Re: [DNSOP] Favor: Weigh in on draft-ietf-ipsecme-split-dns?

Paul Wouters <> Fri, 30 November 2018 15:53 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 31DC51277BB; Fri, 30 Nov 2018 07:53:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id ZtisZHtxnwG5; Fri, 30 Nov 2018 07:53:35 -0800 (PST)
Received: from ( [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id CD2CD127598; Fri, 30 Nov 2018 07:53:34 -0800 (PST)
Received: from localhost (localhost [IPv6:::1]) by (Postfix) with ESMTP id 435zSr5PddzFY1; Fri, 30 Nov 2018 16:53:32 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=default; t=1543593212; bh=J6cHxcX+0myGRgD8uspHMa7Nc3YURas0lFJpC8bJTs0=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=Ro/7dwsJZAw2tNPz3eLMfNRldhTleShVZmVCcj4Wi9fm2ozgkwyoO2X1yviGODPhc zxsqJrTRAAkOUV72hv4lKSkSUkJrxauSy9sxIHEQn1gdxAJBWEvWRxZYnLzGhV2U0N Sp88cnXpqXDjIm5Eeky782EzfS31JSbwh2swVY+k=
X-Virus-Scanned: amavisd-new at
Received: from ([IPv6:::1]) by localhost ( [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id f4YvZ4Ed0zcG; Fri, 30 Nov 2018 16:53:31 +0100 (CET)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS; Fri, 30 Nov 2018 16:53:30 +0100 (CET)
Received: by (Postfix, from userid 1000) id 4EF124A2C9E; Fri, 30 Nov 2018 10:53:29 -0500 (EST)
DKIM-Filter: OpenDKIM Filter v2.11.0 4EF124A2C9E
Received: from localhost (localhost []) by (Postfix) with ESMTP id 4355F41C3B30; Fri, 30 Nov 2018 10:53:29 -0500 (EST)
Date: Fri, 30 Nov 2018 10:53:29 -0500
From: Paul Wouters <>
To: Ted Lemon <>
cc:, Tony Finch <>, dnsop WG <>,, Joe Abley <>
In-Reply-To: <>
Message-ID: <>
References: <> <> <> <> <> <> <> <>
User-Agent: Alpine 2.21 (LRH 202 2017-01-01)
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 8bit
Archived-At: <>
Subject: Re: [DNSOP] Favor: Weigh in on draft-ietf-ipsecme-split-dns?
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 30 Nov 2018 15:53:37 -0000

On Thu, 29 Nov 2018, Ted Lemon wrote:

> On Thu, Nov 29, 2018 at 12:31 AM Paul Wouters <> wrote:
>       How could the use case be more constrained without breaking functionality?
> I discussed this in detail in several previous posts, e.g.:


Well, you argued for changing things so much that it breaks
functionality :) And you would require the VPN client to have
some kind of DNSSEC resolving capability before the tunnel is
setup. And if those checks need to be done during tunnel setup
then there is also a significant delay that would affect on-demand

I especially disagree with your text:

 	I think that we should let the field tell us before figuring out how to solve that problem.

> I explained this in the previous posts.   I would be happy (really!) to help improve the text, but it would be a significant change, and I'm getting the impression from
> Warren that he would like to not do that..

More specifically, the enterprise use case should not be further changed
to a more manual problem. In our previous discussions, both with the list
and the Security AD, we made it clear that this is as far as we can go
without destroying the enterprise use case. That is, let the provisioning
provide the list of names for override, give software a chance to warn,
and treat it otherwise as trusted enterprise provisioning. It is up to
the implementations on how or where they would support internal trust
anchors. For example a phone OS could limit this via "enterprise managed"
phone modes only and not allow "emailed profiles" to have these trust

>> Have you ever installed a Configuration Profile on iOS device? If your profile contains a VPN profile which contains a PkCS12 it will warn (entity installing this
>> can monitor all your traffic) and show you the root CA.
> Yes.   That's a very bad UI flow.   It means that I can just hand you a configuration profile to install, and you can install it easily.   And you will install it—you're
> installing it because you want to get something, and when you're presented with "ok" or "cancel," it's going to be very clear to you that "ok" will get you whatever it
> is that you want, and "cancel" will not get you what you want.   So even offering the user this choice has created a gigantic attack surface..   I think of UIs like this
> as "social engineering enablement UIs."

Well, this is where rubber meets the road. There is nothing I can come
up with that will be rejected by the people who want to see dancing
hamsters or playful kittens. An enterprise can hand out phones that
are restricted with respect to provisioning and they can control it
as they see fit. If such an enterprise wants to support BYOD, they
can choose to forbid these trust anchors on those phones and/or
limit those VPN connections in other ways.

If you let random internet companies install profiles with various
kinds of super powers, no RFC in the world will stop them.


>       The idea of the text is that this can be similarly done and warning you about the domains whitelisted. That would help if it suddenly lists or
> I believe this adds value and is better than not presenting the whitelist. Ignorant users will just click click click regardless and knowledgeable
>       users can go “wait a minute”
> I assume that knowledgable users will do the right thing if given the right information; often these dialogs do not actually give the right information.   But it's the
> ignorant users I actually care about, because there are probably three or four orders of magnitude more of them.   As a knowledgable user, UIs like this actually create
> a lot of stress for me, because they never actually tell me what they're going to do, and yet I know that if they are doing something other than what I hope they are
> doing, clicking "yes" will create a new attack surface on my device.   So I usually click "no," even though it's probably okay to click "yes."   If we want devices to be
> more secure, we have to come up with UI flows that get the user what they need without forcing them to choose between "win and get hacked" and "lose and don't get
> hacked."