Re: [dnsoverhttp] [dns-privacy] draft-hoffman-dns-over-https

[Stephen Farrell <[e-mail]>]

Hiya,

Thanks for doing this. I fully support efforts to experiment
with privacy enhancing DNS.

A query and a comment:

- Query: I wonder if it's wise to take the "it's not DNS, it's
an API to DNS" approach? Ubuntu 17.04/systemd-resolved is the
reason I'm asking, as that's now an irritant for me (until I
find the time to ditch it;-)

- I think this approach (and maybe others) has a missing
security consideration, that could be telling were this widely
deployed. IIUC, the same server here can, and is fairly likely
to, offer both DNS and the web over HTTPS. That has some nice
features, but also a downside - such a server is in a position
to choose which DNS entries it forces the client to resolve
and to also answer those queries. A client that then used
those DNS answers in another context (e.g. on another browser
tab, or cached OS-wide) could have bed consequences as it's
fairly easy to convince a browser to navigate to some bad
actor's web site and if that same bad actor could then poison
my DNS cache for any domain of it's choosing, then that is
a real worry. So I wonder if there needs to be some scoping
on the re-use of (non-DNSSEC) answers delivered via this
mechanism.

Cheers,
S.



On 04/05/17 04:36, Paul Hoffman wrote:
> This has a similar filename and title as previous drafts, but we started
> a -00 because the content is different. The discussion should probably
> happen on the https://www.ietf.org/mailman/listinfo/dnsoverhttp mailing
> list for now, but it is our intention to bring this to the DISPATCH WG
> because the draft is more about "foo over HTTP" (which is the purview of
> DISPATCH) than "DNS in private", even though the latter is assured by
> the protocol.
> 
> --Paul Hoffman
> 
> Name:           draft-hoffman-dns-over-https
> Revision:       00
> Title:          DNS Queries over HTTPS
> Document date:  2017-05-03
> Group:          Individual Submission
> Pages:          10
> URL:           
> https://www.ietf.org/internet-drafts/draft-hoffman-dns-over-https-00.txt
> Status:        
> https://datatracker.ietf.org/doc/draft-hoffman-dns-over-https/
> Htmlized:       https://tools.ietf.org/html/draft-hoffman-dns-over-https-00
> Htmlized:      
> https://datatracker.ietf.org/doc/html/draft-hoffman-dns-over-https-00
> 
> 
> Abstract:
>    DNS queries sometimes experience problems with end to end
>    connectivity at times and places where HTTPS flows freely.
> 
>    HTTPS provides the most practical mechanism for reliable end to end
>    communication.  Its use of TLS provides integrity and confidentiality
>    guarantees and its use of HTTP allows it to interoperate with
>    proxies, firewalls, and authentication systems where required for
>    transit.
> 
>    This document describes how to run DNS service over HTTP using
>    https:// URIs.
> 
>    [ This paragraph is to be removed when this document is published as
>    an RFC ] Comments on this draft can be sent to the DNS over HTTP
>    mailing list at https://www.ietf.org/mailman/listinfo/dnsoverhttp .
> 
> _______________________________________________
> dns-privacy mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dns-privacy
>