Re: [Doh] New Privacy Considerations Section Proposal

[Mateusz Jończyk <[e-mail]>]

W dniu 21.06.2018 o 13:41, nusenu pisze:
> 
> 
> Hewitt, Rory:
>> "DoH clients should use the minimal set of data (e.g. headers, cookies) that 
>> can achieve the desired feature set whilst minimizing potentially identifying 
>> information being passed."
> 
> 
> I like this as a start with the following modification:
> should -> SHOULD
> 
> and
> 
> followed by what a minimal example DoH client request looks like and the specific
> advice that Sara gave in her Privacy Consideration section wrt header (specifically UA).
> 
> 
I am afraid that ensuring that the minimal set of data is being used may be
difficult in practice, for example in simpler implementations that do not have
complete control over the stack. For example, it may be non-trivial to disable
TCP Fast Open when using a particular networking library.

Additionally, fulfilling this requirement to the letter would require insight
into the whole protocol stack, which would require much knowledge and expertise.
It should not be assumed that DOH implementers are knowledgeable about TCP Fast
Open or HTTPS session tickets, for example.

What is more, there has been talk about using DOH in JavaScript.

I would rather support the previous text in the PR:

	Implementations of DoH clients and servers need to consider the benefit
	and privacy impact of all these features, and their deployment context,
	when deciding whether or not to enable them.


Greetings,
Mateusz Jończyk