Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

[Ted Hardie <[e-mail]>]

Hi Vittorio,

On Wed, Jul 17, 2019 at 1:06 AM Vittorio Bertola <vittorio.bertola=
[e-mail]> wrote:

>
> Il 17 luglio 2019 07:01 Rob Sayre <[e-mail]> ha scritto:
>
>
> On Tue, Jul 16, 2019 at 12:30 PM Jim Reid < [e-mail]> wrote:
>
>
> Whether or not these tools/services work well is another issue entirely.
> And IMO not something to discuss at the IETF.
>
>
> Hi Jim,
>
> I thought about this email a lot today.
>
> I think the problem with its sentiment is that whether or not
> tools/services work on the Internet might be fairly called "engineering",
> and this is the Internet Engineering Task Force, right?
>
> But if you have tools that work well enough that millions of people rely
> on them and that they are encouraged or even mandated in many countries,
> and you decide to develop and implement technologies to prevent them from
> working
>

The IETF builds building blocks that meet specific needs.  In building DNS
over TLS, DNS over DTLS, and DNS over HTTPS, it was adding the protocol
functionality to make DNS queries confidential from inspection by network
observers.  The energy for that work was the reaction to pervasive
surveillance, but it is clear that other attackers had been gathering data
for some time.  The IETF was not building these protocols to stop the use
of the DNS as a policy enforcement mechanism and it is entirely possible to
integrate them into a system which does this by offering the policy
enforcing resolver over one of these confidential protocols.

But, and this is the crux of the matter, that integration requires the
cooperation of the endpoint or its control by an organization's system
administrators.  If you do not have their cooperation or the right to
manage them by tools like those Eric mentions, it is difficult for the
endpoint to distinguish a network-level interception by a mandated policy
engine and by an attacker.

Rather than falling back to the state where the endpoint simple accepts
that its traffic is visible to all and possibly intercepted, this new work
is an effort to make it easier for you to gain the cooperation required.  I
hope you can see that this is in both the interest of policy enforcement
bodies and the end users.

best regards,

Ted