Re: [Doh] [Ext] Fallback to untrusted DOH servers

I really think you are discussing discovery. The chairs have said that is
out of scope for this draft but they are soliciting proposals for new work
that could include it.

On Mon, Apr 23, 2018, 06:04 Mateusz Jończyk <mat.jonczyk@o2.pl> wrote:

> W dniu 22.04.2018 o 17:15, Paul Hoffman pisze:
> > On Apr 22, 2018, at 6:21 AM, Mateusz Jończyk <mat.jonczyk@o2.pl> wrote:
> >> I think if Your interpretation of DOH is correct, that the text is
> unclear there
> >> and should be clarified.
> >> I would suggest to add the following clarification:
> >>
> >>      A client MAY use an untrustworthy DNS API server as a fallback.
> >
> > This seems horribly dangerous without a clear definition of "fallback".
>
> There was a definition of "fallback" in a modification I proposed several
> mails
> ago, but I removed it for sake of simplicity.
>
> So, I would propose a following addition:
>    A client MAY use an untrustworthy
>    DNS API server as a fallback, for example: when no trustworthy DNS API
>    server is configured, no configured DNS server works or
>    when the trustworthy DNS API server returned NXDOMAIN (and the client
>    checks whether an untrustworthy DNS API server would resolve the
> address in
>    question).
>
>    The client MUST use separate DNS API caches for trustworthy and
> untrustworthy
>    DNS API servers or drop DNS caches when switching from an untrustworthy
>    DNS API server to a trustworthy one.
>
> Ted Lemon suggested in a private e-mail that contacting an untrusworthy
> DNS API
> server after the trustworthy DNS API server returned NXDOMAIN exposes all
> mistyped domains to the untrustworthy DNS API server. This is a valid
> concern,
> and applies equally well to using old-school DNS in such a situation.
>
> I would therefore propose to add the following warning after the phrase:
>         "If a client of this protocol encounters an HTTP error after
> sending a
>         DNS query, and then falls back to a different
>         DNS retrieval mechanism, doing so can weaken the privacy and
>         authenticity expected by the user of the client."
>
>         When a DNS API server returns NXDOMAIN, a client may wish to check
>         whether another server will resolve the domain name (as this may be
>         a local name to be resolved by a local DNS server). Doing so will,
>         however, expose all mistyped domain to that server.
>
>
> >
> >> I am going to submit a draft that specifies how a fallback DNS API
> server could
> >> be retrieved from DHCP.
> >
> > That would be quite useful. If you do that, wouldn't it define the DNS
> API server as trusted?
>
> No, the server retrieved via DHCP is going to an untrustworthy DNS API
> server
> (as defined above) as DHCP is usually unauthenticated and prone to various
> manipulations.
>
> >
> > --Paul Hoffman
> >
>
> Greetings,
> Mateusz Jończyk
> _______________________________________________
> Doh mailing list
> Doh@ietf.org
> https://www.ietf.org/mailman/listinfo/doh
>