Subject: Re: [Add] meeting hum: should the IETF take up this work?
From: Adam Roach <[email-masked]>
To: Andrew Campling <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Thu, 25 Jul 2019 11:32:26 -0400
List-Id: Applications Doing DNS <add.ietf.org>

See my response to Vittorio, which I think addresses your points.

/a

On 7/25/19 11:19, Andrew Campling wrote:
> *Adam*
> You rightly mention the protections offered by the Cloudflare privacy 
> policy and Mozilla's contract with Cloudflare.  The topical reference 
> to Facebook should serve as a timely reminder about the growing 
> importance of privacy as well as a useful illustration that 
> well-intentioned privacy policies can often be by-passed or undermined.
> Given your comment to Neil, I think that it would be incredibly 
> helpful to have your thoughts on the following points:
>
>   * Will all resolvers accessible within Mozilla's TRR policy have a
>     contractual relationship with the company to provide this
>     additional layer of protection?
>   * In Europe, DNS constitutes personal data and therefore needs to be
>     processed in compliance with GDPR - I didn't notice a direct
>     reference to this in the privacy policies, apologies if I've
>     missed it;
>   * For non-US citizens "reasonably believed to be outside the US",
>     FISA Section 702 of course overrides the stated privacy policies
>     of both Mozilla and Cloudflare (this is _not_ a criticism, simply
>     a clarification), has global reach when combined with the Cloud Act.
>
> I think we should all bear in mind that DoH does of course have the 
> potential to provide a contiguous, device level fingerprint to the DoH 
> resolver, is a backward step for privacy in that regard vs both DoT 
> and DNS53.  In my view this does helpfully illustrate that encryption 
> and privacy are not synonymous – no doubt others will have their own 
> views.
> *Andrew *
> -----Original Message-----
> From: Adam Roach <[email-masked]>
> Sent: 25 July 2019 15:12
> To: Neil Cook <neil.cook=[email-masked]>; Stephane 
> Bortzmeyer <[email-masked]>
> Cc: Jim Reid <[email-masked]>; [email-masked]; Rob Sayre <[email-masked]>
> Subject: Re: [Add] meeting hum: should the IETF take up this work?
> On 7/25/19 03:57, Neil Cook wrote:
> > But let’s say I decide to run my own non-public DoH  resolver on my
> > network at home. Firefox won’t have it on their list of TRRs, and if
> > as you suggest, the discovery drafts are pointless and so don’t
> > proceed, no application will ever find out about it, unless I
> > configure it manually on every single application and computer in my
> > house (not even mentioning those IoT devices that I can’t configure).
> >
> > It is also possible that we end up with a large number of public DoH
> > resolvers which mine your personal data for profit. Given the current
> > business model of the internet that is entirely possible.
> Since you mention Firefox's TRR list and then mention data mining 
> (with an implied connection), I'd like to point out yet again that one 
> of the key criteria for appearing on that list is an agreement to 
> treat resolution data according to a strict set of privacy-protecting 
> provisions. You can see, for example, Cloudflare's associated privacy 
> policy at 
> https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/
> I'm going to pre-reply to a frequent response that the lack of direct 
> contractual relationship between users and Cloudflare is problematic.
> Even if you don't trust Mozilla's contractual agreement with 
> Cloudflare to provide protection here, I would think that FTC v. 
> Facebook (2019) [1] should serve as a pretty vivid illustration of 
> what happens when a US company operates outside its published privacy 
> policy.
> /a
> ____
> [1]
> https://www.ftc.gov/news-events/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions
>