Re: [Doh] some privacy ponderings wrt HTTPs and plain DNS

[Benno Overeinder <[e-mail]>]

On 18/06/2018 20:04, Patrick McManus wrote:
> 
> 
> On Mon, Jun 18, 2018 at 12:36 PM, Sara Dickinson <[e-mail]
> <mailto:[e-mail]>> wrote:
> 
>     Thanks for the list… it certainly provides context to understand
>     that HTTP as a substrate brings a significant overhead (as well as
>     all the benefits of such bells and whistles).
> 
>     So I think what I am hearing here is that the use of DoH effectively
>     comes at the price of accepting that additional overhead and all its
>     potential privacy/tracking issues because in practice it is rather
>     impossible and/or impractical to have ‘bare’ DoH that transmits only
>     as much information about the user as, for example, typical
>     DNS-over-TLS?
> 
> 
> 
> more impractical than impossible - at the extreme, you would be building
> a mere tunnel rather than really building an HTTP application. But its
> totally appropriate to highlight that there are various tradeoffs that
> can be made by implementations. e.g. firefox will not accept server
> cookies right now on DoH transactions nor will it allow authentication.
> But, in a different circumstance, a DoH client might want to use
> cookie-drive auth totally reasonably (imagine a subscription based DoH
> service) - so its not something the protocol should prohibit but we can
> mention..

Thank you, I would certainly appreciate some wording about the
consideration (or trade-off) between the various implementation
decisions.  I understand it is difficult to cover all variants, but as
you mention above, one can describe the extremes and how these relate
to, for example, privacy considerations used in the DPRIVE WG RFCs and
Internet drafts.

-- Benno

-- 
Benno J. Overeinder
NLnet Labs
https://www.nlnetlabs.nl/