Re: [dispatch] Working Group Proposal: DNS Over HTTPS

[Stephen Farrell <[e-mail]>]

I'm not against this, pretty much for it in fact, but...

On 10/08/17 17:00, John Levine wrote:
> 
> Someone asked what if the https server lies?  DNS caches have always
> lied, that's nothing new.  If you don't trust it, you have DNSSEC.

Changing the liar can be significant. If this is used with
some dedicated https server that only does dns and nothing
else, and the URL for that is configured into a dns/https
client, that's probably no big change vs. speaking the dns
protocol with a resolver.

If however, a random web site were to be able to get a http
client like a browser to believe lies about dns then that'd
be much worse than today, if those lies affect more than the
web pages that the fibbing web site can control anyway.

That's ack'd in the last para of the security considerations
but I suspect more will be needed there, first to analyse
possible bad behaviours and then to figure out what to say
about those. (I'd be surprised if that were doable by the
end of the year, but since ietf milestone date fiction
deserves it's own aisle in a bookstore, that's ok:-)

As an aside, I'm puzzled a bit by how CORS comes into this.

S.