Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

[Ted Hardie <[e-mail]>]

On Wed, Jul 17, 2019 at 11:40 AM Brian Dickson <
[e-mail]> wrote:

>
> The root of the problem is visible in "if they chose not to". The nature
> of DoH, is that the network operator (regardless of who they are) is unable
> either detect or prevent guests (or users or BYOD or whoever) from not
> complying with your network policy.
>
>
I disagree.  It forces the existence of the network policy to be visible,
but it is entirely possible to deny network access to a system which is
non-compliant.  It is not as simple as blocking or intercepting all port 53
traffic, but that method never addressed the reality that cleartext traffic
on that port was available to an observer.  To get both confidentiality and
policy enforcement via this means, practice will need to change.  It will
need to be visible to the system consuming the DNS (be it a browser, an OS,
or some other application), and the enforcement mechanism will have to be
better integrated into reachability mechanics.  That is definitely new code
for most people, but it is not impossible.

regards,

Ted Hardie