Re: [Doh] [Ext] draft-ietf-doh-resolver-associated-doh-02 comments

[Stephen Farrell <[e-mail]>]

Hiya,

Other bits will resolve themselves in time (which is to say,
I may agree or not but we can do that later:-), but on these
two...

On 20/03/2019 01:03, Paul Hoffman wrote:
>> - Section 7, para 1: that's way too one-sided. DoH could be less
>> privacy-friendly (than say DoT) due to cookies and whatnot.
> The sentence explicitly says "communication privacy", not overall
> privacy, for the very reason you give. I guess that wasn't clear
> enough. 

I don't know that there is actually a discrete and useful
concept of "communication privacy" TBH. Regardless of that,
it'd seem wiser to steer away from such debates if possible,
and it should be easy enough in this case to recognise the
dangers inherent in HTTPs vs DoT. (That being said, I'd be
happy if the kind of "why it's in practice hard to be that
privacy-unfriendly using DoH" text that Martin earlier
implied could be useful were included as well.)

I'll add "However, using a DoH server can also reduce overall
> privacy because both TLS and HTTPS allow for user identification in
> ways that plain Do53 does not."
> 
>> - Section 8: Why diss. DoT? It's not a competition:-)
>
> For many people, it is. 

They are incorrect. Better to not pander to that error.

> That is, people constantly ask why should DoH
> even exist if DoT already exists. This helps explain that.

The current text did not help me at all and I can't see how it
helps anyone really, unless one is willing to accept that:
  "DoT==bad && DoH==good"
(or some such absolutist nonsense), is a sensible proposition.

Cheers,
S.