Re: [Doh] panel discussion on DoH/DoC

Heya, I tried to think of a few good questions to the FOSDEM DNS privacy
panel [1] and included the following (forgive what may be a naive
question!):

----

3\. Software like browsers seem to want to have a list of DOH providers
that they can shuffle queries across in order to minimize the raw quantity
of queries any given DOH service sees from a given user. Right now the big
DOH services all have very very different privacy policies and terms of
service making such a list impossible as you'd be comparing apples to
oranges (e.g., one second you are talking to CF's 1.1.1.1 which a very
strong privacy policy and the next minute you are talking to Google's
8.8.8.8 which has a much less strong privacy policy). How should
application developers decide which kind of DOH service to build into their
offerings? (My own organization, CDT, is going to start an effort in a few
months to try and bring DOH providers together to set some baseline "rules
of the road" for these kinds of services and we'd love to work with others
thinking about the "wild west" of DOH.)

----

I'm about to go on leave for a bit (18-Feb up to Prague) but would love to
help think through what might make sense here. We did a project last year
with VPN providers where we sought to clarify some "rules of the road", so
to speak, and ended up basically with a standard questionnaire that
providers answered ( https://cdt.org/issue/privacy-data/vpns/ ,
https://cdt.org/insight/unedited-answers-signals-of-trustworthy-vpns/ ).

best, Joe

[1]:
https://gist.github.com/jpmens/be639dfd798dba2d65fb1c98e209e3f8#gistcomment-2812589

On Thu, Feb 7, 2019 at 9:28 AM Jim Reid <jim@rfc1035.com> wrote:

>
>
> > On 7 Feb 2019, at 14:20, Vittorio Bertola <
> vittorio.bertola@open-xchange.com> wrote:
> >
> > but this looks more like a job for DPRIVE, which has the word "policy"
> in its charter and "Document Best Current Practices for operating DNS
> Privacy services"
>
> OTOH DoH didn’t exist when DPRIVE was created and what was meant then by
> DNS privacy is not quite the same as is meant today.
>
> I think DoH is the better choice. Though there’s enough ambiguity/overlap
> between the WGs that the ADs might need to decide this.
>
> _______________________________________________
> Doh mailing list
> Doh@ietf.org
> https://www.ietf.org/mailman/listinfo/doh
>

-- 
Joseph Lorenzo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE 200, Washington DC 20005-3497
e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

Don't miss out! CDT's Tech Prom is April 10, 2019, at The
Anthem. Please join us: https://cdt.org/annual-dinner/