Re: [Doh] Mozilla's plans re: DoH

Stephen Farrell <stephen.farrell@cs.tcd.ie> Thu, 28 March 2019 11:31 UTC

Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: doh@ietfa.amsl.com
Delivered-To: doh@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70FC11204F3 for <doh@ietfa.amsl.com>; Thu, 28 Mar 2019 04:31:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.3
X-Spam-Level:
X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eeTjdqMuxd79 for <doh@ietfa.amsl.com>; Thu, 28 Mar 2019 04:30:57 -0700 (PDT)
Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A88B1202A1 for <doh@ietf.org>; Thu, 28 Mar 2019 04:29:11 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 17ED4BF15; Thu, 28 Mar 2019 11:29:07 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie
Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bqvrtVb3YyVG; Thu, 28 Mar 2019 11:29:05 +0000 (GMT)
Received: from [31.133.146.21] (dhcp-9215.meeting.ietf.org [31.133.146.21]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id E2449BF0F; Thu, 28 Mar 2019 11:29:04 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1553772545; bh=wMKaX/UVD+2uey7x35AxpkP4LYHzJU/OiAYWIxVfh4Q=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=xq2mfvRQHVaxVxy8zRw8DkVQav/pXV6zwPPedede+EhzpGTA47Lq2aTt/xqcYZcDw ofu8s66DxcogNZNjoxVqhKHU5l67vXhRBP8TTG61NI2X+VWZ7e94Rkn5AEUfKmtgsU kNCeoW9u5/OBxISpJpugPKGfaUCqHP12enel6nE8=
To: Vittorio Bertola <vittorio.bertola=40open-xchange.com@dmarc.ietf.org>
Cc: DoH WG <doh@ietf.org>
References: <CABcZeBOk5bM+3G2Jd3Lu33Z08gc=AeoZ8UFHzN6AYk4f_hjZ8Q@mail.gmail.com> <CABcZeBPUh6x=D+GfKg11+4bRouZdm1LcZvLm1jd4UUEJA832BQ@mail.gmail.com> <alpine.DEB.2.20.1903271629430.13313@grey.csi.cam.ac.uk> <CABcZeBOv0S8gHMYejhGkSncB4kX7KVFiYP3bHPLimdZ==epQQg@mail.gmail.com> <CAH1iCiqPJK=QAVvNufhGJ=uq2d9Znh2puau9GnQukw8vbiu3Ww@mail.gmail.com> <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> <CAH1iCiqEqbVDcaGtC+EzwiHFsFptKbvQMxg34UMO0CojWRb_mA@mail.gmail.com> <24f0d96b-c6e3-97b8-7ead-b1853b4171f6@cs.tcd.ie> <1351299192.23919.1553762643258@appsuite.open-xchange.com>
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url=
Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw==
Message-ID: <2f52bab4-128f-3e38-6d21-54485623a20b@cs.tcd.ie>
Date: Thu, 28 Mar 2019 11:29:03 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1
MIME-Version: 1.0
In-Reply-To: <1351299192.23919.1553762643258@appsuite.open-xchange.com>
Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="GL7EfmseBjuB44D9lJ2HC5jBNX9fzBSzn"
Archived-At: <https://mailarchive.ietf.org/arch/msg/doh/EQukxLOUwGVGrKrFeM9PalesmC4>
Subject: Re: [Doh] Mozilla's plans re: DoH
X-BeenThere: doh@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DNS Over HTTPS <doh.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/doh>, <mailto:doh-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/doh/>
List-Post: <mailto:doh@ietf.org>
List-Help: <mailto:doh-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/doh>, <mailto:doh-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 28 Mar 2019 11:31:14 -0000

Hiya,

On 28/03/2019 08:44, Vittorio Bertola wrote:
> 
>> Il 27 marzo 2019 alle 23.46 Stephen Farrell <
>> stephen.farrell@cs.tcd.ie mailto:stephen.farrell@cs.tcd.ie > ha
>> scritto:
>> 
>> I do not accept the above as a useful distinction for this topic.
>> 
>> Those in the category of your first bullet can only be protected by
>> technology when (essentially) all those in other categories use the
>> same technology. (That said, I could quibble with your text, but
>> won't for now:-)
>> 
>> But, and it's a big but, those whose safety is not at risk
>> (today), also have valid interests to protect, and mechanisms that
>> we have to offer for such protection need to be widely deployed to
>> be effective.
>> 
> The problem is that, in DoH's "obfuscated traffic mode" (is that
> better than "dissident mode"?), 

Better, but still not good:-) I'm not sure we ought think about
different modes of operation at all tbh - that may be assuming
that we're dealing with a single dimension when we're not.

> increased transport privacy for the
> individual (not necessarily increased privacy, but that's a different
> story) is obtained at the expense of network security. 

I'm not sure that conclusion has been established. (It has been
asserted certainly.) What does seem true is that some deployment
models for DoH are inconsistent with use of some current network
security tools. That doesn't mean there's no other way to get the
same benefits, even if it may be disruptive.

> Other tradeoff
> points are possible, giving the user almost the same amount of
> privacy but also more security, so while I find it justified to push
> the tradeoff to the extreme side of privacy when someone's life and
> freedom could be at risk, 

As I've said, I don't think that's a good way to help us analyse
the situation.

> I would prefer a more balanced tradeoff
> point (the one in which DoH traffic is clearly identifiable and can
> be blocked by the network if necessary) in other contexts, at least
> as the default.

It could be that making DoH traffic visible as being DoH traffic
has some role to play, or maybe it won't turn out that way. It is
not at all clear to me though that doing that to enable blocking
DoH traffic would be a useful mechanism - ISTM some applications
(and all malware) would just avoid that.

> More generally, beware that if you build an Internet that is designed
> to work as if everyone on the planet were a dissident in an
> authoritarian country, it is not unlikely that you will then get an
> Internet regulatory and access environment that looks like the one of
> authoritarian countries, even in democratic ones.

+1 to what Adam said.

Cheers,
S.

> 
> Ciao,
> 
> --
> 
> Vittorio Bertola | Head of Policy & Innovation, Open-Xchange 
> vittorio.bertola@open-xchange.com
> mailto:vittorio.bertola@open-xchange.com Office @ Via Treviso 12,
> 10144 Torino, Italy
> 
> 
> _______________________________________________ Doh mailing list 
> Doh@ietf.org https://www.ietf.org/mailman/listinfo/doh
>