Re: [IPsec] Warren Kumari's Discuss on draft-ietf-ipsecme-split-dns-14: (with DISCUSS and COMMENT)

[Michael Richardson <[e-mail]>]

Warren, I see your concern, but I don't think it's much of an in practice.

Warren Kumari <[e-mail]> wrote:
    > Lots of "regular" users use VPNs for access the Internet, either to bypass
    > censorship / content restrictions, or to improve their privacy. These are not

Sadly, very few regular users use IPsec/IKEv2 for this kind of access.
So, really, this comment applies to a vanishing few number of people.
(There are a few:  Openswan is run by at least one big one to provide
IPsec/IKEv2 access, but I note that they provide 5 other protocols as well).

In almost all cases the VPN provider is in control of the software that is
installed on the client system, so they can hijack paypal already.
Few support IPv6 or DNSSEC for the VPN either.  Some are effectively HTTPS
proxies only, so ALG gateways, with HTTPS certificate evaluation done by the
VPN provider.  This is not much of a new threat.


In the remote cases where a user uses IPsec/IKEv2, and configures it
themselves (perhaps from instructions), then they could easily omit the:
  trust-ikev2-internal-dns=true
configuration option.  In the case where they don't configure it themselves,
then DNSSEC would get hijacked at configuration time, does not matter what
the protocol does.

****
Where I think there may be issues is when one has a non-technical consultant
who has an Enterprise-VPN to *two* customers, that the two Enterprises could
arrange to do things to each other via the cross-site scripting via the
consultant.

I think the document does a good job of making it clear that there
are issues the client implementer needs to worry about.
****

But, this seems terribly unlikely since just getting two VPNs installed
(and compatible) and running at the same time is such deep VPN-fu, that it's
like only half the IPsec WG members that could ever make this work anyway.


    > "Any updates to this whitelist of domain names MUST happen via explicit human
    > interaction to prevent invisible installation of trust anchors." Is my auntie
    > really expected (or competent) to understand what "Your VPN provider, TrustVPN
    > wants to whitelist com. Do you want to allow this? [Y/N]" means?

If she managed to install the TrustVPN herself, then I think yes.
Otherwise, she is going to call whomever installed the thing (I guess you),
and ask them.

{I think walled-garden DNS (whether for Enterprise use or IPTV) is security
threatre myself.  IPv6 is here, use it, and stop building coconut networks.}

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-