Re: [Add] draft-grover-add-policy-detection-00

[Vittorio Bertola <[e-mail]>]

Il 15 luglio 2019 02:30 Eric Rescorla <[e-mail]> ha scritto:

The question of whether it's a good idea is rather more complicated: at a high level we have a situation where nearly all DNS is unencrypted and sent to a resolver which is insecurely configured. Some of those resolvers do policy enforcement and in some of those cases, the user wanted that kind of policy enforcement, so just switching over to a secure Trusted Recursive Resolver potentially violates POLA, and it would be nice to be able to detect those cases and do something [0].

Also, often that policy enforcement is actually being done on behalf of the user to increase his/her security, so even if we only wanted to focus on maximizing security, the choice would be between connecting securely to a (from the user's point of view) less secure resolver, and connecting insecurely to a more secure resolver; which option of the two is in the end more secure depends on the specific case (threat scenarios and their likelihood), so I think each application will make its own choice, often asking the user. Of course the proper solution is to have a way for the users to connect securely to the more secure resolver, but in the meantime both options should be made available.

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[e-mail] 
Office @ Via Treviso 12, 10144 Torino, Italy