Re: [Doh] [EXTERNAL] Re: Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh

["Winfield, Alister" <[e-mail]>]

I happen to find it harder to trust a company where there is no contract and the company is not operating under local laws that I know and understand. Others with less trust of local laws, regulations and governments would feel rather differently. At work I'll take the local resolvers over everything else because I know they will do what they can to avoid malware inside the network (eg blocking C&C domains).

So can we be more nuanced in the meaning of trusted and accept both viewpoints.

This exchange is why I think the whole area is missing concepts:

a) Defining trust and privacy in general terms. The BCP draft has some of this but it's likely that there is more to do to cover every angle.
b) Somehow securely advertising what types of trust and privacy your resolver is built to provide. Here we are very light and it could be built into the discovery mechanism or perhaps not ?
c) Auditing and its related actions on failure to uphold promises made in (b). Here be dragons, the problem is avoiding a central authority that charges and allowing anyone to setup a DNS TRR perhaps akin to self-signed certs in the way that the client can handle 'trust'. Perhaps a notary solution is better in that it allows a user to define who they trust and that trusted entity can then accept or deny resolvers.

Remember, the autodetection concept is for those where using local DNS is a non-issue or is required. Yes for those who are more focused on the transport security the way you get that DNS resolver IP is suspect but that is an interesting challenge for the protocols involved (DHCP, PPPoE etc).

--
Alister Winfield.



On 28/01/2019, 08:05, "Doh on behalf of Daniel Stenberg" <[e-mail] on behalf of [e-mail]> wrote:

    On Wed, 23 Jan 2019, Vittorio Bertola wrote:

    > This could be true for you and me, but average users have no idea of what
    > the DNS is - they only make one choice, they pick an *ISP* that they decide
    > to trust.

    I don't know a single ordinary person who selected their ISP based on their
    privacy stance for DNS queries. The people I know pick ISP primarily based on
    availability, price, bandwidth and technology.

    I actually think rather few people trust their ISP, and I think history would
    give them right since so many ISPs have violated their users' privacy and data
    through the years.

    --

      / daniel.haxx.se

    _______________________________________________
    Doh mailing list
    [e-mail]
    https://www.ietf.org/mailman/listinfo/doh
    --------------------------------------------------------------------
    This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by sending them to [e-mail] as attachments. Thank you
    --------------------------------------------------------------------



Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD