Re: [Add] Fwd: New Version Notification for draft-mglt-abcd-doh-privacy-analysis-00.txt

Hi Vittorio,

I agree that it will be hard to have a general statement as DoH brings more
or less privacy. As you mention "it depends". However, I believe
it should documented, so the end user can understand in which context he is
and what to do.

Yours,
Daniel

On Wed, Nov 6, 2019 at 3:51 PM Vittorio Bertola <vittorio.bertola=
40open-xchange.com@dmarc.ietf.org> wrote:

>
> Il 6 novembre 2019 20:35 Bob Harold <rharolde@umich.edu> ha scritto:
>
>
>
> On Wed, Nov 6, 2019 at 2:10 PM Tommy Jensen <Jensen.Thomas=
> 40microsoft.com@dmarc.ietf.org> wrote:
>
> As far as ill-behaved applications go, they were going to do whatever they
> wanted anyway, and pushing DoH adoption doesn't give them powers they
> didn't already have. At some point, the problem becomes one of the user
> needing to decide what apps they trust which we cannot help with via
> protocol design.
>
>
> I agree with most of your points - but here you say "pushing DoH adoption
> doesn't give them powers they didn't already have".  One concern is IF some
> major web service enables DoH on a major web server, then that does make it
> very easy for apps to hide their DNS in a way they could not easily do
> before.
>
> More generally, applications could already do their own
> DNS-over-whatever-type-of-encryption-and-obfuscation-protocol, but they
> would have to develop it on their own and also develop and run the related
> server. After standardizing DoH and getting it widely adopted, applications
> that want to reach that objective just need to deploy a readily available
> Web client library and use any of the many public servers - something that
> any script kiddie can do.
>
> Note that this is less true of DoT, since DoT towards out-of-perimeter
> servers would more easily be detectable and blockable. This is why I have
> heard some cybersecurity people suggest that the industry should promote
> DoT rather than DoH, as they see it less likely that DoT will circumvent
> national cybersecurity practices and law enforcement mechanisms.
>
> Regarding Daniel's draft, I appreciate the effort and I partly tried to do
> this and other analyses in my draft for Prague, but I then realized that
> there are people here that will never consent to such a document becoming
> an agreed standard, even if informational. So I suggest that we should
> focus on a few technical developments for interoperability purposes that we
> can agree upon, such as standardized ways for the local network to
> advertise their own Do* service and their use of it for local policy
> enforcement, and give up discussions on deployment models and human rights
> assessments. I don't think we could ever get to agreement here on whether
> DoH brings more privacy and freedom or less of it, as the answer is really
> "it depends".
>
> --
>
> Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
> vittorio.bertola@open-xchange.com
> Office @ Via Treviso 12, 10144 Torino, Italy
>
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
>