Re: [Doh] [Ext] Fallback to untrusted DOH servers

[Mateusz Jończyk <[e-mail]>]

W dniu 15.04.2018 o 21:15, Patrick McManus pisze:
> The document says "must not trust simply because it was discovered".. "only
> trust configured".. and explicitly does not go into configuration.
>
> imo you're reading too much into the text. It's just trying to say an endpoint
> isn't to be trusted just because it speaks DoH and you found it (e.g. becuase
> www.example.com <http://www.example.com> pushed you a DoH request and
> response). Note that it doesn't say "must not use" it says "must not trust".
> Whether or not you would use an untrusted server if you have no trusted
> options is not something that's going to be in scope here.
Hello,
Sorry, but I didn't have time to deal with DOH in the last week.

I think if Your interpretation of DOH is correct, that the text is unclear there
and should be clarified.
I would suggest to add the following clarification:

	A client MAY use an untrustworthy DNS API server as a fallback.

I am going to submit a draft that specifies how a fallback DNS API server could
be retrieved from DHCP.

Greetings,
Mateusz Jończyk

>
> On Sun, Apr 15, 2018 at 1:39 PM, Mateusz Jończyk <[e-mail]
> <mailto:[e-mail]>> wrote:
>
>     W dniu 14.04.2018 o 22:54, Paul Hoffman pisze:
>     > On Apr 14, 2018, at 9:36 AM, Mateusz Jończyk <[e-mail] <mailto:[e-mail]>> wrote:
>     >>
>     >> Hello,
>     >> Current DOH draft specifies that:
>     >>
>     >>   A client MUST
>     >>   NOT trust a DNS API server simply because it was discovered, or
>     >>   because the client was told to trust the DNS API server by an
>     >>   untrusted party.  Instead, a client MUST only trust DNS API server
>     >>   that is configured as trustworthy.
>     >>
>     >> It may happen that either no trustworthy DOH server has been
>     configured, or the
>     >> configured DOH server is not working. In such cases a DOH client would
>     usually
>     >> revert to using an untrusted DNS server on port 53, possibly one that was
>     >> discovered through unsecure DHCP. This DNS resolver would also be able
>     to poison
>     >> DNS caches then.
>     >
>     > The topic of how a user (well, really, an OS or browser) choose a DNS
>     server to use is a worthy one to look at, but not in this document. If
>     someone wants to start such a document, it needs to deal with trust in
>     DHCP, DHCP MITMs, DNS-over-TLS, DNS-over-TLS policy, DOH, and DOH policy.
>     (There are likely additional topics...)
>
>     This draft specifies some limitations on DNS resolvers a client can use.
>     Therefore - I would argue - it is fine to discuss whether these
>     limitations are
>     appropriate and not overbroad.
>
>     >
>     > --Paul Hoffman>
>
>     Greetings,
>     Mateusz Jończyk
>
>     _______________________________________________
>     Doh mailing list
>     [e-mail] <mailto:[e-mail]>
>     https://www.ietf.org/mailman/listinfo/doh
>     <https://www.ietf.org/mailman/listinfo/doh>
>
>