Re: [Doh] Mozilla's plans re: DoH

[Stephen Farrell <[e-mail]>]

Hiya,

On 28/03/2019 08:26, Brian Dickson wrote:
> On Wed, Mar 27, 2019 at 11:46 PM Stephen Farrell <[e-mail]>
> wrote:
> 
>> I won't, sorry. I don't accept your proposed dichotomy as valid.
>>
> 
> I would like to point out the consequences of your position.

I don't believe answers to your questions below reflect any
consequences of my position that use of the term dissident
in this discussion isn't a good plan. But happy to answer...

> First question:
> Consider the two following URIs, for use by a DoH client (e.g. in a
> configured template):
> 
> https://some-resolver.example.com/dns-query
> https://some-resolver.example.com:<NEW_PORT>/dns-query
> 
> (replace <NEW_PORT> with a dedicated-to-DoH port number assigned by IANA)
> 
> Let's presume the only server-side difference involved is the port the DoH
> server listens to.
> i.e. the DoH server listens only on 443, vs the DoH server listens on both
> 443 and NEW_PORT.
> 
> Would you consider those two URIs to be "the same technology"?

Yes.

> 
> Second question:
> Consider the two following models for end-user access to DoH from within an
> enterprise network.
> 
>    1. Escalation model: The user attempts to contact the DoH server via
>    NEW_PORT.
>       -  If the user is unable to reach the DoH server over NEW_PORT, the
>       user is given two options:
>          - Don't use that specific DoH server (sub options: pick another
>          DoH server, pick a DoT server, pick a Do53 server, don't
> connect to the
>          network)
>          - Make an informed (e.g. warnings and explicit user acceptance)
>          choice to reach DoH over 443. This may have personal
> consequences for the
>          user if DoH443 is prohibited and detected.
>             - One possible version of this is that the browser facilitates
>             a per-user, opt-in configuration, of always doing the
> escalation without
>             further prompting.
>             - Another possible variation is that the browser facilitates a
>             per-user, opt-in configuration, of bypassing the NEW_PORT
> attempt. This is
>             still distinguished from the "Blind Model" in that it is
> opt-in, and that
>             the user makes a specific informed choice.
>          2. Blind model: No assessment of network posture regarding DoH is
>    attempted. User contacts DoH on port 443.
> 
> What are you saying about model 1?
> Are you rejecting it out-of-hand? I
> f you are, have you considered the consequences to users?

I have rejected nothing, neither in nor out of hand;-)

I'd disagree with aspects of what you describe as model 1, e.g.
"the user is given two options" seems overly prescriptive and
we all know (I hope) that terms like "informed choice" seem to
mean very different things to different people involved in this
discussion.

Anyway, allocating a new port for use of DoH seems like it's
worth exploring, but I don't know if it'd work or not. (And I
don't control any browser, nor recursive s/w, so am not really
the right person to chat with for that anyway.)

Fixating now on a new port as the-one-right-answer also seems
unwise to me, given there are multiple dimensions to this overall
topic.

> P.S. Sorry about the confusion caused by your MUA. You might want to report
> that to the vendor as a bug.

Thanks for the sympathy but my MUA is just fine in that respect;-)
There are no quotes around the word dissident visible at [1] either,
so I just didn't misquote you at all.

Cheers,
S.

[1] https://mailarchive.ietf.org/arch/msg/doh/wE-FqNjC67oyl_ZXKrHKClSqHVo