IETF Logo Mail Archive

Re: [Doh] [Ext] Seeking input on draft-03

Paul Hoffman <paul.hoffman@icann.org> Thu, 08 February 2018 18:18 UTC

Return-Path: <paul.hoffman@icann.org>
X-Original-To: doh@ietfa.amsl.com
Delivered-To: doh@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CCB4712D80F for <doh@ietfa.amsl.com>; Thu, 8 Feb 2018 10:18:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.21
X-Spam-Level:
X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FLe7IN0xDssc for <doh@ietfa.amsl.com>; Thu, 8 Feb 2018 10:18:18 -0800 (PST)
Received: from out.west.pexch112.icann.org (pfe112-ca-1.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 61BCD1242F7 for <doh@ietf.org>; Thu, 8 Feb 2018 10:18:18 -0800 (PST)
Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Thu, 8 Feb 2018 10:18:16 -0800
Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1178.000; Thu, 8 Feb 2018 10:18:16 -0800
From: Paul Hoffman <paul.hoffman@icann.org>
To: Mike Bishop <mbishop@evequefou.be>
CC: "doh@ietf.org" <doh@ietf.org>
Thread-Topic: [Ext] [Doh] Seeking input on draft-03
Thread-Index: AQHToQg4JPRWKhdW8EC83B7aYTP4NqObVmkA
Date: Thu, 08 Feb 2018 18:18:15 +0000
Message-ID: <914B79D6-A755-4672-BCE5-B63E99E4A71A@icann.org>
References: <CAHbrMsDwWvtcZy8fpg9gs3o+gc_umi9okJW6rvv+s4T7K9-sVQ@mail.gmail.com> <MWHPR08MB2432FFCE097EBBB1279EAC2EDAF30@MWHPR08MB2432.namprd08.prod.outlook.com>
In-Reply-To: <MWHPR08MB2432FFCE097EBBB1279EAC2EDAF30@MWHPR08MB2432.namprd08.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [192.0.32.234]
Content-Type: text/plain; charset="utf-8"
Content-ID: <9CD2B2946D8E16478A00856CD28A14A6@pexch112.icann.org>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/doh/ZUBNy07wzo9i03GWbOzLQLaZTK4>
Subject: Re: [Doh] [Ext] Seeking input on draft-03
X-BeenThere: doh@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: DNS Over HTTPS <doh.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/doh>, <mailto:doh-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/doh/>
List-Post: <mailto:doh@ietf.org>
List-Help: <mailto:doh-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/doh>, <mailto:doh-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 08 Feb 2018 18:18:20 -0000

On Feb 8, 2018, at 10:11 AM, Mike Bishop <mbishop@evequefou.be> wrote:
> I’m inclined to think this is a positive change.  We’re trying to do something better than the current world of “trust the local DNS server because unauthenticated DHCP says so”, and promiscuous trust just because a server claims it support DOH via a .well-known endpoint isn’t really any better.  The client should know the hostname(s) of the DOH server(s) it wants to use, and it should authenticate the DOH server against that hostname.

To be clear: that's not what the current draft says. It says that the client needs to know *the full URL to the DOH service* of the DOH server it wants to use.

The effect of this is that, if a user wants to tell its browser to use DOH on example.com, they need to know the full URL and type it into some config dialog for the browser. Or, possibly worse, browsers that want to enable DOH will have to have a list of popular DOH servers and the URL associated with each server, somewhat akin to the preloaded key pinning we see now; that list would also need to allow the user to extend the list.

Using .well-known/ or some other fixed prefix would make it so that configuring DOH was less onerous for users.

--Paul Hoffman

v2.23.0 | Report a Bug | By Email