Re: [Add] Browser Administrative Authority

["Cook, Neil" <[e-mail]>]

Glenn’s point is not just about enterprises. It applies to consumer use cases as well.

Neil

Sent from my iPhone

> On 24 May 2019, at 16:58, Adam Roach <[e-mail]> wrote:
> 
> This is called “enterprise policy”, and — as far as I know — all major browsers honor it. 
> 
> See, e.g., https://support.mozilla.org/en-US/products/firefox-enterprise/policies-customization-enterprise/policies-overview-enterprise
> 
> /a
> 
>> On May 24, 2019, at 09:48, Deen, Glenn (NBCUniversal) <[e-mail]> wrote:
>> 
>> HI everyone,
>>  
>> I’ve been thinking though some of the issues with the proposal DoH deployment in browsers.
>>  
>> A big part of the tug of war here is  the authority precedence for advanced security and network settings that should be followed.    
>>  
>> Historically, it’s been at the device level – which meant the device administrator, which could choose delegate choices to a specific DNS resolver operator, or to the Network DHCP provided settings.     
>>  
>> Now the browser is seeking to adding itself into the authority chain for those settings. The trouble being that this is a major change to the administrative trust model.
>>  
>> To date, browser settings have been limited to rendering options, some basic certificate options, addons, and scripting language choices.    Advance security and trust has remained with the device administrator.     Adding the browser to the administrative chain so that it can control advanced security and network settings introduces a problem because the browser does not have an administrative level authority that is as high as the device administrator.
>>  
>> Current hierarchy (top has more authority)
>>  
>>               Device Administrator       -- device authority for security, network, trust settings
>>               Network Administrator     -- provides recommend network settings to devices
>>               Resolver Administrator    -- can provide filtering
>>               Browser  Maker               -- provides core trusted certificate list
>>               Browser User                  -- can set rendering options, can make limited certificate choices, plugins.  – Impact is limited to the browser sandbox
>>  
>>  
>> The problem is that some of the browser makers proposals are now changing this administrative authority hierarchy, but they haven’t done the extra work of establishing administrative trust and working through the consequences of that such as a child being able to change the browser DNS settings and bypass both resolver, Network, and even OS based restrictions.
>>  
>> So they are changing it to:
>>  
>>               Browser Maker                -- provides default DNS resolver and DNS Protocol choices.
>>               Browser User                  -- can set DNS resolver and DNS protocol
>>               Device Administrator       -- device authority for security, network, trust settings
>>               Network Administrator     -- provides recommend network settings to devices
>>               Resolver Administrator    -- can provide filtering
>>  
>>  
>>  
>> The path to fixing this maybe to see if there is a way to express the administrative hierarchy that respects the intentions of the device administrator on what hierarchy they want to accept/delegate decisions to.
>>  
>> It maybe that what’s needed is a means to communicate to the browser what authority the device administrator wants it to follow, since in the end the device owner should be in charge.
>>  
>>  
>> -glenn
>>  
>> -- 
>> Add mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/add
> -- 
> Add mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/add