Re: [dns-privacy] Concerns around deployment of DNS over HTTPS (DoH)

Kenji Baheux <kenjibaheux@google.com> Wed, 13 March 2019 04:34 UTC

MIME-Version: 1.0
References: <CADWWn7W19TX7Q8gQTJFHvUxg7jpR8UB8033QtcPK-N7wKafQKw@mail.gmail.com> <alpine.LRH.2.21.1903122346180.26130@bofh.nohats.ca>
In-Reply-To: <alpine.LRH.2.21.1903122346180.26130@bofh.nohats.ca>
From: Kenji Baheux <kenjibaheux@google.com>
Date: Wed, 13 Mar 2019 13:34:34 +0900
Message-ID: <CADWWn7WmRFz-vr+ur8b+1UEr9FagFOk7Y1F2cU+EMnwq4Bv=MA@mail.gmail.com>
To: Paul Wouters <paul@nohats.ca>
Cc: dns-privacy@ietf.org
Content-Type: multipart/alternative; boundary="0000000000005307030583f253ce"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dns-privacy/MIAcwUu2Pnmr_0JwlSvgm-F-s-o>
Subject: Re: [dns-privacy] Concerns around deployment of DNS over HTTPS (DoH)
Precedence: list

On Wed, Mar 13, 2019, 12:49 Paul Wouters <paul@nohats.ca> wrote:

> On Wed, 13 Mar 2019, Kenji Baheux wrote:
>
> > I'm involved with Chrome's DoH efforts.
>
> > Our motivations in pursuing DoH in Chrome is to offer our users a better
> user experience:
>
> >     Hopefully, some performance wins.
>
> > Tentative plans:
>
> >     We are considering a first milestone where Chrome would do an
> automatic upgrade to DoH when a user’s existing resolver is capable of it.
>
> I'm confused how these two can both be done? You either prefer the local
> ISP over Google DNS, or you prefer the faster of the two.
>

We would not change the underlying DNS provider. The only thing that would
change is how the DNS query is done: vanilla or DoH (if the existing DNS
provider is capable of it).

Discovery is an open question.

Until there is a better discovery story, we could have a list of
known-to-be-DoH-compatible DNS providers that we could check against and
map accordingly. Obviously, this doesn't scale but it seems reasonable for
the experimentation phase (gathering data, etc).

> >     There are some unanswered questions about how we will be doing that
> discovery, and would welcome input from the community. Perhaps, a good
> topic for IETF 104.
>
> that is interesting indeed. You doing some static name lookups to test
> would just make those names be in cache and not a good probe. And
> probing nonsense is something that you do too much of already and it
> is causing too much root zone noise :P
>

(^ ^;

> > PS: I won't be able to join IETF 104 to discuss this face to face
>
> I'm already envious :)
>
> Paul
>

Re: [dns-privacy] Concerns around deployment of D… Kenji Baheux
Re: [dns-privacy] Concerns around deployment of D… Paul Wouters
Re: [dns-privacy] Concerns around deployment of D… Kenji Baheux
Re: [dns-privacy] Concerns around deployment of D… nusenu