Re: [Add] point of deploying DoH in access network (Re: meeting hum: should the IETF take up this work?)

[Joe Abley <[e-mail]>]

On 1 Aug 2019, at 14:38, 神明達哉 <[e-mail]> wrote:

> At Wed, 24 Jul 2019 13:15:49 -0400,
> Stephane Bortzmeyer <[e-mail] <mailto:[e-mail]>> wrote:
> 
> > > I’m also trying to understand why there seems to be resistance to
> > > providing ISPs with advice on deploying DoH.
> >
> > I'm tempted to say that I don't see the point for an access network to
> > deploy DoH. If the network is safe, DoH is not really necessary
> > (paranoid may use DoT, since the access network can ensure that port
> > 853 is clear). If it is not, for instance because the resolver
> > modifies the answers, then users will want to bypass it, anyway.
> >
> > My guess is that DoH operators will be different from access network
> > operators.
> 
> I've been wondering about this, too.

Lots of access network providers don't control all of the infrastructure between their network and their end-users. Examples are ISPs that use wholesale DSL and CATV access networks operated by incumbents who are required to allow third-party access by regulators.

I have heard concerns before that such access wholesalers might interfere (e.g. block, rate-limit) traffic that was in competition with their own services, or for other reasons. I've also heard concerns that such wholesalers routinely target retail customers of other ISPs when trying to sell their own retail services, and that visibility of the traffic of the end-users allows them to be tempted with targeted promotions.

I'm not saying any of this has happened, anywhere; I'm just saying I have heard concerns about these kinds of things.

To the extent that any of this kind of thing can be enabled by surveillance of DNS traffic between an end-user and a resolver, this to me is a plausible reason to want privacy protection. DoH is arguably a better mechanism than DoT for anybody whose primary focus is privacy (as has been discussed from many angles, many times) because the existence of the channel is obfuscated along with its content.


Joe