Re: [Add] [EXTERNAL] Re: Malware adopting DoH

["Dixon, Hugh" <[e-mail]>]

On 16/09/2019, 07:22, "Add on behalf of Rob Sayre" <[e-mail]<mailto:[e-mail]> on behalf of [e-mail]<mailto:[e-mail]>> wrote:

Google and other browser makers do perform malware blocking, in a sense. They just generally don't use DNS to do it. See: https://safebrowsing.google.com<https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsafebrowsing.google.com&data=02%7C01%7Chugh.dixon%40sky.uk%7C99ec23d0e81449d1610708d73a6e419b%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C1%7C637042117539399573&sdata=6ZfpzQ5hEBt9qw2Har2rt5apVdDqj4iYM864yUys%2B7w%3D&reserved=0>

Safebrowsing is what I’ve taken to refer to as “Type 1” Malware mitigation – infection-prevention within that specific application (the browser) and I haven’t seen any data on whether it or DNS-based infection-prevention-filtering is more effective, except of course to say that combining the two is likely to be even better than either alone.  But I suspect browser-based is “pretty good”.

Type 2 Malware mitigation is what we’re talking about in this thread – post-infection malware operation-prevention largely independent of any other specific application.

Is the “All filtering is bad, mmkay” ethos really so strong that the idea of interdicting criminal operations is not an option?

H


It seems to me that DoH provides the typical benefits of encryption over the wire. On the "informed consent" argument: there are many divergent opinions. Some people on this list seem to think DNS is special in some way, but I don't think there is an IETF document that states anything like that. As we have seen, there are many libraries, applications, and products that connect to DNS servers without informing the user.

thanks,
Rob

On Sun, Sep 15, 2019 at 7:44 AM Robert Mortimer <robm=[e-mail]<mailto:[e-mail]>> wrote:
No that's an argument for making an informed decision about what DNS service provider you use and possibly for being able to avoid limitations being imposed by the network you happen to be using at the time.

Using a VPN to access your DNS provider would achieve the same thing, as would using DoT or in many cases simply not using DHCP to decide your DNS provider.

If my an application is deciding which DNS service to use without my informed consent then even if it's using DoH it achieves none of the things you list.

Your list merely describes informed choice of DNS provider not any benefit uniquely inherent to DoH
Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD