Re: [Add] Mozilla's DoH resolver policy

[Wes Hardaker <[e-mail]>]

Christian Huitema <[e-mail]> writes:

> > Which clearly shows that between the above three, they're willing to
> > sacrifice some level of authenticity to achieve better latency and
> > privacy.  Note, though, that this choice isn't wrong.  It's a choice.  I
> > may choose a different one, as may others.  And I'm more than sure my
> > list above is incomplete from an ideological stand point; it just
> > happens to be the three biggest I could think of.
> 
> On the other hand, DNSSEC does not guarantee authenticity either. It
> guarantees that the mappings of name to IP address is authentic, but
> that's not the same thing as guaranteeing that the connection actually
> terminates at the authentic end point. There could well be a NAT
> somewhere that translates the IP address and delivers the packets to a
> different server. See for example the many cases of rerouting 8.8.8.8
> traffic to a different server.

Yes, you're absolutely right.  There are a ton of layers of the protocol
stack that get involved, and attacks at any point along the way can
break the connection so it becomes unusable.  Without DNS security, may
never get to the right place.  Without routing security, you may never
get to the right place.  Without TLS security, you may never get to the
right place.  If you don't type things properly, you may get to the
wrong place.  Protecting all layers increases your odds that you're
getting to the right place.  If you only check the highest layer (and
you trust it implicitly) you still may be misdirected at other layers,
causing client failures that may have been avoidable.

> Arguably, once you have HTTPS and authenticate the server, then DNSSEC
> does not provide any additional guarantee.

That is one view, yes.  As I said in my previous note about other
choices: it's not wrong!  You're prioritizing your needs and tradeoffs,
however, and others may have different prioritization.  Its in this
selection of trade-offs that we seem unable to help users make informed,
personal decisions.

-- 
Wes Hardaker
USC/ISI