Re: [Add] data integrity and DNSSEC or DoH/DoT

[Christian Huitema <[e-mail]>]

 

> On Sep 3, 2019, at 7:34 AM, Neil Cook <neil.cook=[e-mail]> wrote:
> 
> 
> 
>>> On 3 Sep 2019, at 15:46, Eric Rescorla <[e-mail]> wrote:
>>> 
>>> It’s not entirely  useless. The problem it does solve is giving the user a better experience when a site is blocked for resolvers that support this extended Error Code. Currently for HTTPS the user will end up with a TLS connection error of some kind (or a blank page in some browsers). If a resolver returns a “blocked/censored/prohibited” response, then the browser can tell the user that the web page was blocked with an informative message. Assuming this becomes the default behaviour for non-malicious resolvers then I think it will a good signal for distinguishing  "this is malware blocking" from "this resolver is malicious”.
>> 
>> I'm not following. Suppose that we add an error code that says "this site has malware". Now, I operate a resolver which is malicious in the sense that it wishes to block a certain form of content (say, access to the IETF) but don't want the people whose content I am blocking is being blocked for that reason. So, instead I return "this site has malware".
>> 
>> My point here is that a code of this type only tells you what the resolver *asserts* the reason it blocked it is, it doesn't necessarily tell you what the actual reason that the content was blocked.
>> 
> 
> Ok yes I understand. The blocking reason wouldn’t be that useful in the general case of not knowing whether a resolver was malicious. However I think the fact that the resolver is telling you that the content is blocked is still useful, no matter what the reason for the blocking is, for the reason described above. For example in your use-case, the user would see “this site is blocked by the DNS resolver” (or whatever) rather than “TLS connection error” which would be the case today.

Is there a way to explain how the message is blocked? Such as, "this domain is listed as malware in RBZ malware.example.net." Information like that would allow the client to make an informed decision.

-- Christian Huitema