Re: [Add] [EXT] Re: meeting hum: should the IETF take up this work?

[Christian Huitema <[e-mail]>]

On 8/1/2019 10:59 AM, Jacques Latour wrote:

> From the department of this-could-be-a-bad-idea and the department of
> omg-this-goes-against-everything-we’re-trying-do, but here it goes: a
> DoH operator should have a policy to blacklist IP address as requested
> by the network operator, since we can’t effectively block DoH at the
> edge of the enterprise network, an enterprise network should have the
> ability to request the well behaved DoH recursive operators to block
> requests coming from their network IP address.  Perhaps have some sort
> of trusted clearing house of IP addresses that the well behaved DoH
> recursive operators should blacklist from. Enterprises can block non
> well behaving DoH recursive operators.

Not only does this come from the bad ideas department, but blocking at
the DoH operator is not going to scale, given the number of enterprise
policies. It also assumes the DoH operator can identify the enterprise
network from which the query originated, which is non trivial -- what if
the query arrives with DoH over Tor, for example?

If you want to enforce an enterprise policy, you are much more likely to
succeed at the local end point. I understand that Mozilla is willing to
use an heuristic to detect enterprise networks that would require
blocking DoH. If you don't trust that, your best bet is to enforce your
blocked lists through a browser plug-in, the same kind of plugin that is
also used for parental control. I suppose that security software
companies will be willing to provide such plug-ins.

-- Christian Huitema