Re: [Add] [EXTERNAL] Re: Browser Administrative Authority

[Paul Ebersman <[e-mail]>]

melinda> I do think part of the problem here is that for whatever reason
melinda> our community (the IETF) hasn't come to consensus on problems
melinda> related to trust in the DNS.  If you don't have a trustworthy
melinda> name resolution system you can't trust much else, either.  This
melinda> relates to both being able to get a correct answer that hasn't
melinda> been mucked with by a third party, and to privacy protection of
melinda> queries and responses.  It seems unsurprising to me that
melinda> browsers (and other application vendors) would respond to the
melinda> default unprotected DNS situation by doing something about it
melinda> themselves.

If you are worried about full end to end data integrity, DoH/DoT isn't
it. It's a point to point encryption with no way to know if that
recursive you're talking to actually got valid DNS data.

DNSSEC solves that problem (end to end data integrity).

DoT/DoH solves the confidentiality (snooping the wire) problem but
that's all it solves.

If you want privacy and validated data, you need both.

But that's the technology piece. That still doesn't address user consent
vs network policy.

Let's not conflate several problems into one big hairball. Glenn laid
out some policy and consent issues. That seems something useful to at
least enumerate and define clearly so we at least know what problem
we're trying to chew on first.