Will 1.1.1.1 hide my traffic from my landlord's router?

Question

I've read different articles about https://1.1.1.1/ and am confused since they conflict. A couple examples:

effectively making your traffic invisible to snoopers on your local network but not providing an anonymised connection to the sites you're accessing at the other end - https://www.wired.co.uk/article/cloudflare-1111-with-warp

Even though Cloudflare hides the questions you’re asking from the ISPs it can’t hide the answers. So this is not a meaningful privacy enhancement. - https://hightechforum.org/cloudflares-1-1-1-1-dns-does-nothing-for-privacy/

I will soon be living in a shared apartment where I don't control the wifi router. I don't trust the owner and don't want him to be able to see the content of my traffic or the URLs.

If the sites I visit use HTTPS (which seems to be the case for every site nowadays anyway), he'd never see the content, right? But he'd still normally be able to see the URLs visited.

I know that the standard recommendations (e.g. this answer) are to use a VPN and/or Tor.

But my internet connection will already be slow, and I'd love not to slow it down further by using those.

Will 1.1.1.1 hide my browsing history from the owner of my LAN router?

Answer 1

The sources you cite in your question suggest that you are confusing two different services offered by Cloudflare in the context of 1.1.1.1:

• there is the traditional offer, which consists only of a DNS server available directly or with DNS over HTTP (DoH) or DNS over TLS (DoT).
• and there is Cloudflare Warp, which is practically a VPN

With Cloudflare Warp all traffic is protected against sniffing by the landlord since all traffic between your system and Cloudflare is encrypted. See this answer for details.

With Cloudflare DNS instead there is much less protection. While the landlord can no longer get the contents of the DNS if encrypted DNS is used (i.e. DoT or DoH), the landlord can still extract sensitive information from other traffic. For example plain HTTP traffic is not protected at all. But even with HTTPS the target hostname can be extracted from the traffic in most cases. And the landlord can also see the IP addresses you connect to and deduce from this what sites you visit. The landlord might also do selective blocking of sites or services based on this visibility. With Cloudflare Warp instead none of this is visible to the landlord and no selective blocking is possible.

Answer 2

If you use 1.1.1.1 with DNS over TLS or DNS over HTTPS, and you use it properly by preventing normal plaintext DNS traffic with a firewall, then it will hide DNS queries from your landlord.

What does this mean? Your landlord will still see the IP of the server your browser is talking to. He will not be able to see the URL. However, and this is a big however, he may be able to deduce what host the IP is by reverse DNS.

So, will 1.1.1.1 prevent your landlord from being able to deduce what sites you are visiting? Generally speaking, no.

Will 1.1.1.1 be able to prevent your landlord from being able to see the content of your web traffic? That is unrelated -- HTTPS prevents this, assuming you don't ignore any certificate errors.