Re: [Add] fixing coffee shop brokenness with DoH

[Vittorio Bertola <[e-mail]>]

Il 24 luglio 2019 12:19 Joseph Lorenzo Hall <[e-mail]> ha scritto:

On Tue, Jul 23, 2019 at 22:26 Tommy Jensen <Jensen.Thomas= 40microsoft.com@dmarc..ietf.org> wrote:

> Are people selling DNS logs to ad tech companies? Is that the ecosystem being disrupted?

Given how many valid points have been brought up in the last few weeks about the drawbacks of centralized app-configured DNS, I don’t think the glib tone is constructive.

Tone aside, to some users, centralization is a benefit in that they don't have a bunch of unknown privacy policies applying to the resolution of the names they need. For example, the privacy policy of 1.1.1.1 is pretty amazing from the perspective of data retention, secondary uses, etc. (e.g., I know my resolutions will be removed from their logs within 24 hours).

This may seem small but it seems to be lost in the centralization/choice discussion.

What you seem to want above, however, is not made possible by centralization, but by user choice, i.e. the user being able to tell all the applications to use a specific resolver that has a privacy policy they like. Centralization might make your choice easier, since you have less privacy policies to compare, but might also make it impossible for you to find one that you actually like - the fewer they are, the easier it is for them to form a cartel and impose conditions that are only good for them.

Moreover, the above is already possible today over unencrypted DNS(*) - just enter "1.1.1.1" or whatever other IP address in the configuration of your operating system. And DoH could even make it go away, if applications started to tell you that you are "not technical enough" to even deserve a configuration option, and started sending your DNS queries to a resolver that you did not choose and that maybe does not have the privacy policy you want.

(I will also note that all this focus on privacy policies is a U.S. bias - in Europe, all resolvers have a pretty restrictive basic privacy policy which is mandated by the requirements of the GDPR, though of course there still are differences that deserve giving users a choice.)

(*) bar transparent proxying etc, which encrypted DNS will make impossible and I don't think anyone has objections to that, as long as in the overall we build a system that works for everyone.

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[e-mail] 
Office @ Via Treviso 12, 10144 Torino, Italy