Re: [DNSOP] Proposal: Whois over DNS

[John Bambenek <[e-mail]>]

Below

On 7/9/19 9:28 AM, Ted Lemon wrote:
> On Jul 9, 2019, at 10:07 AM, John Bambenek
> <jcb=[e-mail]
> <mailto:jcb=[e-mail]>> wrote:
>> But ICANN won’t allow such a system with meaningful data, so here we
>> are. 
>
> The question you should be asking is “why not?”   The answer is that
> nobody whose info you need will publish it, because the info you need
> is from people who are engaging in misfeasance or malfeasance.  The
> people who will publish accurate information here are likely naive, so
> you’ve really just created a vuln that bad actors can exploit.

Why ICANN won't? The answer is not that altruistic.

If there are incentives they will, yes, wide spread adoption is a
problem, but define accurate? Role-based accounts are fine here (some of
which, I believe are codified in RFCs already). If you'd like, I can get
you the anti-spam people to chime in on their thoughts about how much
abuse would happen compared to how much anti-abuse would be facilitated
given adoption.

> You can’t use the fact that no information, or false information, is
> provided as a basis for seeking out bad actors, because any sensible
> person will not put their information in this database unless they
> have to to get something they need.  If they have to to get something
> they need, they will likely put in false information, because they
> have no legal obligation to do otherwise, and putting in correct
> information would not be in their interests.   So all you’ve done here
> is create two attack surfaces.
>
I most certainly can and do use no information and false information for
making policy decisions. In fact, so do you and everyone here, every
day. Would you give you credit card information over the phone when
receiving a call with no caller ID?
> The first attack is against people who are naive: you now have
> personal information about them that they shouldn’t have given you.  
> The second attack is that you can use the fact that someone posts
> false information, or doesn’t provide information, as a pretext for
> investigating them.
>
You're making an assumption that people SHOULDN'T ever give contact
information. That's not true. Every business puts their contact
information their website. They WANT to be contact. Individuals often
will do the same. On twitter, journalists routinely put their phone numbers.

As far as pretext for "investigating people", as long as I break no
laws, I can't investigate anyone for anything I want at any time I want
for any reason I want. So can you. But that's not the question here.
Voluntary interconnection is. I can deny people access to my resource
for any reason I want.

> If you genuinely think this is worth doing, please come up with a
> real-world use case that meets the following three criteria:
>
>   * It would be in my interest to put information about myself in this
>     database
>
You'd want me (or others) to let you know about compromises, for one.
DMARC does this already, in a sense. I get email reports about potential
abuse of my domain and spoofing emails. To do this, it needs an email. I
get something. But wide-spread adoption is the risk, I don't make any
illusions of that.
>
>   * That information would be useful to you, or to someone specific
>     whom you can identify
>
I can provide lots of use cases and provide others who will attest to
the same. Victim notification, correlation of domains and resources,
investigations, generating reputational data...


>   * My participation in, or non-participation in, this mechanism is
>     entirely voluntary, and can’t be used against me
>
There is no protocol, communication, human endeavor where this will be
every true as far as "not used against me". DNS records is entirely
voluntary now. You control what you put or don't put in there, no one is
changing that. But using it against you or not, someone could use the
fact you are running an IIS web server against you.
>
> You haven’t done that yet.  If this depends on people acting against
> their own interests, we shouldn’t publish it.  If it solves a paper
> problem but isn’t actually useful, we shouldn’t publish it.  It needs
> to solve a real problem in a way that is ethical.   I don’t think it does.
Exactly what ethical standard do you claim is violated here? And if the
answer is that you have some unfettered right to access my network
resources, that is simply false.