Re: [Add] Foundational questions on draft-box-add-requirements

[Eric Orth <[e-mail]>]

On Tue, Sep 8, 2020 at 2:04 PM Eric Rescorla <[e-mail]> wrote:

>
>
> On Tue, Sep 8, 2020 at 11:00 AM Eric Orth <ericorth=
> [e-mail]> wrote:
>
>>
>> On Tue, Sep 8, 2020 at 1:22 PM Paul Hoffman <[e-mail]>
>> wrote:
>>
>>> 2) Why must the associated resolver be operated by the same entity? If
>>> an ISP offers only unencrypted resolvers, but is happy to point its
>>> customers to resolvers operated by someone else (such as a public resolver)
>>> for when they want encryption, why should this document prohibit that?
>>>
>>
>> I think many clients are mostly interested in a "same-provider" upgrade,
>> but I think you make a good point that maybe the draft shouldn't be
>> mandating anything around that.  It's encroaching into policy.
>>
>> Maybe we just need a flag to specify whether or not a listed resolver is
>> run by the same entity and let clients make decisions about it.  Would that
>> be useful without a mechanism to enforce truthfulness of the flag? Maybe
>> fine since you're already placing plenty of trust in the initial resolver.
>>
>
> I would say technically you're placing trust in the mechanism that told
> you about that resolver. Consider the case where I have configured my
> resolver (via resolv.conf or whatever) to be 1.1.1.1. With a mechanism such
> as the one that MSFT (and I believe Chrome) uses, I would automatically be
> upgraded to Do[HT] regardless of the configuration of my local network.
>

Correct for Chrome.  If 1.1.1.1 is configured, DoH will be attempted to
https://chrome.cloudflare-dns.com/dns-query.


> However, if I were to ask the resolver who operated it over Do53 that
> would require me to trust the local network, no?
>

Maybe you could ask the target DoH server if it has the same operator as
the original Do53 address.  Has the advantage that the DoH server is at
least an authenticated connection.  But that's not giving much protection
if you didn't have a mechanism to prevent a network attacker from just
sending you to an attacker-controlled DoH server to start with.