Re: [Add] When Two Worlds Collide

[Eric Rescorla <[e-mail]>]

On Sat, Aug 17, 2019 at 2:08 AM Joe Abley <[e-mail]> wrote:

> On Aug 16, 2019, at 18:43, Eric Rescorla <[e-mail]> wrote:
>
>
> On Sat, Aug 17, 2019 at 12:08 AM Joe Abley <[e-mail]> wrote:
>
>> On 16 Aug 2019, at 17:50, Eric Rescorla <[e-mail]> wrote:
>>
>> > My point is that either (1) you can do MITM, in which case you can
>> disable DoH or (2) you cannot disable DoH, in which case you won't be able
>> to MITM anyway. But in neither case should you need to MITM DoH.
>>
>> I'm confused. This is not unusual.
>>
>> A user walks into the office with their personal, unmanaged phone. They
>> join the wifi. Some things work, but many things do not. User not
>> technical. What happen. Call IT.
>>
>> User's problems relate to the fact that all HTTPS is effectively blocked
>> because much software on their device reacts badly to the certificates
>> being presented by the corporate firewall, which is MITMing all the HTTPS
>> traffic it can identify through destination port number or deep packet
>> inspection.
>>
>> IT person says here, scan this QR code on the poster and follow the
>> instructions. Some eye-rolling accompanies the need to point finger at
>> large, obvious poster; some inference that most people don't need finger to
>> notice poster. User does that, all now work.
>>
>
> Why can't those instructions describe how to turn off DoH?
>
>
> That seems like a degenerate case of modifying the traffic carried within
> HTTPS, which is what I was trying to describe. So I don't really understand
> the question.
>
> Perhaps what is missing is the need to MITM HTTPS for reasons other than
> DoH in a network that accepts unmanaged devices, which I mentioned earlier.
>

I also do not understand your question. This is not about managed versus
unmanaged.

Suppose that you have a policy that requires some level of HTTPS MITM. In
order to execute that policy, you need to modify user's computers (either
via a management interface or otherwise) or convince the user to modify
their computers. At that time, you can also disable DoH or convince users
to disable DoH (assuming, as Stephen says, that DoH can be disabled).
Therefore, there should not be a need to MITM DoH traffic, because you can
just divert it to Do53.

-Ekr


>
> Joe
>