Re: [Doh] panel discussion on DoH/DoC

[Joseph Lorenzo Hall <[e-mail]>]

On Fri, Feb 8, 2019 at 3:26 AM Shane Kerr <[e-mail]> wrote:

> Joe,
>
> On 07/02/2019 16.33, Joseph Lorenzo Hall wrote:
> > 3\. Software like browsers seem to want to have a list of DOH providers
> > that they can shuffle queries across in order to minimize the raw
> > quantity of queries any given DOH service sees from a given user. Right
> > now the big DOH services all have very very different privacy policies
> > and terms of service making such a list impossible as you'd be comparing
> > apples to oranges (e.g., one second you are talking to CF's 1.1.1.1
> > which a very strong privacy policy and the next minute you are talking
> > to Google's 8.8.8.8 which has a much less strong privacy policy). How
> > should application developers decide which kind of DOH service to build
> > into their offerings? (My own organization, CDT, is going to start an
> > effort in a few months to try and bring DOH providers together to set
> > some baseline "rules of the road" for these kinds of services and we'd
> > love to work with others thinking about the "wild west" of DOH.)
> >
> > ----
> >
> > I'm about to go on leave for a bit (18-Feb up to Prague) but would love
> > to help think through what might make sense here. We did a project last
> > year with VPN providers where we sought to clarify some "rules of the
> > road", so to speak, and ended up basically with a standard questionnaire
> > that providers answered ( https://cdt.org/issue/privacy-data/vpns/ ,
> > https://cdt.org/insight/unedited-answers-signals-of-trustworthy-vpns/ ).
>
> My feeling is that we should avoid any design or recommendations
> involving multiple upstreams.
>
> My reasoning is that I think that trying to direct queries to multiple
> resolvers is going to run the risk of leaking more information than
> protecting it more.
>
> Certainly a naive approach of just sending to a random server won't
> work, as that basically insures that every resolver operator will see
> every user action pretty quickly.
>
> Trying to isolate to specific user actions might make sense - for
> example send all the queries based on visiting a give web site to a
> single resolver operator. That involves some knowledge about what a
> session or other meaningful grouping of privacy is.
>
> Really I tend to think that in the end we'll re-visit the same problems
> that Tor and other obfuscating overlay networks have tried to address,
> and likely end up with similar solutions. I don't think the DNS
> community understands enough about this to start designing protocols at
> the IETF today. Maybe the web community does, as they are (usually)
> closer to the end user?
>
>
Those are great points and I may have taken some liberty with the the
"multiplexing across many DOH providers" statement as I'm not really sure
what browsers want to do, it just seems like having one or a few options is
not ideal. Anyway, I recognize that the work I'm interested in is not
protocol work (as far as I can tell), so I'll stop bugging folks here!
best, Joe