Re: [DNSOP] An approach to DNS privacy

Florian Weimer <> Sun, 16 March 2014 15:04 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id ADA5B1A0211 for <>; Sun, 16 Mar 2014 08:04:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, RP_MATCHES_RCVD=-0.547] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id hiNaBFYM72Tb for <>; Sun, 16 Mar 2014 08:04:17 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 753A41A01D2 for <>; Sun, 16 Mar 2014 08:04:17 -0700 (PDT)
Received: from [] ( by with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) id 1WPCbh-0003N2-5U; Sun, 16 Mar 2014 16:04:09 +0100
Received: from fw by with local (Exim 4.80) (envelope-from <>) id 1WPCbh-0005PO-19; Sun, 16 Mar 2014 16:04:09 +0100
From: Florian Weimer <>
To: Phillip Hallam-Baker <>
References: <> <> <> <> <>
Date: Sun, 16 Mar 2014 16:04:09 +0100
In-Reply-To: <> (Phillip Hallam-Baker's message of "Sun, 9 Mar 2014 10:54:34 -0400")
Message-ID: <>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: "" <>
Subject: Re: [DNSOP] An approach to DNS privacy
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 16 Mar 2014 15:04:19 -0000

* Phillip Hallam-Baker:

>> If your ordinary resolver operator is a "carrier" is somewhat
>> questionable, but resolver operators generally comply with requests
>> for cleartext copies of traffic transitioning through their networks.
>> I have no doubts that these operators will ask implementors to add the
>> necessary features to keep these capabilities--or they will just turn
>> on indiscriminate query logging.

> We are not a carrier or an obligated party.

We aren't, but the people who run our protocols and code mostly are.
If they aren't, they comply with most requests directed at them just
to avoid being declared a carrier or an obligated party explicitly.

> The model where the carrier provides DNS resolution is bogus and
> obsolete for the reasons you cite.

I think we are being to see a move in a different direction, where end
users are no longer in a position to run resolvers.  For me, that's
not just theoretical because I've been forced to switch hosting
providers because my current one filters DNS traffic to certain
ISC.ORG name servers, apparently in an ill-advised attempt at prevent
their customers from taking part in amplification attacks.

> People are tired of being spied on without due process. Lets see some of
> the Abu Ghraib torturers facing criminal trial.

And more encryption helps with that how?

Abu Ghraib would have been just another prison with an abuse problem
without the pictures leaking out.  Proper cryptography with extensive
key management could have prevented that.  It is difficult to predict
how technology will be used.  A decade or two ago, many of us thought
that encryption and the ubiquity of software vulnerabilities (or the
fallibility of information systems in general) would help to keep
powerful governments in check.

When I first sketched the technology that is now cited in quite a few
DNS privacy discussions, I thought I was doing something genuinely
helpful.  Now the picture is less clear.