Re: [DNSOP] on the subject of dnse

Paul Vixie <paul@redbarn.org> Fri, 21 March 2014 14:59 UTC

Message-ID: <532C53BD.7030205@redbarn.org>
Date: Fri, 21 Mar 2014 07:59:09 -0700
From: Paul Vixie <paul@redbarn.org>
User-Agent: Postbox 3.0.9 (Windows/20140128)
MIME-Version: 1.0
To: Phillip Hallam-Baker <hallam@gmail.com>
References: <532BB27F.9020208@bogus.com> <CAMm+Lwhpvc51WBgjs_TvgdmVG7hDBPKAt57zTtP3g2uFU2nnFg@mail.gmail.com>
In-Reply-To: <CAMm+Lwhpvc51WBgjs_TvgdmVG7hDBPKAt57zTtP3g2uFU2nnFg@mail.gmail.com>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/dnsop/0YagMJL3N2e4eBIT1PVFz9RsJzs
Cc: joel jaeggli <joelja@bogus.com>, "dnsop@ietf.org" <dnsop@ietf.org>
Subject: Re: [DNSOP] on the subject of dnse
Precedence: list

Phillip Hallam-Baker wrote:
> This was the use case that originally drove the development of OmniBroker.
>
> If we do DNS Encryption right it is going to be very easy for end
> users to chose their DNS provider and very hard for the authorities to
> block them.

+1.

> Security is a balance. Going through 8.8.8.8 rather than direct means
> that you are leaking privacy sensitive information to Google. But that
> is probably less important here than the censorship attack.

noting, google's public claims about not data mining any part of the
8.8.8.8 query flow, are believable. we also now know that the greater
risk is an on-path nation-state MiTM. i think we should solve for the
latter and not worry about the former.

vixie

[DNSOP] on the subject of dnse joel jaeggli
Re: [DNSOP] on the subject of dnse Phillip Hallam-Baker
Re: [DNSOP] on the subject of dnse Paul Vixie
Re: [DNSOP] on the subject of dnse Phillip Hallam-Baker