Re: [Add] [EXT] Re: meeting hum: should the IETF take up this work?

[Eric Orth <[e-mail]>]

On Thu, Aug 1, 2019 at 1:59 PM Jacques Latour <[e-mail]>
wrote:

> From the department of this-could-be-a-bad-idea and the department of
> omg-this-goes-against-everything-we’re-trying-do, but here it goes: a DoH
> operator should have a policy to blacklist IP address as requested by the
> network operator, since we can’t effectively block DoH at the edge of the
> enterprise network, an enterprise network should have the ability to
> request the well behaved DoH recursive operators to block requests coming
> from their network IP address.  Perhaps have some sort of trusted clearing
> house of IP addresses that the well behaved DoH recursive operators should
> blacklist from. Enterprises can block non well behaving DoH recursive
> operators.
>
>
>
> Since the major problems of DoH is for all to understand the
> multidimensional matrix of deployment models vs. value proposition vs. user
> (vantage) point of view, it’s almost impossible to assess the value
> proposition of the above example against all the currently
> possible/available scenarios. But we know that DoH has a negative value
> proposition for Enterprises.
>
>
>
> How do we turn DoH to have a positive value proposition for Enterprise?
>
>
>
> Can DoH have positive value proposition for all scenarios?
>
>
>
> What are the gaps and how do we address them methodically?
>
>
>
> Jack
>
>
>

I can't speak for any DoH server operators, but I would imagine most would
not be willing to trust a please-block-these-IPs/names signal unless the
agent sending the signal could prove it has authority over the user/device
making the request.  Could be very damaging for an enterprise's operations
if an unauthorized attacker can disrupt their access to websites the
enterprise wants to be able to access.  Maybe there's a way I'm missing,
but I'm having trouble thinking of any way for the blocking agent to prove
that authority without having control of the requesting user/device.  And
if any enterprise has that control, they should be able to just block
IPs/names from the device or control from there what DNS server is used.