Re: [DNSOP] Draft for dynamic discovery of secure resolvers

[Vladimír Čunát <[e-mail]>]

On 08/21/2018 04:47 PM, Philip Homburg wrote:
>> If I got it well, what you are trying to bypass is your ISP's
>> security filter that prevents you from connecting to malware or to
>> illegal content (e.g. intellectual property violations and the
>> likes). 
> As a user, I think there is little reason to trust an ISP.
>
> If you take a mobile device, do you trust every hotel, bar, etc. where you
> may connect to the wifi? Are they all competent? Are you sure none of them will
> violate your privacy?

Then you have a problem that's not solvable in DNS itself (yet).  That's
what people usually forget to consider.

The hostnames are clear-text in https hanshakes (so far), and it seems
relatively easy to collect those.  So, by tunneling *only* DNS you don't
make it much more difficult for the ISP, and in addition you share the
names with some other party.  That doesn't sound very appealing to me
personally, from privacy point of view at least.  (On the other hand,
big resolvers will have lots of cached answers, etc.)

https://tools.ietf.org/html/draft-rescorla-tls-esni-00

After SNI encryption gets widely deployed, tracking through IP addresses
only will be somewhat harder, so there it will start getting
interesting.  Until then, IMHO you just need to either trust the ISP or
tunnel *all* traffic to somewhere, e.g. via tor or VPN to some trusted
party.

--Vladimir