Re: [Add] fixing coffee shop brokenness with DoH

[Ted Lemon <[e-mail]>]

On Jul 24, 2019, at 9:05 AM, Vittorio Bertola <vittorio.bertola=[e-mail]> wrote:
> What you seem to want above, however, is not made possible by centralization, but by user choice, i.e. the user being able to tell all the applications to use a specific resolver that has a privacy policy they like.

I asked this question earlier and nobody answered, so I’ll ask it again.  How do we ensure that the user has a choice and that the choice is honored?   Or to put it differently, suppose a malicious app wants to funnel all user DNS requests to a tracker.   How can we detect that this is happening?   How can we prevent it?

I think there’s a tendency to not talk about this problem because I think it’s an extremely hard problem.   It pretty much boils down to this: who can the user trust?  Can the user even meaningfully evaluate their determination of trust?   At present, the trust model is “if I download the browser from Mozilla, I can trust it,” or some variation on that model.  This maybe works for something like Firefox, but, if pretty much any app is doing DoH, can we even tell that this is happening?

I can think of ways of making it hard for the app to misbehave in this way, but no way to completely prevent it.

This is important for two reasons.   First, we should not pretend that we can prevent what we can’t prevent.   Secondly, we should actually come up with a mitigation strategy.