Re: [Doh] New Privacy Considerations Section Proposal

[Adam Roach <[e-mail]>]

On 6/21/18 6:22 AM, Howard Chu wrote:
> Adam Roach wrote:
>> [as an individual]
>>
>> I agree with Patrick's analysis here, and think the proposed text 
>> (plus the "minimal set of data" statement below) is likely to serve 
>> the purpose well. In particular, I agree with Patrick that the 
>> various features that have been cited so far each serve a useful 
>> purpose, and that such purposes may have a place in DoH deployments. 
>> Giving implementors a heads up about the privacy trade-offs seems 
>> appropriate. Mandating (MUST or SHOULD) that DoH runs over a minimal 
>> profile of HTTP seems to remove several of the advantages of using 
>> HTTP at all.
>
> That's overstating things. It seems the primary benefit is being able 
> to hide DoH traffic within standard HTTPS traffic, making it more 
> difficult to filter out at firewalls. That benefit remains, even if 
> barebones HTTP requests are used. 

Note that I didn't say "all" or "most" -- I said "several." If all we 
wanted was putting DNS requests over connections that are difficult to 
distinguish from ordinary HTTPS traffic, then we could have 
informatively described the use of HTTP CONNECT to set up RFC 7858 
connections and had a much simpler document.

/a