Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients

[nalini elkins <[e-mail]>]

Stephen,

> TLS1.3 will, I expect, noticeably improve security for an awful lot of
enterprises in time.

I am sure you are right.   There is also likely to be quite a bit of pain
ahead for many.  Also,
this is exactly why I propose a neutral observer who might tease out the
nuances.   Or
say something along the lines of "if you do x, you will need to do y".  It
may also be
needed to have subtopics.   And, the pro and con sides could also provide a
writeup.
The write up could also propose transition strategies.

I am trying to make it so that people, including enterprises, can better
decide the merits of the
situation for themselves.

Many people do not have the time, expertise or energy to follow these
discussions which
have gone on for a number of years.  I have also seen assessments of
protocol changes from people
who have "a dog in the hunt" so to speak.  That is, vendors who provide an
assessment which
(shockingly enough) results in their own products (which again shockingly,
cost money) being the best
solution.  There is much hyperbole on all sides of not just the TLS1.3
issue but DoH also.

I compliment the authors of the current drafts on DoH deployment drafts for
good efforts to bring
light to this subject.

Having said that, I would like to see IETF work with a neutral third party,
maybe an academic institution,
or CERT, or someone else help people, including enterprise operators, who
have to make decisions to
implement these protocols and possibly change their architecture
strategies.  Even if we manage to
come to consensus on an IETF draft and create an RFC on DoH deployment,
many enterprises do not
keep up with all RFCs nor do they always have the time to evaluate
everything properly because they
are so busy with the fires of the current day.   I worked for large
enterprises for many years doing network
design and troubleshooting.  I was always extremely busy fighting the
issues of the day.

Enterprises, and many others, do pay attention to what NIST or CERT says.
 Just my 2 cents to try
to find a long term solution to what has been a contentious and exhausting
multi-year set of discussions
for all involved and which seems set to rekindle with DoH.

Nalini

On Tue, Mar 12, 2019 at 5:30 AM Stephen Farrell <[e-mail]>
wrote:

>
> (This distribution list is too scattered and diverse. Be
> great if some AD or someone just picked one list for this.
> In the meantime...)
>
> On 11/03/2019 20:43, nalini elkins wrote:
> >  impact assessment that certain changes such as
> > DoH and TLS1.3 will have on enterprises,
>
> TLS1.3 will, I expect, noticeably improve security for an awful
> lot of enterprises in time.
>
> As for DoH, I wonder has anyone done studies on how split-horizon
> names and access patterns leak today?
>
> I don't recall having read that kind of study. I can imagine
> many ways in which that kind of stuff would leak. I'd be very
> surprised if it never happens. I don't know how often it does.
>
> For names, leaking once is kinda fatal. For access patterns,
> I guess one leak exposes an IP address that's interested in a
> name (e.g. secret-project.example.com) but more would be
> needed for broader access patterns to be exposed to "foreign"
> recursives and/or in-band networks.
>
> ISTM that it is quite possible that enterprises that deploy their
> own DoH services could potentially reduce such leakage and gain
> overall. (I'm assuming here that sensible browser-makers will
> end up providing something that works for browsers running in
> networks with split-horizon setups before those browsers turn
> on DoH as a default at scale.)
>
> Cheers,
> S.
>


-- 
Thanks,
Nalini Elkins
President
Enterprise Data Center Operators
www.e-dco.com