Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients

["Konda, Tirumaleswar Reddy" <[e-mail]>]

Please see inline [TR]

From: dns-privacy <[e-mail]> On Behalf Of Neil Cook
Sent: Tuesday, March 12, 2019 5:14 PM
To: Konda, Tirumaleswar Reddy <[e-mail]>
Cc: [e-mail]; Vittorio Bertola <vittorio.bertola=[e-mail]>; [e-mail]; Paul Vixie <[e-mail]>; Christian Huitema <[e-mail]>; nalini elkins <[e-mail]>; [e-mail]; Ackermann, Michael <[e-mail]>; Stephen Farrell <[e-mail]>
Subject: Re: [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients


CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.


________________________________
ISTM that it is quite possible that enterprises that deploy their own DoH
services could potentially reduce such leakage and gain overall. (I'm
assuming here that sensible browser-makers will end up providing
something that works for browsers running in networks with split-horizon
setups before those browsers turn on DoH as a default at scale.)

If Enterprise network provides a DoT/DoH server, browser should be able to discover and use the Enterprise DoT/DoH server.

Well until now there has been no discovery mechanism for DoH servers. There is now draft adopted by the DoH WG that proposes a discovery mechanism. However whether browsers actually use it is another question. Hence the draft by VIttorio.

[TR] Discovery alone will not solve the problem, the DoH client needs to trust the discovered DoH servers (see https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-01).

Cheers,
-Tiru

Neil


On 12 Mar 2019, at 06:14, Konda, Tirumaleswar Reddy <[e-mail]<mailto:[e-mail]>> wrote:

-----Original Message-----
From: Stephen Farrell <[e-mail]<mailto:[e-mail]>>
Sent: Tuesday, March 12, 2019 5:30 AM
To: Paul Vixie <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
Cc: nalini elkins <[e-mail]<mailto:[e-mail]>>; Konda, Tirumaleswar Reddy
<[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>; Ackermann,
Michael <[e-mail]<mailto:[e-mail]>>; Christian Huitema
<[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>; Vittorio Bertola
<vittorio.bertola=[e-mail]<mailto:vittorio.bertola=[e-mail]>>
Subject: Re: [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients


(This distribution list is too scattered and diverse. Be great if some AD or
someone just picked one list for this.
In the meantime...)

On 11/03/2019 20:43, nalini elkins wrote:

impact assessment that certain changes such as DoH and TLS1.3 will
have on enterprises,

TLS1.3 will, I expect, noticeably improve security for an awful lot of
enterprises in time.

As for DoH, I wonder has anyone done studies on how split-horizon names
and access patterns leak today?

I don't recall having read that kind of study. I can imagine many ways in
which that kind of stuff would leak. I'd be very surprised if it never happens.
I don't know how often it does.

For names, leaking once is kinda fatal. For access patterns, I guess one leak
exposes an IP address that's interested in a name (e.g. secret-
project.example.com<http://project.example.com>) but more would be needed for broader access
patterns to be exposed to "foreign"
recursives and/or in-band networks.

ISTM that it is quite possible that enterprises that deploy their own DoH
services could potentially reduce such leakage and gain overall. (I'm
assuming here that sensible browser-makers will end up providing
something that works for browsers running in networks with split-horizon
setups before those browsers turn on DoH as a default at scale.)

If Enterprise network provides a DoT/DoH server, browser should be able to discover and use the Enterprise DoT/DoH server.

-Tiru



Cheers,
S.
_______________________________________________
DNSOP mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/dnsop