Re: [DNSOP] Concerns around deployment of DNS over HTTPS (DoH)

[Paul Vixie <[e-mail]>]

On Wednesday, 13 March 2019 10:20:58 UTC Kenji Baheux wrote:
> On Wed, Mar 13, 2019 at 4:41 PM Paul Vixie <[e-mail]> wrote:
> > ... can i request that you offer DoT as a
> > solution, not just DoH? they offer the same capabilities of secrecy and
> > authenticity, but DoT can be cheaply disabled by the network operator,
> > whereas
> > a malicious user or app using DoH will be very expensive to detect or
> > prevent
> > at the network level.
> 
> I'm not sure I understand in which scenario this would provide user
> benefits over DoH.

i plan (speaking as a network operator) to deploy and use DoT, but not DoH. i 
would like my users to have the benefits DoT offers, since it is an 
improvement over plain text in some parts of the topology here.

> I'm also not sure why / how a browser could prevent these type of issues
> from happening by merely shipping DoT on top of DoH.

i intend to cooperate with all network operators. when i travel, if DoT fails, 
i will know that the network operator does not want me to have privacy. i can 
then make an informed choice about whether to violate that policy, or not.

DoH deliberately obfuscates that condition, which is dangerous to me.

> If there is a malicious user or app on a network that someone is trying to
> protect, isn't the very existence of these players the actual issue that
> needs to be addressed?

i'll be happy to discuss the ways in which controlled RDNS helps detect such 
malicious activity, as a valuable contribution to addressing that activity. 
but i think i err'd in mentioning it here, since as you say, it's not the 
browser maker's problem.

> On the other hand, for the set of use cases that I do understand, the
> ability for a network operator (not the admin) to cheaply disable DoT, and
> as a result downgrading DNS to vanilla queries, appears to be a significant
> downside for end-users. Taken to an extreme, it seems to imply that
> shipping DoT is effectively the same as not shipping it.
> 
> What am I missing?

encryption and authenticity of DNS transactions has value even when the user 
and the network operator intend to cooperate. i'm not going to deploy DoH, 
however, nor use it when i travel. DoT, by working only when the user and the 
network operator are in cooperation, is a valuable technology for my needs as 
both an end user and a network operator.

thank you very much for your time.

vixie