The problem with DHCP is the client has no way to know whether the DoT/DoH 
server is indeed hosted by the local network or by an attacker. For example, 
consider a network using Quad9/OpenDNS to perform malware filtering but 
attacker spoofs the DHCP response to convey the network is using CloudFlare DNS 
server. Chrome would establish DoH with CloudFlare, and the attack is 
successful. It is also easy for the attacker to get a domain name, and get the 
certificate signed by the CA (domain validate certificate).


I suspect that here is a problem made worse by assuming a single 
all-encompassing list of ‘trusted’ services. Personally I would hope eventually 
to have an administrator set policy on what DoH services to trust. This could 
be simple like only quad9 or more complex set allowing different providers 
depending upon the context. In your example the application would see 
CloudFlare and then refuse to use it.

Alister Winfield
Information in this email including any attachments may be privileged, 
confidential and is intended exclusively for the addressee. The views expressed 
may not be official policy, but the personal views of the originator. If you 
have received it in error, please notify the sender by return e-mail and delete 
it from your system. You should not reproduce, distribute, store, retransmit, 
use or disclose its contents to anyone. Please note we reserve the right to 
monitor all e-mail communication through our internal and external networks. 
SKY and the SKY marks are trademarks of Sky Limited and Sky International AG 
and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited 
(Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 
2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect 
subsidiaries of Sky Limited (Registration No. 2247735). All of the companies 
mentioned in this paragraph are incorporated in England and Wales and share the 
same registered office at Grant Way, Isleworth, Middlesex TW7 5QD
_______________________________________________
dns-privacy mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dns-privacy

Reply via email to