Re: [Resolverless-dns] Paper on Resolver-less DNS

[Paul Vixie <[e-mail]>]

On Monday, 19 August 2019 16:10:48 UTC Anne Bennett wrote:
...
> AB>> I would think this to be an impossible task;
> 
> PV> this draft in another wg appears to be an attempt at such:
> PV> https://datatracker.ietf.org/doc/draft-sah-resolver-information/
> PV>
> PV> i don't know if it can meet the "reliably detected" threshold though.
> 
> I took a quick look at the above draft; it specifies a method
> for enquiring about "features of a recursive resolver", but
> gives no ideas or guidance as to what such features might
> consist of, aside from a brief sentence fragment in the
> abstract, "such as whether they perform DNSSEC validation or
> are available over transports other than what is defined in
> RFC 1035".

ah. that's my misunderstanding then. i thought "has policy" was one of the assigned 
indicators. it should be.

> It seems to me straightforward to use this mechanism to supply
> the information *that* a resolver applies filtering, but I don't
> see how it could reasonably *describe* the filtering, since
> such a description would essentially almost *be* the filtering.

i would not, and we could not, export that policy. it's often proprietary. only the existence 
of policy, which ought to disable any "app doing DNS" (ADD) from doing DNS, is needed.

> I think your polite assumption that it could be possible for
> resolverless DNS to respect a network operator's policies for
> DNS filtering is, well, polite.  ;-)

the resolverless people are, like the DoH people, noncriminals with good hearts lacking 
only some understanding of how criminals use the internet (and the subset of the 
internet called the web, and the fact that the web is a subset of something). i believe that 
they will write a spec that recommends respect for the choices made by system and 
network operators, and i believe that vendors will implement it that way. 

which means i believe that netflow will continue to be useful in finding malware, because 
it won't follow the rules. (for a great time, find somebody from sony and ask how much 
money they would pay in modern dollars to move to the timeline where they knew about 
north korea the day after they got in.)

> .... which brings us to:
> 
> ES>> we talked about possible privacy drawbacks of resolver-less
> ES>> DNS. However, did we talk about the privacy risks of using a
> ES>> traditional DNS resolver? They can monitor the entire browsing
> ES>> activities of a user and present the real privacy problem.
> 
> PV> DoT (RFC 7858) corrects that privacy problem and is being deployed.
> 
> I dispute the idea that DNS over TLS addresses the privacy
> problem of the resolver operator having access to all of a
> user's DNS queries.

i think our ships are passing in the night. "traditional dns resolver" means one you run on 
your campus, on your LAN, on your hypervisor, on your endpoint. this whole "public DNS" 
bullpucky is entirely non-traditional. 

see also:

https://www.darkreading.com/vulnerabilities---threats/benefits-of-dns-service-locality/a/
d-id/1333088[1] 

> That being said, I think that stating that traditional DNS has the
> "real privacy problem", and implying that resolverless DNS doesn't
> suffer from a similar problem, is disingenuous.

resolverless is questionless. no knowledge of user intent is leaked, only knowledge of 
user probable next steps. this is an important difference, though it's entirely 
noncompelling. my network policy is that i be able to monitor and filter DNS. if that 
means i end up outlawing some web browsers or some web server IP addresses because 
they want to sneak their DNS translations through as questionless unvalidated 
unmonitorable unfilterable assertions of pseudo-fact, then that's the war i'll be in. note, i 
won't choose it, but i won't shirk it either.

> If I ask a question and expect an answer, *someone* has to hear my
> question!  Who would I rather trust: an ISP whose services I pay for,
> or a commercial web site where most likely, I *am* the product?

again, resolverless means there are no questions. so while it's a huge problem for 
internet security unless it respects the existence of filtering by local resolvers and unless 
it respects the same-origin policy, it's a DIFFERENT problem than the one that DoH claims 
to solve using Big Lie techniques.

-- 
Paul

--------
[1] https://www.darkreading.com/vulnerabilities---threats/benefits-of-dns-service-locality/
a/d-id/1333088