Re: [Doh] Privacy Considerations Text (#2)

[Patrick McManus <[e-mail]>]

Hi Sara,


+ ### DNS Specific considerations
> +
> + Whilst DNS transports will generally carry the same privacy properties
> of the
> + layers used to implement them the standard DNS wireformat itself notably
> + contains no client identifiers.
>

That's mostly true imo (modulo perhaps edns client subnet)

Using HTTPS as a transport therefore introduces
> + new privacy concerns over DNS over UDP, TCP or TLS (RFC7858) with regard
> to
> + additional data that may be visible to a DoH server compared to a DNS
> resolver.
>
>
I do agree that HTTP adds additional considerations, which is what the
existing text describes. But I don't agree with this sentence which,
significantly through the use of therefore, indicates HTTPS has client
identifiers and other transports do not.

The previous several paragraphs have enumerated client identifiers also
present in IP (therefore UDP), TCP, and TLS. Everything that transports
wireformat.

What if, instead, we add a new first paragraph to the "In the server"
section along the lines of

"The original DNS wireformat contains no client identifiers, however
various transports of the DNS wireformat do provide data that can be used
for request correlation. HTTPS presents new considerations for correlation
ranging from explicit HTTP cookies to implicit fingerprinting of the unique
set and ordering of request headers."



> + ### HTTP Specific considerations (#HTTPconsiderations)
>
>
I think this is largely what the paragraph that begins "The DoH protocol
design allows applications to fully leverage.." is conveying. Maybe it can
move towards what you are thinking.. wdyt of:


The DoH protocol design allows applications to fully leverage the HTTP
ecosystem, including features not enumerated here. Utilizing the full
set of HTTP features enables DoH to be more than an HTTP tunnel, but
also opens implementations up to the full set of privacy
considerations of HTTP.

Implementations of DoH clients and servers need to consider the
benefit and privacy impact of these features, and their deployment
context, when deciding whether or not to enable them. Implementations
are advised to expose the minimal set of data needed to achieve the desired
feature set.