Re: [Doh] [EXTERNAL] Re: [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients

["Winfield, Alister" <[e-mail]>]

MDM is also a red-herring given >90% of devices world-wide aren't managed so anyone talking of MDM riding to the rescue of DoH client configuration is walking around with blinkers on. Even inside company networks there are servers not under MDM; locally developed applications that might in future pull in a DoH resolver; BYOD; visitors; malware and so on. So whatever you think a reasonable solution for client configuration has to start with unmanaged clients. That last one malware is why the corporate response may well be 'MITM' the traffic so we can protect the data, people and systems using our network.

What DoH discovery and presentation looks like is complex issue that will take some discussion. Just one small example, I might want to use the local networks DNS if and only if it provides anti-malware protection and has a reasonable privacy policy but use a static one if not. Or perhaps on a child's device it's okay if there is filtering in place suitable for children.

Alister

On 12/03/2019, 05:43, "dns-privacy on behalf of Konda, Tirumaleswar Reddy" <[e-mail] on behalf of [e-mail]> wrote:

    > -----Original Message-----
    > From: Eliot Lear <[e-mail]>
    > Sent: Monday, March 11, 2019 11:49 PM
    > To: Paul Vixie <[e-mail]>
    > Cc: nalini elkins <[e-mail]>; Konda, Tirumaleswar Reddy
    > <[e-mail]>; [e-mail]; [e-mail];
    > Ackermann, Michael <[e-mail]>; Christian Huitema
    > <[e-mail]>; [e-mail]; Vittorio Bertola
    > <vittorio.bertola=[e-mail]>; Stephen Farrell
    > <[e-mail]>
    > Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients
    >
    > Hi Paul,
    >
    > > On 11 Mar 2019, at 19:12, Paul Vixie <[e-mail]> wrote:
    > >
    > >
    > >
    > > nalini elkins wrote on 2019-03-11 10:26:
    > >> Tiru,
    > >> Thanks for your comments.
    > >> > Enterprise networks are already able to block DoH services,
    > > i wonder if everyone here knows that TLS 1.3 and encrypted headers is
    > going to push a SOCKS agenda onto enterprises that had not previously
    > needed one, and that simply blocking every external endpoint known or
    > tested to support DoH will be the cheaper alternative, even if that makes
    > millions of other endpoints at google, cloudflare, cisco, and ibm unreachable
    > as a side effect?
    >
    > That or it will require a bit more management at the MDM level.  I’m hoping
    > the latter.  And I hope that one output of all of these documents will be a
    > recommendation regarding MDM interfaces.

    I don't think MDM is required to use the DoT/DoH servers provided by the local network.

    -Tiru

    >
    > Eliot
    _______________________________________________
    dns-privacy mailing list
    [e-mail]
    https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fdns-privacy&amp;data=02%7C01%7Calister.winfield%40sky.uk%7Cab5faa933f374ae7b72c08d6a6ada348%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C636879662059337184&amp;sdata=bba3bapIO3ffilylhoIj0x3zVkHYlNC4Gid96Ybx9Xo%3D&amp;reserved=0
    --------------------------------------------------------------------
    This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by sending them to [e-mail] as attachments. Thank you
    --------------------------------------------------------------------



Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD