Re: [Add] meeting hum: should the IETF take up this work?

[Eric Rescorla <[e-mail]>]

On Sat, Jul 27, 2019 at 7:52 AM Michael Richardson <[e-mail]>
wrote:

>
>     mcr> Does Mozilla have a policy/proceedure to vet the privacy policy of
>     mcr> DoT/DoH providers?  Maybe Mozilla is considering this?
>
>     ekr> Yes: https://wiki.mozilla.org/Security/DOH-resolver-policy
>
>
>     mcr> Would it be appropriate for this to go into
>     mcr> a certificate extension (perhaps signed by a Mozilla CA)?
>
>     > I'm not sure what this would buy us over just having a list.
>
> I guess it buys Mozilla nothing.
> But others could rely on the list in a distributed fashion.
>

Well, we already have a worked example of a similar system, which is Root
Programs, and in that case we've found that having a list of trust anchors
that someone could download was adequate. Unless this list were to get very
large, this seems far simpler than creating a certificate extension.


If the extension said what the privacy was, rather than just that Mozilla
> had
> vetted it, then perhaps there could be other levels of privacy.
>

It's not quite clear to me what you have in mind here, but one thing I
would like to emphasize is that the Mozilla TRR program is more than just a
self-assertion about privacy policy, in that we actively manage the list,
rather than just trusting people's self-assertions. If people were
interested in some other set of privacy policies, then it's not clear to me
who would be responsible for running such a program.

-Ekr