcoin.</p>

CC BY-SA 4.0
2020-12-20T16:31:09.247Z
2020-12-20T16:38:46.783Z
2020-12-20T16:38:46.783Z
Claris
<p>Recently Cloudflare <a href="https://blog.cloudflare.com/oblivious-dns/" rel="nofollow noreferrer">proposed</a> an improvement to the DNS over HTTPS protocol called ODOH (Oblivious DNS over HTTPS). It allows separating a DNS server into two parts: the resolver and the proxy that receives DNS requests from an end-user, thus avoiding leaking an IP address to the resolver and an actual query to the proxy server.</p>
<p>When running the Bitcoin node with the <code>onlynet=onion</code> parameter, one has to either leave DNS queries enabled (which could potentially reveal a user is running Bitcoin), either to disable the DNS queries completely (<code>dnsseed=0</code> and <code>dns=0</code>), and then to seed some good nodes with the <code>addnode=</code> parameter.  Both options aren't perfect.</p>
<p>Does (hypothetically) using the ODOH protocol for the initial node discovery make any sense from the privacy perspective?</p>

<bitcoin-core><privacy>
Is the Cloudflare proposed ODOH protocol a thing that could improve Bitcoin node privacy?
leshik
# Is the Cloudflare proposed ODOH protocol a thing that could improve Bitcoin node privacy?

(Asked by: username_0 on 2020-12-20)

Recently Cloudflare [proposed](https://blog.cloudflare.com/oblivious-dns/) an improvement to the DNS over HTTPS protocol called ODOH (Oblivious DNS over HTTPS). It allows separating a DNS server into two parts: the resolver and the proxy that receives DNS requests from an end-user, thus avoiding leaking an IP address to the resolver and an actual query to the proxy server.

When running the Bitcoin node with the `onlynet=onion` parameter, one has to either leave DNS queries enabled (which could potentially reveal a user is running Bitcoin), either to disable the DNS queries completely (`dnsseed=0` and `dns=0`), and then to seed some good nodes with the `addnode=` parameter. Both options aren't perfect.

Does (hypothetically) using the ODOH protocol for the initial node discovery make any sense from the privacy perspective?

**Tags:** bitcoin-core, privacy


---

## 1 answers

### Answer by username_1 on 2020-12-20. Score: 1

Bitcoin running with `onlynet=onion` is **severely** insecure, nobody should ever be running the software in this mode. There is no sybil protection, it is completely feasible to operate an unlimited number of HS peers and prevent a node from ever connecting to one which will give them a true vision of network consensus. There is no cost to performing this attack whatsoever.

> one has to either leave DNS queries enabled (which could potentially reveal a user is running Bitcoin)

DNS queries can be proxied as well.

> Does (hypothetically) using the ODOH protocol for the initial node discovery make any sense from the privacy perspective?

I doubt it makes any meaningful difference, especially as seeding is typically only something which happens for initial startup of a node and likely never again. You're almost never going to be able to hide that you're running a Bitcoin node from your ISP, even by using a proxy the traffic patterns are very obviously Bitcoin.


---

