Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers

[Rob Sayre <[e-mail]>]

On Tue, Jun 30, 2020 at 5:52 PM Eric Rescorla <[e-mail]> wrote:

>
>
> On Tue, Jun 30, 2020 at 4:25 PM Deen, Glenn (NBCUniversal) <
> [e-mail]> wrote:
>
>> This all comes back to the three slices of access types that had been
>> discussed some months ago:
>>
>>
>>
>>    1. Trusted & known networks – this is your enterprise, your home.
>>    You have a relationship with them.
>>    2. Unknown networks – This is the café, school, hotel - you choose
>>    them because they are available, but you know very little to nothing about
>>    them.
>>    3. Hostile networks – you may not have any choice in network and must
>>    use this is you want any Internet access at all.  However, not only do you
>>    not trust them, you know they are actively acting in ways you do not want.
>>
>>
>>
>> Another slice around threat levels would be: Green, Yellow, Red networks
>>
>>
>>
>> Certainly in terms of policy and security concerns one size does not fit
>> all 3.  The question is can we fashion a discovery means that works in all
>> 3, but perhaps mitigates the policy and security concerns in each?
>>
>>
>>
>> DHCP may be a perfectly fine choice in a green network, but in a yellow
>> network there is a need for validation and assurance of the choice, while
>> in a red network – can you trust anything at all, even things you
>> explicitly specified such as IP address of resolvers without some
>> additional validation ?
>>
>
> This is a great taxonomy. Thanks.
>
> I think the question I would ask is: in a green network, how much benefit
> do you get from Do[HT]? We can probably divide this up into the local
> network environment (e.g., the wireless network) and the access link from
> the ISP.
>

There are lots of attacks that create compromised "Green" networks. For
example:

https://www.zdnet.com/article/brazil-is-at-the-forefront-of-a-new-type-of-router-attack

I might categorize an "enterprise" network as something managed well enough
to do an investigation in the event of a security breach. Most business and
home networks do not fit this definition, so they are category 2
("Yellow"), because people set them up and forget them.

thanks,
Rob