Re: [Doh] some privacy ponderings wrt HTTPs and plain DNS

[Petr Špaček <[e-mail]>]

On 18.6.2018 18:00, Star Brilliant wrote:
>> * Do not allow the DoH server to set cookies
> 
> Do you know RFC7873? Yes, there is already a Cookie system for traditional DNS protocol. And many public DNS services are already using it to protect against DDoS attack.

It is very important to note that DNS cookies are, unlike HTTP cookies, 
designed to just verify IP addresses and nothing else.

I.e. an properly implemented DNS cookies will change once client's IP 
address changes so DNS cookies cannot be used to track client who is 
moving across different networks. This is very different property when 
compared to traditional HTTP cookies which easily facilitate tracking.

> Additionally, since DoH protocol usually relies on Keep-Alive connections (otherwise it would be painfully slow), a single connection usually correspond to a single user or a single group of users, isn't it?
> 
> Similar to RFC7873 Cookie, HTTP Cookie also serves as a tool to defend servers from DDoS attacks, and is already widely adapted by many leading CDN providers.
> 
> My suggestions is to give the user an option to disable Cookies, or limit Cookies to a very short lifetime (e.g. 2 minutes).

Wouldn't it cause all the DDoS mitigations work only for two minutes?

-- 
Petr Špaček  @  CZ.NIC