Re: [Doh] some privacy ponderings wrt HTTPs and plain DNS

[nusenu <[e-mail]>]

> As noted, I don't know if this has a place in the draft, but I'd recommend
> DoH clients to:
> 
> * Set their Agent to 'DoH client', no matter what browser/library
> * Do not pass non-essential HTTP headers (like language)
> * Do not allow the DoH server to set cookies
> * Ponder TLS sessions resumption data settings
> * Think about all other ways in which HTTP can be tracked (HSTS?)
> 
> Thoughts?

Thanks for this, I find it rather important to avoid introducing new data 
collection opportunities (at the resolver) that haven't been there on plain DNS 
and support your recommendations to minimize data exposure.

Ideally all DoH clients look the same from the DoH server perspective.
This this will never be completely the case but we should try to minimize
the DoH client fingerprintability.

I hope the minimization of the DoH client fingerprint becomes a mandatory part
in the document.

This is also in-line with the spirit of RFC6973
Privacy Considerations for Internet Protocols

specifically section 6.1 and 7.1
https://tools.ietf.org/html/rfc6973#section-6.1
https://tools.ietf.org/html/rfc6973#section-7.1

"What identifiers could be omitted or be made less
identifying while still fulfilling the protocol's goals?"
is always a good question to ask.


kind regards,
nusenu


-- 
https://twitter.com/nusenu_