Re: [Add] [EXTERNAL] Re: WG Adoption Call draft-schwartz-add-ddr-forwarders

[Vittorio Bertola <[e-mail]>]

> Il 15/04/2022 19:51 Tommy Jensen <jensen.thomas=[e-mail]> ha scritto:
> 
> We do not intend to implement this. We believe that simply using the network’s resolver without encryption would be better than the unverifiable upgrade alternative. However, I respect that others disagree and that it is within our charter to provide a solution for those who do want to take that trade-off.
I can't speak for either of the two groups so perhaps I am wrong, but I think that this should be the subject of a frank discussion between browser makers and ISPs. It may be that some ISPs want "unverified DDR" because they think the opposite of the above, i.e. that DoH via unverified DDR is more secure for their customers than unencrypted DNS on the local network, but it may be that they want it because they think that browsers, at a certain point in the future, will discourage (e.g. via warnings) or even prevent the user from ever using unencrypted DNS, and so they need some form of automated discovery to make sure that browsers will still use DoH to their resolver for their customers that presently fall into the very common "forwarding CPE with private IP" case.



In other words, a commitment by browsers that they will still make use of unencrypted DNS in the long term in the "forwarding CPE with private IP" case, and that they will not try to push users to move to encrypted DNS servers run by other parties, could perhaps make the above draft redundant. But I do want to stress the "could", because I can also see a number of reasons why ISPs may want to upgrade their customers to DoH automatically in that case as well, even if this implies accepting some risk. Even just keeping up with the general "encrypted is better" marketing push in front of their customers would be a valid one.




--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[e-mail] <mailto:[e-mail]>
Office @ Via Treviso 12, 10144 Torino, Italy