Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

[Michael Sinatra <[e-mail]>]

On 7/16/19 11:04 AM, Alec Muffett wrote:

> Yet: Firefox is literally the foundation of TorBrowser, but somehow when 
> Firefox is resolving DNS addresses via DoH, it suddenly becomes a 
> problem where we are talking about the "necessity" of things which 
> otherwise we dismiss as pervasive monitoring: canary domain names, 
> privacy-busting beacons, and third party enforcement over someone else's 
> ability to connect to their intended destination.

In the case of most enterprise policy enforcement, it's not a third 
party that's imposing the restrictions, it's the enterprise itself.  The 
enterprise *may* decide to outsource this activity, and it may also be 
"guided" by a regulatory framework.  However, I wouldn't necessarily 
call that "third party enforcement."

As another example, in my home network, I impose DNS filtering 
restrictions, in conjunction with endpoint management, to restrict the 
set of destinations that *my software* can contact.  I have configured 
Firefox (for example) to explicitly not use DoH or its TRR list, so that 
*I* can better control what Firefox does on my network when I am using 
it.  As someone who operates my own resolver on my home network, with 
QNAME minimization enabled, I am a big supporter of ADoT.  DoH 
(depending on how it is deployed), however, has the potential to 
complicate my ability to control what my applications do.  This is 
especially the case if applications try to obfuscate or prevent me from 
disabling their own resolution methods to use mine.  Part of my goal in 
this discussion is therefore to ensure that the applications that *I* 
use play properly with *my* controls.

Finally, since you brought up pervasive monitoring, consider a scenario 
where I run my own resolver and ADoT is pervasively deployed.  Would 
Firefox sending all of me DNS queries to Cloudflare (a third party, no?) 
afford me more privacy than what I currently have?

michael