Re: [Doh] Mozilla's plans re: DoH

Stephen Farrell <stephen.farrell@cs.tcd.ie> Thu, 28 March 2019 09:12 UTC

Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: doh@ietfa.amsl.com
Delivered-To: doh@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DC3012014E for <doh@ietfa.amsl.com>; Thu, 28 Mar 2019 02:12:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.3
X-Spam-Level:
X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IOGuvpmsjD_f for <doh@ietfa.amsl.com>; Thu, 28 Mar 2019 02:11:58 -0700 (PDT)
Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74F141200FB for <doh@ietf.org>; Thu, 28 Mar 2019 02:11:57 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 543C6BEFF; Thu, 28 Mar 2019 09:11:54 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie
Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6LOWNG3NU3aw; Thu, 28 Mar 2019 09:11:52 +0000 (GMT)
Received: from [31.133.128.194] (dhcp-80c2.meeting.ietf.org [31.133.128.194]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id E3DD9BEFC; Thu, 28 Mar 2019 09:11:51 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1553764312; bh=VAtNApL1NmgvjiczqsR79CIu083lXWkt4zrknQSMQb8=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=Gnfr2I4djTctV95LRpi+ysIuKnaJeQsxuUo0Clrh150Ay00amFA+vqELsn25/rKSE LVHokK2wHwIBPPiSPjKrRdMzQwykSQFaLXgdh3SOJeDRFWwvqX7ZSvWhq9lFR+sKF/ 3+SL/ZmVMFgcd+QWNODchXVF7SJG7nT3Rq/B/XyA=
To: Brian Dickson <brian.peter.dickson@gmail.com>
Cc: DoH WG <doh@ietf.org>
References: <CABcZeBOk5bM+3G2Jd3Lu33Z08gc=AeoZ8UFHzN6AYk4f_hjZ8Q@mail.gmail.com> <CABcZeBPUh6x=D+GfKg11+4bRouZdm1LcZvLm1jd4UUEJA832BQ@mail.gmail.com> <alpine.DEB.2.20.1903271629430.13313@grey.csi.cam.ac.uk> <CABcZeBOv0S8gHMYejhGkSncB4kX7KVFiYP3bHPLimdZ==epQQg@mail.gmail.com> <CAH1iCiqPJK=QAVvNufhGJ=uq2d9Znh2puau9GnQukw8vbiu3Ww@mail.gmail.com> <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> <CAH1iCiqEqbVDcaGtC+EzwiHFsFptKbvQMxg34UMO0CojWRb_mA@mail.gmail.com> <24f0d96b-c6e3-97b8-7ead-b1853b4171f6@cs.tcd.ie> <CAH1iCipkTKDt+3JkJ+7dzC3Gd1N1ZheoJGbu30R8-YJh7L8b_w@mail.gmail.com>
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url=
Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw==
Message-ID: <997e33da-1e84-c263-f1b5-7aea2a3cf5a0@cs.tcd.ie>
Date: Thu, 28 Mar 2019 09:11:50 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1
MIME-Version: 1.0
In-Reply-To: <CAH1iCipkTKDt+3JkJ+7dzC3Gd1N1ZheoJGbu30R8-YJh7L8b_w@mail.gmail.com>
Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="t06H3NIHErxhawPdAweE37MEUC8YxzgEE"
Archived-At: <https://mailarchive.ietf.org/arch/msg/doh/Y8SumSUhrrAJQJEPODWBUfuif4I>
Subject: Re: [Doh] Mozilla's plans re: DoH
X-BeenThere: doh@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DNS Over HTTPS <doh.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/doh>, <mailto:doh-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/doh/>
List-Post: <mailto:doh@ietf.org>
List-Help: <mailto:doh-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/doh>, <mailto:doh-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 28 Mar 2019 09:12:02 -0000

Hiya,

On 28/03/2019 08:26, Brian Dickson wrote:
> On Wed, Mar 27, 2019 at 11:46 PM Stephen Farrell <stephen.farrell@cs.tcd.ie>
> wrote:
> 
>> I won't, sorry. I don't accept your proposed dichotomy as valid.
>>
> 
> I would like to point out the consequences of your position.

I don't believe answers to your questions below reflect any
consequences of my position that use of the term dissident
in this discussion isn't a good plan. But happy to answer...

> First question:
> Consider the two following URIs, for use by a DoH client (e.g. in a
> configured template):
> 
> https://some-resolver.example.com/dns-query
> https://some-resolver.example.com:<NEW_PORT>/dns-query
> 
> (replace <NEW_PORT> with a dedicated-to-DoH port number assigned by IANA)
> 
> Let's presume the only server-side difference involved is the port the DoH
> server listens to.
> i.e. the DoH server listens only on 443, vs the DoH server listens on both
> 443 and NEW_PORT.
> 
> Would you consider those two URIs to be "the same technology"?

Yes.

> 
> Second question:
> Consider the two following models for end-user access to DoH from within an
> enterprise network.
> 
>    1. Escalation model: The user attempts to contact the DoH server via
>    NEW_PORT.
>       -  If the user is unable to reach the DoH server over NEW_PORT, the
>       user is given two options:
>          - Don't use that specific DoH server (sub options: pick another
>          DoH server, pick a DoT server, pick a Do53 server, don't
> connect to the
>          network)
>          - Make an informed (e.g. warnings and explicit user acceptance)
>          choice to reach DoH over 443. This may have personal
> consequences for the
>          user if DoH443 is prohibited and detected.
>             - One possible version of this is that the browser facilitates
>             a per-user, opt-in configuration, of always doing the
> escalation without
>             further prompting.
>             - Another possible variation is that the browser facilitates a
>             per-user, opt-in configuration, of bypassing the NEW_PORT
> attempt. This is
>             still distinguished from the "Blind Model" in that it is
> opt-in, and that
>             the user makes a specific informed choice.
>          2. Blind model: No assessment of network posture regarding DoH is
>    attempted. User contacts DoH on port 443.
> 
> What are you saying about model 1?
> Are you rejecting it out-of-hand? I
> f you are, have you considered the consequences to users?

I have rejected nothing, neither in nor out of hand;-)

I'd disagree with aspects of what you describe as model 1, e.g.
"the user is given two options" seems overly prescriptive and
we all know (I hope) that terms like "informed choice" seem to
mean very different things to different people involved in this
discussion.

Anyway, allocating a new port for use of DoH seems like it's
worth exploring, but I don't know if it'd work or not. (And I
don't control any browser, nor recursive s/w, so am not really
the right person to chat with for that anyway.)

Fixating now on a new port as the-one-right-answer also seems
unwise to me, given there are multiple dimensions to this overall
topic.

> P.S. Sorry about the confusion caused by your MUA. You might want to report
> that to the vendor as a bug.

Thanks for the sympathy but my MUA is just fine in that respect;-)
There are no quotes around the word dissident visible at [1] either,
so I just didn't misquote you at all.

Cheers,
S.

[1] https://mailarchive.ietf.org/arch/msg/doh/wE-FqNjC67oyl_ZXKrHKClSqHVo