Re: [Add] What to do in this potential working group

[Ted Hardie <[e-mail]>]

Hi David,

On Wed, Aug 21, 2019 at 10:59 AM David Conrad <[e-mail]> wrote:

> Ted,
>
> Not Jari, but wanted to point out one thing:
>
> On Aug 21, 2019, at 10:36 AM, Ted Hardie <[e-mail]> wrote:
>
> The second threat model is that a resolver may provide an untrustworthy
> answer (e.g. captive portal). The use of DoT and DoH can help with this if
> the client device, application, or user selects a trustworthy resolver**
> and uses the TLS certificate to verify they have reached that service.
>
>
> You probably need to define “trustworthy answer” here.
>

I tried to finesse that saying by saying it is up to the client to decide
this.  If there is an objective reality to "trustyworthy answer", though, I
think "true to the data supplied by the zone maintainer" may still be it.
I'm not sure there is, though, if you have any belief in the use of the DNS
as a control surface.  In the case of household using a DNS filtering
service, the answer may be that the "trustyworthy" resolver provides the
data supplied by the zone maintainer after the application of the filters
to which the subscriber has agreed.


>  Traditionally, a “trustworthy answer” was the data originally supplied by
> the zone owner of the domain being looked up. DNSSEC was created to ensure
> this. However, network operators (e.g., CDNs) playing “stupid DNS tricks”,
> resolver operators providing filtering, etc. may have changed what is a
> “trustworthy answer” over the years.
>
> With that said, and assuming you’re using the traditional interpretation
> of “trustworthy answer”, then DoT/DoH do not ensure a “trustworthy answer.”
> DoT/DoH provide transport protection. The only way to truly ensure a
> trustworthy answer is to protect the actual answer. Which is what DNSSEC
> does.
>
>
Evidently I was unclear, sorry.  It doesn't assure you that the answer is
trustworthy; it can assure you have reached the resolver that you intend.
If you trust that resolver (for whatever value of trustworthy you have),
that may help.

Thanks for pointing out the lack of clarity,

Ted
(as an individual)



> Regards,
> -drc
> (Speaking only for myself)
>
>