Re: [dane] Alissa Cooper's No Objection on draft-ietf-dane-openpgpkey-10: (with COMMENT)

["John Levine" <[e-mail]>]

>I think if this sees any sizable deployment, it will be trivial for
>attackers to use it to harvest email addresses from the DNS. Section 7.4
>therefore seems to be quite misleading. I don't see why a zone walk is
>necessary to do this kind of harvesting when an attacker could just send
>one query per entry in its dictionary. I think it would be more accurate
>to say that by using this mechanism, people are effectively making their
>email addresses public.

I think this draft is a bad idea and should not be published at all,
but that isn't one of the reasons.

Address harvesting has been a problem for decades, since anyone can do
a partial SMTP transaction up to the RCPT TO stage to verify
addresses.  There are even companies that will check lists of
addresses for you to try and weed out the invalid ones.

Countermeasures are widely known in the e-mail community.  The obvious
one is rate limiting, but it turns out that a more effective one is to
lie and say all addresses are valid (in this case by returning fake
but plausible certificates.)  We often see the validation places start
by probing a bunch of random made up addresses to see if a domain says
yes to everything and then give up when it sees that we do.

>I also think the mechanism could facilitate pervasive monitoring as
>described in RFC 7258, ...

That, on the other hand is a problem: this draft has no security model
beyond saying it's not the web of trust.  With SMTP address probes, the
target system has some idea who it's talking to, and can require TLS
to prevent third parties from observing the traffic.  With DNS, the
traffic all goes unencrypted via caches.  The caches are often not
under the same management as the end system, and caches routinely
provide data to third parties for forensic and other purposes.  See,
for example, Farsight Security, run by people we all know, which
provides a large and interesting database of DNS query traffic to its
clients who use it to track down various sorts of online badness.

Everything published in the DNS has traditionally been public.  Some
people imagine that the contents of their zone files are proprietary,
but we know they're silly.  Publishing information that's
semi-private, or that contains PII, is a significant change of DNS semantics,
and its implications need far more careful evaluation than this
draft does.

R's,
John

PS: It also has downgrade problems, see prior messages on that topic.