Re: [Add] [EXTERNAL] Re: Browser Administrative Authority

["Deen, Glenn (NBCUniversal)" <[e-mail]>]

Hi Paul,

> On May 26, 2019, at 8:44 PM, Paul Wouters <[e-mail]> wrote:
> 
> As a user I cannot determine that if I once google for "canadian contact
> lenses", who and why and where that info went. All I know is that 60%
> of ads are suddently about contact lenses across my house, devices and
> applications. And the only way out is to encrypt everything end to end,
> with no midle man or ISP seeing anything.

This may not be a good example for use in the current discussion as it’s really a web search and web page tracking example and not DNS as everything in this example can be accounted for entirely by what’s going on inside your browser, the search engine, and visited web pages.

It’s well documented that the search engine and linked visited web pages are all instrumented and mined to track your web visits and correlate them so that the Ad provider, which is owned and run by search engine, can sell Ads targeted to you.  The cited example is just the web search and advertising technology and business model at work.  

The hard work needed to turn DNS queries into such actionable target Ads isn’t worth doing when the search engine already knows the exact search terms you are looking for and all the subsequent web pages you visit afterward.   

The fact that they appear on many devices across your house would suggest that the tracking device infrastructure is also correlating your home activity around the shared NAT address your home uses, and it is then targeting ads to any browser activity that comes from that IP address.  All of this will still work the same way even when application and DNS traffic if encrypted end to end.

Encryption of DNS or general encryption of all network traffic won’t help in the case of tracking web activity by Ad networks since the search engine and every web page will still in the see, track, and report everything you do at the web application level.  The tracking and advertising technology and business model that finances much of the web won’t be affected in any way by on the wire encryption.

The discussion at hand isn’t about the web Ads business model, it’s about how  the deployment architectures of technologies like DoT and DoH might be best done,  what bad consequences may come from poor deployment choices, and what gaps are still missing in the technologies so as to permit them to be deployed without also breaking a lot of other important Internet, application, and web infrastructure at the same time.

-Glenn