Re: [DNSOP] Proposal: Whois over DNS

[John Bambenek <[e-mail]>]

Not intended to debate, per se.

On 7/9/19 10:21 AM, Ted Lemon wrote:
> As far as I can tell, you are deflecting my serious concerns rather
> than responding to them.   I’m asking you to describe an actual
> situation where the information you want us to publish would (a) be
> published and (b) /actually work/ as a means of notifying some real
> person of something, or prosecuting some real crime.  I’m going to
> respond to what you’ve said to point out that it’s not serious, but I
> encourage you not to debate these points with me.  If your goal is
> actually to publish this draft, the right thing to do is come up with
> some good arguments why the IETF should publish it, not to get into a
> debate over details with me.
>
> You respond:
>> I most certainly can and do use no information and false information
>> for making policy decisions. In fact, so do you and everyone here,
>> every day. Would you give you credit card information over the phone
>> when receiving a call with no caller ID?
>
> Caller ID is always presumptively forged.  If you actually care about
> not being phished, you should never under any circumstances provide
> your credit card information over the phone if you didn’t initiate the
> phone call.   You shouldn’t even do it then, since telephone
> conversations aren’t encrypted end-to-end.
I'd agree its preemptively forged. Then pick another example. If someone
came up to you on the street and demanded to see identification, you'd
say no. If they were wearing a police uniform and have a badge, you
might say yes (varies between jurisdictions).
>
>> You're making an assumption that people SHOULDN'T ever give contact
>> information. That's not true. Every business puts their contact
>> information their website. They WANT to be contact. Individuals often
>> will do the same. On twitter, journalists routinely put their phone
>> numbers.
>>
> This isn’t actually true.  People who want anonymous contact do in
> fact publish information that people can use to contact them
> anonymously, which may be a phone number.   It’s also a straw man.
>  I’m not saying people shouldn’t ever give contact information.  I’m
> saying that people shouldn’t be held hostage in such a way that they
> are forced to _publish_ personal information in order to get services.
No one is holding anything hostage, I guess that's the thing I genuinely
don't get. Individuals are free to publish or communicate how they see
fit. I'm free to reject said communication. It's the other side of the
same coin. No one is forcing anything. If this proposal was universally
implemented, there still would be no force or hostage taking. On one
hand, I'm being told to show incentives, on the other told that such
incentives are coercive. I can't do both.
>>
>> As far as pretext for "investigating people", as long as I break no
>> laws, I can't investigate anyone for anything I want at any time I
>> want for any reason I want. So can you. But that's not the question
>> here. Voluntary interconnection is. I can deny people access to my
>> resource for any reason I want.
>>
> Repressive regimes often use pretexts to justify their repressive
> activities.   It is to this that I am referring when I talk about this
> as an attack surface.  Maybe you never engage in improper policing,
> but we can’t assume that this is true everywhere where DNS is used.
I'm a private sector actor, improper policing is criminal. I can't
forsee, however, how a repressive regime could use a phone number in a
DNS record to commit human rights violations.
>>
>> You'd want me (or others) to let you know about compromises, for one.
>> DMARC does this already, in a sense. I get email reports about
>> potential abuse of my domain and spoofing emails. To do this, it
>> needs an email. I get something. But wide-spread adoption is the
>> risk, I don't make any illusions of that.
>
> There is no way in the world that I would ever publish my email
> address as a way to get notifications of compromise.  Not merely for
> privacy reasons, but because the spam rate on that email address would
> be astronomical, and so I’d never see them.
Then don't, that's fine.
>
>> I can provide lots of use cases and provide others who will attest to
>> the same. Victim notification, correlation of domains and resources,
>> investigations, generating reputational data…
>>
> These are nearly all examples of ways this information will be used
> against me.  If you think victim notification is a good use case, can
> you describe in detail how that would work?

It's voluntary, if you don't want it, you won't get it. But there are
millions of websites compromised on the internet right now. We can only
clean them either if hosting providers just go in and do it (assuming
they have access), or somehow contact you in a low cost way and getting
you to do it. There exists no easy programmatic way to do this unless
the hosting providers want to get into that business, so the use case
doesn't really exist today.

That being said, the sticking point is "used against you". Anything you
do can be used against you online in deciding whether or not I want to
accept your packets. People block entire countries. That is their right
and how the internet was designed to work. I don't intend to deflect, I
intend to say I believe such a position runs counter to a fundamental
design principle of the internet.

I'd like information, for instance, to accurate and narrowly block bad
providers. In the absence of that data, all I have is provider
reputation. For instance, if you have a .pw or .tk TLD, you're just
blocked. You may be innocent, but if I can't specifically block, I have
to generally block, which means innocent people get dragged in. The
alternative is to not block and allow my constituents to more likely be
victims.

>> There is no protocol, communication, human endeavor where this will
>> be every true as far as "not used against me". DNS records is
>> entirely voluntary now. You control what you put or don't put in
>> there, no one is changing that. But using it against you or not,
>> someone could use the fact you are running an IIS web server against you.
>>
> It’s true that whenever I communicate with anyone, I create a risk for
> myself.  So doesn’t it make sense that I would want to control with
> whom I communicate, rather than broadcasting?
If you are e-mailing me, connecting to my webserver, etc, you want to
communicate with me... should I not have information with which to make
a decision to decide if that's ok? If the answer to this is no, then we
have an irreconcilable philosophical difference and that's ok, I just
disagree and there isn't much middle ground to be had there.
>> Exactly what ethical standard do you claim is violated here? And if
>> the answer is that you have some unfettered right to access my
>> network resources, that is simply false.
>
> That’s an interesting response, which suggests that you have a use
> case in mind.  The use case you have in mind is that you will deny
> service to people who do not publish this information.  This is
> exactly the attack surface I was describing earlier, and you’ve just
> said that you intend to use this attack.
More accurately, I will score it as part of one of many reputational
indicators if and only if a critical mass of adoption takes place for
the VERY small portion of the internet I have a say on. I'm not Google,
I have no power over even a rounding error of the overall network space.
>
> Of course it’s your right to deny service to people who don’t identify
> themselves to you.  If you want to do that, the way you do that is by
> establishing a business relationship with them and refusing service to
> people with whom you have no business relationship.  It is not by
> creating a huge database of personal information accessible to
> everyone, and demanding that they publish their information in  this
> database.

You assume I'm going to create a huge database, I am not. I would
envision doing something like if you send me email, try to connect, etc,
there is a DNS query for this information, much like there are queries
for DBLs, SPF et al, and score it in real time.

Or if doing abuse reporting, just programmatically look who an email and
then email whatever is given (assuming syntactically valid).

>
>
> _______________________________________________
> DNSOP mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnsop