On Wednesday, 13 March 2019 10:20:58 UTC Kenji Baheux wrote: > On Wed, Mar 13, 2019 at 4:41 PM Paul Vixie <[email protected]> wrote: > > ... can i request that you offer DoT as a > > solution, not just DoH? they offer the same capabilities of secrecy and > > authenticity, but DoT can be cheaply disabled by the network operator, > > whereas > > a malicious user or app using DoH will be very expensive to detect or > > prevent > > at the network level. > > I'm not sure I understand in which scenario this would provide user > benefits over DoH.
i plan (speaking as a network operator) to deploy and use DoT, but not DoH. i would like my users to have the benefits DoT offers, since it is an improvement over plain text in some parts of the topology here. > I'm also not sure why / how a browser could prevent these type of issues > from happening by merely shipping DoT on top of DoH. i intend to cooperate with all network operators. when i travel, if DoT fails, i will know that the network operator does not want me to have privacy. i can then make an informed choice about whether to violate that policy, or not. DoH deliberately obfuscates that condition, which is dangerous to me. > If there is a malicious user or app on a network that someone is trying to > protect, isn't the very existence of these players the actual issue that > needs to be addressed? i'll be happy to discuss the ways in which controlled RDNS helps detect such malicious activity, as a valuable contribution to addressing that activity. but i think i err'd in mentioning it here, since as you say, it's not the browser maker's problem. > On the other hand, for the set of use cases that I do understand, the > ability for a network operator (not the admin) to cheaply disable DoT, and > as a result downgrading DNS to vanilla queries, appears to be a significant > downside for end-users. Taken to an extreme, it seems to imply that > shipping DoT is effectively the same as not shipping it. > > What am I missing? encryption and authenticity of DNS transactions has value even when the user and the network operator intend to cooperate. i'm not going to deploy DoH, however, nor use it when i travel. DoT, by working only when the user and the network operator are in cooperation, is a valuable technology for my needs as both an end user and a network operator. thank you very much for your time. vixie _______________________________________________ DNSOP mailing list [email protected] https://www.ietf.org/mailman/listinfo/dnsop
