Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

[Eric Rescorla <[e-mail]>]

On Tue, Jul 16, 2019 at 12:37 PM Rob Sayre <[e-mail]> wrote:

>
>
> On Tue, Jul 16, 2019 at 12:28 PM Eric Rescorla <[e-mail]> wrote:
>
>>
>>
>>
>> Aside from that seemingly obvious conflict, it doesn't seem like
>>> DNS-based solutions would really work very well for these benevolent
>>> applications. It's sort of like using a coffee cup as an umbrella--it will
>>> catch some rain, yes.
>>>
>>
>> I'm not sure how relevant this is, but you seem to be assuming that
>> people are actively trying to evade these controls.
>>
>
> Well, they are, but your point about voluntary participation is different.
>

Some people are, some are not. In case it's not clear, my interest here is
in providing DoH/TRR for people who have not explicitly decided they want
some sort of non-transparent DNS service while avoiding changing the
experience of people who have decided they do want some sort of
non-transparent/filtered DNS service. What we are trying to do is figure
out who is who.



> Obviously that's true in some cases, but if I point my DNS to Quad9, it's
>> because I *want* them to do malware and phishing detection [0], and so I
>> have no interest in evading that. I'm not aware of any inherent reason to
>> believe that would be ineffective.
>>
>
> Yeah, I think the question is whether a user would /also/ want that task
> to be unencrypted. That doesn't make much sense to me.
>

Ah, I think we are now converging on the relevant point.

Taking a TRR-style system out of the equation for a moment. Suppose that
what I want is for all devices on my network to use a filtering resolver. I
don't expect any evasion because they're all my devices, it's just a matter
of convenience to centrally configure it. So what I do here is I configure
my DHCP server to provide the IP address of that resolver. Now, those
devices do unencrypted DNS because that's what everyone does. Now, suppose
that resolver starts offering DoT. How do my devices learn that
information? The resolver could tell them over DNS but then we have a
straightforward downgrade attack from anyone on the network. Do you agree
with this so far? Do you have a proposed solution?

-Ekr




>
> thanks,
> Rob
>