Re: [arch-d] IAB statement on "Avoiding Unintended Harm to Internet Infrastructure"

[Mark Nottingham <[e-mail]>]

On 14 Nov 2019, at 9:29 am, Paul Ebersman <[e-mail]> wrote:
> 
> My take from RFC 7258 is that the key differentiator is user knowledge
> and/or consent, i.e. if the user is not aware they are being monitored
> and/or has not consented explicitly to altered data (in this case DNS
> answers), that is what RFC 7258 considers an attack.
> 
> In the use case of DNS filtering, if the user is both aware of the
> alteration of DNS answers (and why/how they might be altered) and has
> consented via opt-in, that is a *service*, not an attack.

7258 doesn't say anything about consent or "user knowledge," so I don't know how you took that away from the document.

Putting that aside, assuming that consent (or its oft-relied upon variant, "informed consent") is adequate to protect users relies on users' ability to understand how the Internet works, how their data will be used, how it could be misused, how changes in policy, law, or entity ownership might affect its handling, the nature of any security vulnerabilities introduced by third parties involvement in their communication. If the consent is long-lived (as it would be with DNS), they have to remember it over that period of time, for each interaction. They also have to intersect this consent with others that they give -- often leading to "consent fatigue" (see: GDPR cookie notices and privacy policy changes).

That doesn't mean that we should never allow a user to make a choice, but we need to think carefully about the systemic effects of the points where we allow such a choice; there is ample evidence that most users _don't_ understand the choice they're making, and can be led into pretty hazardous situations as a result.

Right now, unencrypted DNS via DHCP doesn't give users a choice at all; they use the DNS results returned by their network, without any consent (beyond using the network -- which in most peoples' minds is "the Internet."). They can, however, choose to use a different DNS server by configuring it, or they can choose to configure an encrypted DNS server. 

The sticking point here is that DoH allows someone to avoid their network making that choice for them (with a lot of fuzziness about how consent is obtained). There are user-centred arguments as to why it's necessary to impose that policy at the network level (eg., lack of interfaces to configure IoT devices), but let's not start from the assumption that the best place to interpose those services is by having the network transparently handle them, just because that's how it's been done before. Let's also not assume that obtaining consent explicitly from the user to interpose those services is easy or without risks of various sorts; we have lots of examples where allowing random devices on networks to ask permission to do things ended up badly.

> As Andrew said, we and the IAB should not be making blanket statements
> that "all DNS filtering is wrong" as that doesn't correctly reflect all
> of our stakeholders, considering the use case of user approved
> filtering.

That is not a quote from the document. In context, the statement is cautioning that legislation or regulation that requires DNS servers to give false answers could have systemic effects on trust.

> Agreed. Recent government panels in the UK and Australia on DoH and
> concerns that this will break DNS filtering, even in cases where the
> users wish to have it, shows that governments and law enforcement will
> push back on technical standards.

Australian here; could you point me to the event you're talking about? Because I see no evidence yet that the Australian government will "push back" on DoH. There are some people who are trying to stir up a controversy around it, and a lot of misinformation flying about, but nothing from the government itself, AFAICT.

> This is particularly likely if we
> don't include them as stakeholders in discussions and help them
> understand what these protocols do (and don't do).
> 
> This doesn't mean I'd advocate for government approval of IETF documents
> but avoiding misunderstandings we can predict in advance does make it
> less likely we'll be saddled with excessive and possibly ineffective
> regulation.

I agree that we need to do better in working with the various parts of the Internet community, including governments. I'd be loathe to give them any special status, though, as that would fundamentally change the nature of the IETF, and the Internet.

Chers,


--
Mark Nottingham   https://www.mnot.net/