Re: [Add] Fwd: New Version Notification for draft-reddy-dprive-dprive-privacy-policy-00.txt

[tirumal reddy <[e-mail]>]

On Mon, 7 Oct 2019 at 14:32, Paul Wouters <[e-mail]> wrote:

> On Mon, 7 Oct 2019, tirumal reddy wrote:
>
> >       Section 10 Security Considerations describes well why I think this
> is
> >       not a good idea. Publishing a privacy policy in a computer
> consumable
> >       way has no relationship to the actual DNS server's privacy policy
> >       used.
> >
> > No, the privacy policy also conveys a URL that points to the human
> readable privacy policy formation of the DNS
> > server. Public DNS resolvers have published privacy policy statements
> (for example, see
> >
> https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/).
> If a firm violates the privacy
> > claims, it will most likely face penalty (similar to FTC imposing fine
> on facebook).
>
> How and how would any enforcement system work for a variety of DNS
> providers all over the world? ISPs? hotels? coffeeshops? Mobile
> providers? Will there be an industry standard org? How will this
> not devolve into government sanctioned mandatory DNS providers on
> my mobile device?
>

Users may or may not trust the attached network and the DNS server provided
by the network (e.g, a public network). It is similar to the way users
disable VPN in specific trusted networks (e.g., Enterprise network) and VPN
is enabled by default in all other networks.


> >       This is not a technical wire problem to solve with an RFC. It is a
> >       social-economic issue. Can we trust vendor X? And vendor X making
> >       claims in JSON about this isn't useful from a technical point of
> >       view, no matter how or where and with what such statements are
> >       (self)signed.
> >
> > Not really, you probably missed the privacy consideration section. User
> consent is mandatory to use the discovered DoT/DoH
> > servers, the section says the following:
>
> How would that not become another "we use cookies, are you okay" screen
> for which I have no choice but to say "yes"?
>

No. If the privacy requirements of the endpoint are not met, the DNS client
can discard using the discovered DNS server in the attached network, and
connect to a public DNS resolver meeting the endpoint privacy preserving
data policy requirements.

The proposed mechanism also helps the DNS client to automatically learn
updates to the privacy claims by a DNS server and avoids the need for users
to periodically manually review the privacy statement.


>
> >    Users are expected to indicate to their system in some way that they
> >    trust certain PAT signers (e.g., if working for Example, Inc., the
> >    user's system is configured to trust example.com signing the PAT).
>
> How is that done on my iphone? If I install vendor X application, I
> already have to trust them (and google or android, etc). Another screen
> of "terms and services" the enduser is forced to scroll through?
>
> >    Separately, the user is expected to indicate to their system their
> >    PAT privacy requirements (e.g., logging, etc.).  By doing so, thee DNS
> >    client can automatically discover local DNS-over-TLS or DNS-over-
> >    HTTPS server, validate the PAT signature and check if the PAT
> >    complies with user's privacy needs, prior to using that DNS-over-TLS
> >    or DNS-over-HTTPS server for DNS queries.
>
> All of these things come down to one thing. Do you trust the DNS
> provider or not. It's really a binary decision. Dividing this up
> in a dozen options isn't helping the average user.
>

The privacy policy information helps make the decision whether the DNS
provider can be trusted or not.


>
> >       It's a great topic for consumer advocay organisations, the EFF or
> >       ACLU or EU commisioners. I do not think this is a technical problem
> >       needing a technical standard from the IETF. And any automated
> >       consumption of this leading to changed DNS client behaviour would
> >       be dangerous.
>
> I'm still not convinced this statement is wrong. And additionally can
> see some serious harmful effects into mandatory censorship if this kind
> of system becomes mandatory on people's devices.
>

I disagree, the proposal helps the user to choose a DNS server that best
supports the desired privacy policies. DNS clients do not need to fallback
to clear text DNS, and can use the DoT/DoH server provided by the local
network. Further, it also provides a mechanism to securely signal to the
DNS client that the attached network performs DNS filtering.

Cheers,
-Tiru


> Paul
>