Re: [Doh] Captive portals (was Re: suggested slides for IETF 104 on draft-reid-doh-operator)

[Stephen Farrell <[e-mail]>]

Hiya,

On 15/03/2019 02:19, Martin Thomson wrote:
> That makes me conclude that captive portals aren't any worse off as a
> result of operating systems or applications choosing to configure
> their own encrypted resolver service.  Given that using DNS for
> captive portals is worse than alternative methods[1], I'd suggest
> that we not concern ourselves with this particular problem.
I think Martin's argument here is convincing.

I'd also note that as a user of stubby (DoT as the system
resolver with my configured choices of recursive), I've
also experienced problems with captive portals that rely
on intercepting DNS, e.g the free wifi in my local airport
does that. The version of stubby I have installed doesn't
have captive portal detection, not sure if that's likely
to be available soon but it'd be a minor improvement.

So basically any encrypted DNS not using the DHCP DNS
as recursive (and possibly also cleartext DNS not using the
DHCP DNS as recursive?) will have an issue, and it's not
a DoH-specific issue.

S.