Re: [Doh] some privacy ponderings wrt HTTPs and plain DNS

[nusenu <[e-mail]>]

>> This is also in-line with the spirit of RFC6973
>> Privacy Considerations for Internet Protocols
>>
>> specifically section 6.1 and 7.1
>> https://tools.ietf.org/html/rfc6973#section-6.1
>> https://tools.ietf.org/html/rfc6973#section-7.1
>>
>> "What identifiers could be omitted or be made less
>> identifying while still fulfilling the protocol's goals?"
>> is always a good question to ask.
> 
> And given that the charter says 
> “The working group will analyze the security and privacy issues that
> could arise from accessing DNS over HTTPS. “

Thanks for citing this, it nails the problem pretty much.
Privacy problems arising from the specific combination of DNS over HTTPS
and their mitigation should be in the scope of the document.

> it suddenly strikes me that this draft doesn’t contain a Privacy Considerations section. I would suggest that one is added to address this issue and offer to help with text on that. 

+1 for a Privacy Consideration section (in fact I was looking for it already).

Given the discussion in this thread:
https://twitter.com/PowerDNS_Bert/status/1008081220603916289

I would also find it helpful to define the threat model (i.e. DoH server is not
necessarily ultimately trusted and data minimization still makes sense even 
if you are trusting the DoH server to learn your DNS queries - or especially because
you give it your queries you don't want to allow him to identify/track DoH clients or link all the
queries to a single DoH client). Queries alone are also potentially enough to identify/link someone.


> On a technical note do we have 2 use cases to deal with?
> - one where dedicated connections are used for DoH (i.e. where only DoH requests are made)
> - one where DoH requests are intermingled on the same connection with existing traffic (which will most likely include headers already identifying the client)

I was thinking about the same problem that would arise from a single connection being used
for DoH server (no cookies) and for "normal" web content (with cookies) requests.
Depending on how a DoH client implement a 'no cookies for DoH servers' protection [1]
it might allow a DoH server to link a cookie to a DoH client if cookie and non-cookie requests
are multiplexed over the same connection.


[1] https://twitter.com/mcmanusducksong/status/1008374832923279360



btw: Is this a typo in the charter?

"This will enable the domain name system to
function over certain paths where existing DNS methods (UDP, TLS [RFC 7857], ..."

RFC 7857 vs. RFC 7858?

-- 
https://twitter.com/nusenu_