Re: [saag] Discovery: can it be solved

[Watson Ladd <[e-mail]>]

On Wed, Nov 17, 2021, 5:14 AM Ted Hardie <[e-mail]> wrote:
>
> Hi David,
>
> On Tue, Nov 16, 2021 at 9:25 PM David Schinazi <[e-mail]> wrote:
>>
>> I don't see any value in standardizing discovery of privacy-related services.
>> When a client device (a user agent, if you will) ships a feature that is
>> marketed at improving user privacy, the vendor makes some promises to its
>> users. For example, it could say "your IP address is hidden from websites".
>> The vendor needs to follow through on that claim, and the way it does that is
>> by using specific proxies that it trusts.
>
>
> Put differently, the need for discovery depends on what claim the folks shipping the feature put forward.  I can imagine claims that work with discovery, like "This software protects from on-the-wire observers collecting your DNS traffic by using any locally available DoH or DoQ services.  It falls back to a globally configured service when no local services are available."  I can imagine claims that do not.

Local services are also unlikely to have the same degree of
independence from adversaries. Would you trust your ISP to delink your
identity from itself?

To be clear I don't think these problems are surmountable. I'm asking
the people who think they do to raise, hold, or fold, rather than make
the same arguments across working groups (often simplifying very
different trust and deployment models).

Sincerely,
Watson Ladd