Re: [DNSOP] Concerns around deployment of DNS over HTTPS (DoH)

[Kenji Baheux <[e-mail]>]

On Wed, Mar 13, 2019 at 4:41 PM Paul Vixie <[e-mail]> wrote:

> On Wednesday, 13 March 2019 02:33:14 UTC Kenji Baheux wrote:
> > *(Sincere apologies about the multi-posting but the discussion seems to
> be
> > happening in different places...)*
> >
> >
> > Hi,
> >
> > I'm involved with Chrome's DoH efforts.
> >
> > ...
> >
> > PS: I won't be able to join IETF 104 to discuss this face to face, but I
> > will see if someone from our side can represent us.
>
> thank you for this information. can i request that you offer DoT as a
> solution, not just DoH? they offer the same capabilities of secrecy and
> authenticity, but DoT can be cheaply disabled by the network operator,
> whereas
> a malicious user or app using DoH will be very expensive to detect or
> prevent
> at the network level.
>

I'm not sure I understand in which scenario this would provide user
benefits over DoH.
I'm also not sure why / how a browser could prevent these type of issues
from happening by merely shipping DoT on top of DoH.

If there is a malicious user or app on a network that someone is trying to
protect, isn't the very existence of these players the actual issue that
needs to be addressed?

On the other hand, for the set of use cases that I do understand, the
ability for a network operator (not the admin) to cheaply disable DoT, and
as a result downgrading DNS to vanilla queries, appears to be a significant
downside for end-users. Taken to an extreme, it seems to imply that
shipping DoT is effectively the same as not shipping it.

What am I missing?


>
> vixie
>
>
>

-- 
Kenji BAHEUX
Product Manager - Chrome
Google Japan