Re: [Add] When Two Worlds Collide

[Ted Lemon <[e-mail]>]

On Aug 16, 2019, at 12:19 PM, Bret Jordan <[e-mail]> wrote:
>  It is your opinion that a QuadX DoH resolver is less dangerous than the DNS (DoH or Do53) that is provided by your internal network. 

I’m sorry, maybe I haven’t been very skillful in responding to you on this.   I think I see where the disconnect is now.   I don’t actually think this.   Let’s enumerate the players here:

Do53 resolver on the local network
DoT resolver on the local network
DoH resolver on the local network
DoH resolver on QuadX, as you put it
DoH resolver on my home network, reachable from outside
DoH resolver on my ISP’s network, reachable from outside

And:
Locked down host, can’t access any resolver other than that configured by the operator
BYO host, not controlled by the operator

If we have host (1), is it better off communicating with resolvers (1), (2), or (3)?   That is, what should the local operator configure?

The answer is that it depends on the network.   If the network is locked down as you say, and the device can’t leave the facility, then it’s probably just a matter of whether the operator cares that the queries are going over the wire in the clear.  If, on the other hand, the network can’t be locked down quite that tightly, then it may be worthwhile to have PKI authentication.   If I were setting this up, I’d install a cert on all site-owned devices, and use that to validate that I’m really talking to the DoT or DoH resolver I intend.   Now, whether to use DoT or Doh is just down to whether I’m concerned about blocking.   If I’m concerned about blocking, DoH is better; if I’m not, I think it’s about even.

Now, what if we have device (2) on a locked-down network?   The operator has two choices.   Either allow the device to do DoH, or block all outgoing connections that aren’t explicitly permitted, including connections to port 443.   If such hosts want to connect out, they have to go through a proxy that can look at the HTTP traffic.

Now, consider the case of your own device.  If you are carrying it around, there will be places where your traffic can be snooped.   But it’s not going to be easy to aggregate it (probably, depends on the operators of the networks amongst which you wander, and the configuration of your handset).  If you connect to resolver (4), then your queries can be aggregated and perhaps correlated with your web traffic.   I agree that that’s bad, and something to try to avoid.

I also agree that a resolver on your home network that you connect to from off-site may be better than (4), even though it allows your ISP to track your DNS traffic.

But what I was talking about was not this sort of modeling.   What I was talking about are simply the security properties of the various players.   Any DoH or DoT resolver can be authenticated, because you are connecting to it over TLS.   No Do53 resolver can be authenticated.   If you are able to authenticate the network, meaning that you are using 802.1X and evaluating the cert in a secure way (which is not trivial to configure), and you know that it is operated in such a way that a rogue Do53 resolver would not be reachable by your device, then when you are on that network, that resolver is equivalently safe whether you are talking to it with Do53, DoT or DoH.   When you are on some other network, it is only safe it you talk to it using DoH or DoT.

Another security property: DoH can be used on any network where HTTPS traffic is allowed to exit without being examined.   Sure, you can maintain a blocklist, but this is going to be a losing battle: the people who are motivated to make DoH work will figure out ways to make it work around your block list.

Another security property: DoT can be blocked, because it doesn’t look just like HTTPS traffic.

These security properties are facts.   Which resolver is safer to use is an opinion.   I have a great deal of sympathy for your opinion about QuadX resolvers, and had no intention of arguing with you about that opinion.   Where the disconnect came in is that it appeared that you were contradicting facts in the process of arguing your opinion.