Re: [Add] [EXTERNAL] Re: Browser Administrative Authority

[Melinda Shore <[e-mail]>]

On 5/25/19 6:48 AM, Deen, Glenn (NBCUniversal) wrote:
> I don’t see this as equivalent to the trust mediation that browser
> makers do through their certificate root programs or security
> settings because those things are very much web application domain
> choices and are entirely appropriate to be controlled in the context
> of the web browser.   Those trust certificates are for web servers
> and applications, and so are in exactly the right place.

Yeah, but you can make the same case for name resolution.
It's certainly the case that some applications that run in
browsers have narrower security requirements around DNS
than others do, and right now there's no way for those
applications to discover whether or not their DNS queries
are protected.

But, I think the broader problem is that ISPs are not running
recursives that use encrypted transport, and because they're not
other folks are stepping up/in.  I suppose that in a better
world an endpoint would be able to check whether or not they
can protect DNS traffic to the default recursive and, if not,
fall back to one of {Google, Cloudflare, whomever} but that's
not where we are right now.

> In the case of browsers, there is an established means for the root
> list to be maintained securely, and to be update when needed.  That’s
> fundamental to the trust model working. If it were possible for this
> root list to be altered outside of that means and it’s associated
> integrity controls, then the trust model would be broken because it
> would be possible for unapproved roots to be installed.

It hasn't always been the case that browser root programs had
strict entry requirements, or that CAs were audited, or that
there were external mechanisms for misissuance detection.  Those
were added as problems were identified.  And, I'll note, that
the browsers are occasionally acting unilaterally around PKI
issues, as well - this situation with encrypted DNS is neither
unique nor isolated.

I do think part of the problem here is that for whatever reason
our community (the IETF) hasn't come to consensus on problems
related to trust in the DNS.  If you don't have a trustworthy
name resolution system you can't trust much else, either.  This
relates to both being able to get a correct answer that hasn't
been mucked with by a third party, and to privacy protection
of queries and responses.  It seems unsurprising to me that
browsers (and other application vendors) would respond to the
default unprotected DNS situation by doing something about it
themselves.

Melinda

-- 
Melinda Shore
[e-mail]

Software longa, hardware brevis