Re: [Doh] ..I don't get it (the hate)

I think it’s a correct observation that the majority of end-users are not qualified to make security policy decisions at a fine-grained level.   It’s also the case that frequently end-users do not have the opportunity to make choices that they would make if they were available (e.g., Facebook, but without all the privacy violations).   But I think that’s not the right taxonomy.

I think the actual split is between devices that have to have on-device security policy enforcement, and devices that can’t.   My iPhone is roaming to networks with different policies all the time.   No matter how well-intentioned, the security policy of a particular network cannot protect my iPhone, because my iPhone talks to other networks.

So for devices like iPhones, a network-enforced security policy can only really cause harm: any good that it could have caused is voided by the fact that the network isn’t always there to protect it.

This is okay, because when I chose my iPhone, one of the reasons I chose it was that another entity would enforce a security policy on it that protects it from attack: the manufacturer, in this case Apple.   Apple has made a very deliberate decision to secure the iPhone in such a way that I can, with reasonable although not perfect confidence, trust that it will not be hacked by the network to which it connects.

On the other hand, my WeMo is wide open.   It doesn’t have any real security.   I’m sure we all know of examples of devices for which this is true.   Such devices tend not to move from network to network, and tend not to be seriously hardened against attack.

In order to protect my WeMo from attack, I need the network to strictly control what it communicates with.   This can to some degree be approximated by controlling DNS resolution.  But to be sure that it is controlled, the network also needs to do IP address filtering, and that filter needs to be controlled somehow.

As Eliot has demonstrated, it is possible to use DNS to control the hosts to which a host connects through a firewall, but it’s expensive, and it only works through the firewall.   That’s why we approximate this using DNS.

But if what we care about is controlling what hosts my iPhone connects to using DNS, the DNS resolver the iPhone uses has to be configured on the iPhone, and the connection to it has to be secure.   Controlling it at the network egress simply doesn’t solve that problem.

So when we are thinking about this problem, I think it’s important to be really clear about exactly what problem we are thinking about, and not confuse these two very different use cases and the very different control planes they require to address them.

> On Mar 26, 2019, at 12:31 PM, Joe Abley <jabley@hopcount.ca> wrote:
> 
> On Mar 26, 2019, at 12:15, George Michaelson <ggm@algebras.org> wrote:
> 
>> This is (surely) between me, the browser vendor, and the website? Why
>> does the ISP have any say in this?
> 
> The ISP (or equivalent actor) has the opportunity to have a say today.
> Some deployment models would take this opportunity away.
> 
> I don't believe the concern is for sophisticated users who can make
> informed choices. I can use a tor browser right now that also defeats
> the ISP's opportunity to participate in the resolution process. That's
> not controversial.
> 
> The contentious aspect is, I think, the potential for a majority of
> end-users who are not sophisticated and hence are unable to make
> informed decisions to have this behaviour changed for them.
> 
> It's not the existence of the mechanism, it's the potential scale of
> the deployment.
> 
> 
> Joe
> 
> _______________________________________________
> Doh mailing list
> Doh@ietf.org
> https://www.ietf.org/mailman/listinfo/doh