Re: [Doh] New I-D: draft-reid-doh-operator

[Stephane Bortzmeyer <[e-mail]>]

On Sun, Mar 10, 2019 at 03:29:51AM +0000,
 Jim Reid <[e-mail]> wrote 
 a message of 30 lines which said:

> FYI colleagues. The draft below has just been submitted. I've been given 10 minutes of WG agenda time at IETF104.

I'm surprised that it is published more or less at the same time
draft-livingood-doh-implementation-risks-issues. They have a lot of
overlap, and even one author in common. May be a merge would be a good
idea?

> When DoH is used, the customer will probably be dependent on DoH
> servers operated by third parties and have no contractual or
> business relationship with those providers.

Like draft-livingood-doh-implementation-risks-issues, there is a lot
of confusion between DoH-the-protocol and possible deployments of DNS
resolution via a public DNS resolver. The specific issue mentioned
above is exactly the same whether I use DoH or DNS-over-UDP to 8.8.8.8
or 9.9.9.9.

[To be more precise: most of this draft is off-topic for the DoH
WG. If this is asked, I will say No to adoption by the WG.]

> Operators can also be required to perform DNS blocking and filtering
> or rewriting for legal reasons

Sure, but is it IETF's job to make it easier? RFC 2804 and 7754 would
be good references here.

> Typical regulations that could apply include General Data Protection
> Regulation (EU) 2016/679 [GDPR] and the EU-US Privacy Shield
> Framework [USPS]. [...] Logs containing individual DNS queries and
> the IP addresses or other data correlating those queries to specific
> users or homes may in some legal jurisdictions be considered as
> personally identifying information (PII).  In such jurisdictions
> detailed DNS query logs may be subject to data protection and
> retention regulations, or other legal and/or compliance
> requirements.

I'm very glad that people consider the importance of personal data
protection, and the useful role of the GDPR in it. But I fail to see
why it's specific to DoH. For *every* IETF protocol, the two parties
communicating may be in different countries (well, may be not for ND,
ARP and DHCP), and logging by one may infringe the laws of
another. Yet, we don't write drafts on the GDPR risks associated with
each specific protocol.

> Some list or registry of "trusted" DoH servers is probably
> necessary.

Why? I don't see it as necessary or unavoidable and even if it were,
why would it be IETF's business? Do we mention a "list of trusted AC"
in PKIX RFCs?

> DoH has the potential to be more privacy intrusive than ECS, largely
> because DoH is based on HTTP and can leverage the rich per-user and
> per-device tracking that pervades the web today.  The implications
> of that are not yet well understood.

draft-dickinson-doh-dohpe