Subject: [Add] Draft on deployment models for Internet infrastructure

From: Jari Arkko <[email-masked]>
Date: Sun, 17 Nov 2019 11:20:00 +0800

I also wanted to point people to a draft that talks about centralised and 
other deployment models. This draft is about a broader topic than the
DNS, more generally about anything in the Internet infrastructure. But 
it is also applicable for DNS. Comments and other observations are 
again appreciated.

https://tools.ietf.org/html/draft-arkko-arch-infrastructure-centralisation-00

Abstract

   Centralised deployment models for Internet services and Internet
   business consolidation are well-known Internet trends, at least when
   it comes to popular and user-visible service.  This memo discusses
   the impacts of similar trends within the Internet infrastructure, on
   functions such as DNS resolution.

Jari

---

From: Rob Sayre <[email-masked]>
Date: Sat, 16 Nov 2019 19:34:22 -0800

> https://tools.ietf.org/html/draft-arkko-arch-infrastructure-centralisation-00

I've already read this draft, so I hope this response will not be viewed as
reflexive.

The idea that encrypted DNS will result in increased centralization is
unsubstantiated. For example, the way unencrypted DNS traffic enables
centralized surveillance at the network layer is well known even in
pop-science publications:

https://www.wired.com/2013/06/nsa-whistleblower-klein/

Encrypted DNS might change the locations of centralization. That is a
phenomenon that should be carefully studied, imho. It doesn't seem like a
structural weakness, but it could be neutral.

thanks,
Rob

---

From: S Moonesamy <[email-masked]>
Date: Sat, 16 Nov 2019 23:57:09 -0800

Hi Jari,
>it is also applicable for DNS. Comments and other observations are

The current deployments of, for example, DoH, are based on a 
centralized model.  As the draft mentions, that encourages 
centralization of information and with it, control of 
information.  That is at odds with the statement in Section 4.1 of 
RFC 3935, (re.
decentralized control and edge-user empowerment).  The DNS might be 
considered as complex because of jurisdiction.

Commenting about jurisdiction, an IETF Area Director was quoted as 
stating that: "[DoH] will allow journalists in hostile regimes to do 
their jobs more safely, or people in heavily censored countries to 
get access to the truth".  First of all, that is a very narrow 
use-case.  Secondly, the argument of "getting access to the truth" 
sounds very convenient.

Regards,
S. Moonesamy

---

From: Vittorio Bertola <[email-masked]>
Date: Mon, 18 Nov 2019 01:49:57 +0100 (CET)

> Il 17 novembre 2019 08:57 S Moonesamy <[email-masked]> ha scritto:
> 

I still find it weird that people at the IETF challenge jurisdiction and national sovereignty so directly. Whether we like it or not, that concept is what keeps the world together and more or less at peace, granting peoples the right to self-govern. In the end, a good architecture for the DNS would support the ability of each country to make and enforce rules over their citizens' use of it. The opposite, in the end, is only going to replace one jurisdiction with another, which is unacceptable to even the most democratic governments.

-- 
 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked] 
Office @ Via Treviso 12, 10144 Torino, Italy

---

From: Andrew Campling <[email-masked]>
Date: Mon, 18 Nov 2019 01:43:27 +0000

On Sun, Nov 17, 2019 at 03:24 Rob Sayre <[email-masked]> wrote:

> The idea that encrypted DNS will result in increased centralization is unsubstantiated. For
> example, the way unencrypted DNS traffic enables centralized surveillance at the network
> layer is well known even in pop-science publications:

Given the vast difference between the number of DNS resolvers and DoH resolvers, it is inevitable that centralization will occur, especially when Firefox is currently enabling DoH by default in the US with a single default resolver option.  And yes, whilst you can change to a different resolver but many people will lack the subject matter knowledge to do this.  When you then consider non-browser apps doing DoH, I suspect that many don’t/wont bother to even ask the user for their agreement nor let them configure an alternate resolver.

So you have potentially 6-7% of traffic going to a single resolver that may have been spread across 100s of resolvers previously.  How is this not centralization?

In my view, the draft document helpfully sets out the risks posed by centralization, as well as highlighting why such centralization goes against some of the basic design objectives - the paper references RFCs 1958 and 3935 to support this contention.  I believe that the risks posed by centralization do indeed apply to DoH as currently described by RFC8484 and that further work is required in order to address these shortcomings.

Andrew

---

From: Andrew Campling <[email-masked]>
Date: Mon, 18 Nov 2019 01:53:14 +0000

At 07:57 17-11-2019, S Moonesamy <[email-masked]> wrote:

> Commenting about jurisdiction, an IETF Area Director was quoted as stating that: "[DoH] will 
> allow journalists in hostile regimes to do their jobs more safely, or people in heavily censored 
> countries to get access to the truth".  First of all, that is a very narrow use-case.  Secondly, the 
> argument of "getting access to the truth" sounds very convenient.

I agree that the use case is indeed very narrow.  I'd add that better tools are already available to aid dissidents and others that do not impair the use of the web by other large groups (eg children, enterprise users etc) and in any case question the validity of the dissident use case for DoH,  do not believe that it stands up to examination.

Andrew

---

From: Rob Sayre <[email-masked]>
Date: Sun, 17 Nov 2019 18:06:29 -0800

On Sun, Nov 17, 2019 at 5:43 PM Andrew Campling
<[email-masked]> wrote:

> unsubstantiated. For
> Given the vast difference between the number of DNS resolvers and DoH
> resolvers, it is inevitable that centralization will occur, especially when
> Firefox is currently enabling DoH by default in the US with a single
> default resolver option.
>

DNS has been around for 30 years, and DoH for about 1, if that. I'd expect
there to be a difference in number. FWIW, I'm already using Comcast's DoH
trial server.

> And yes, whilst you can change to a different resolver but many people
> will lack the subject matter knowledge to do this.  When you then consider
> non-browser apps doing DoH, I suspect that many don’t/wont bother to even
> ask the user for their agreement nor let them configure an alternate
> resolver.
>

That's true. They already do this.

>
>
> So you have potentially 6-7% of traffic going to a single resolver that
> may have been spread across 100s of resolvers previously.  How is this not
> centralization?
>

Well, that estimate is vastly off even for browsers, since you seem to be
looking at desktop data. Counting mobile, it would be around 4% of browser
usage in the US. And that's only browser traffic...

Even then, lots of seemingly distinct resolvers just point at Google DNS or
other centralized resolvers. The level of decentralization in the current
system is overstated. In any case, my point was that encrypted DNS does not
introduce a new centralized surveillance risk. That just happens in lower
layers right now.

>
>
> In my view, the draft document helpfully sets out the risks posed by
> centralization, as well as highlighting why such centralization goes
> against some of the basic design objectives - the paper references RFCs
> 1958 and 3935 to support this contention.  I believe that the risks posed
> by centralization do indeed apply to DoH as currently described by RFC8484
> and that further work is required in order to address these shortcomings.
>

I think this opinion depends on whether one views DNS as special vs other
traffic. I don't--it's just another protocol.

thanks,
Rob

---

From: Paul Ebersman <[email-masked]>
Date: Mon, 18 Nov 2019 10:08:06 +0800

sm> Commenting about jurisdiction, an IETF Area Director was quoted as
sm> stating that: "[DoH] will allow journalists in hostile regimes to do
sm> their jobs more safely, or people in heavily censored countries to
sm> get access to the truth".  First of all, that is a very narrow
sm> use-case.  Secondly, the argument of "getting access to the truth"
sm> sounds very convenient.

acampling> I agree that the use case is indeed very narrow.  I'd add
acampling> that better tools are already available to aid dissidents and
acampling> others that do not impair the use of the web by other large
acampling> groups (eg children, enterprise users etc) and in any case
acampling> question the validity of the dissident use case for DoH,  do
acampling> not believe that it stands up to examination.

Agreed. Tor/VPN and similar solve the dissident case; DoH is an
insufficient protection against state actors or folks with similar
resources.

---

From: Andrew Campling <[email-masked]>
Date: Mon, 18 Nov 2019 02:11:30 +0000

On Sun, Nov 18, 2019 at 00:50 Vittorio Bertola <[email-masked]>

> I still find it weird that people at the IETF challenge jurisdiction and national sovereignty so directly. 
> Whether we like it or not, that concept is what keeps the world together and more or less at peace, 
> granting peoples the right to self-govern. In the end, a good architecture for the DNS would support 
> the ability of each country to make and enforce rules over their citizens' use of it. The opposite, in 
> the end, is only going to replace one jurisdiction with another, which is unacceptable to even the 
> most democratic governments.

I agree, am concerned at the apparent lack of recognition of the poor reputation that the tech sector has when it comes to matters such as privacy in many parts of the world.  Rather than have a policy of treating the network as an enemy, there is a case for doing this with the end points in order to protect users for badly behaved applications.  

It is inevitable that governments will assert their right to apply national/regional regulation to tech matters - for example, in Europe DNS falls within the scope of both GDPR and ePrivacy, as well as any national regulations.  Organisations that ignore these will face being locked out of large markets Ashwell as facing possible enforcement action.  

Andrew

---

From: Dave Lawrence <[email-masked]>
Date: Sun, 17 Nov 2019 21:49:47 -0500

> and national sovereignty so directly.

You were careful with your words and I appreciate that.  To make it
extra explicit for everyone, please bear in mind that "people at the
IETF" is not equivalent to "the IETF", as should be painfully evident
by the ongoing debates on this list and in other IETF venues.  Even
despite the reference earlier in this thread to one AD's remarks, it
is still one opinion among many.

---

From: Jari Arkko <[email-masked]>
Date: Mon, 18 Nov 2019 11:12:05 +0800

Rob,

The draft attempts to both talk about the centralisation issues standalone, but also (correctly, IMHO) notes that there are sometimes interdependencies between issues. 

My crystal ball sees a future where DNS query traffic is much more encrypted than it is today, and that’s a good thing. But my crystal ball is undecided with respect to whether the DNS system will be hugely centralised — which I would consider as a problem — or more distributed (but perhaps in a different way than today). I think we are at crossroads, and I would very much like to see the distributed future, and that is the reason I’m calling for attention to this issue. I think there are promising directions for this. But it will take work, and it may be that some people’s plans need to change because of that.

Jari

---

From: "Livingood, Jason" <[email-masked]>
Date: Mon, 18 Nov 2019 03:49:44 +0000

> So you have potentially 6-7% of traffic going to a single resolver that may have been spread across 100s of resolvers previously.

[JL] I thought I would share some preliminary stats from our (Comcast) network in the US – ironically using some network gear produced by Nokia, kind sponsors of IETF-106… We’ve just started measuring things so we’re not 100% sure the methodology is correct – so these stats may be totally wrong. ;-) As well, since we’re in the early days of deployment on a global basis it seems likely these stats will change rapidly.

Of all the DoH traffic heading off-net, which is tiny volume compared to Do53:
- Cloudflare & Google comprise 90% of the traffic (simply reflecting Firefox & Chrome client deployments that drive adoption - not surprising to me)
- Some other ones: AdGuard.com, tiar.app, CleanBrowsing, PowerDNS, NextDNS, SecureDNS.eu, Quad9, OpenDNS, AppliedPrivacy.net, DNSWarden

Jason

---

From: Paul Wouters <[email-masked]>
Date: Mon, 18 Nov 2019 01:34:20 -0500 (EST)

> I still find it weird that people at the IETF challenge jurisdiction and national sovereignty so directly. Whether we like it or not, that concept is what keeps the world together and more or less…

What I think is the strength of DNS is its hierarchy. If I trust Canada,
I can use things within .ca. If I don't trust The Netherlands, I can
avoid using .nl. Each TLD has its own sovereignty.

The problem arises when the jurisdiction I'm in is trying to limit the
other jurisdictions I can communicate with. DNS censorship is the way
this is done, and DoH helps avoiding being caught in this.

Paul

---

From: Rob Sayre <[email-masked]>
Date: Sun, 17 Nov 2019 22:46:22 -0800

On Sun, Nov 17, 2019 at 6:49 PM Dave Lawrence <[email-masked]> wrote:

> You were careful with your words and I appreciate that.
>

I'd like to understand the use case better.

Is the idea that some software companies are selling DNS filtering software
to any government, and letting those governments configure the policy?

thanks,
Rob

---

From: Vittorio Bertola <[email-masked]>
Date: Mon, 18 Nov 2019 15:37:52 +0100 (CET)

Il 18 novembre 2019 07:46 Rob Sayre <[email-masked]> ha scritto:

On Sun, Nov 17, 2019 at 6:49 PM Dave Lawrence <
[email-masked]> wrote:

Vittorio Bertola writes:

> I still find it weird that people at the IETF challenge jurisdiction

> and national sovereignty so directly.

Is the idea that some software companies are selling DNS filtering software to any government, and letting those governments configure the policy?

No company is "selling DNS filtering software to any government", for the simple reason that governments do not normally operate end-user DNS resolver platforms.

On the other hand, every DNS operator (either ISP or third party, including Do* operators) has to abide by the laws of its own country, which in many countries mandate blocking of certain domains, with procedures, reasons, objectives and numbers that depend a lot on the specific country. In some cases, operators abide by self-regulatory codes of conduct that would have otherwise been mandated by law, possibly in stricter form.

The objectives of these laws (or deriving court orders, or codes of conduct) may or may not be related to censorship, i.e. blocking access to content for political reasons. In Europe, the most common case is rather blocking access to illegal audiovisual content (Pirate Bay and Rojadirecta above all). Frequently blocked content types also include child sexual abuse material, unlicensed gambling websites and counterfeit shops. I would not call any of this "censorship", though there are people at the IETF that seem to do so (e.g. see this PEARG draft
https://datatracker.ietf.org/doc/draft-irtf-pearg-censorship/ to which I made the same objection - I think it adopts a too broad and vague definition of censorship).

So I find terms like "DNS censorship" not useful, at least if applied to DNS filtering in general, also because law-mandated blocking is not the only use of DNS filtering. Several other uses related instead to network and user security, or to user-requested content blocking; stuff like malware, phishing websites, bots - this has already been explained multiple times.

This is also why there is no such thing as "DNS filtering software"; filtering is simply a feature in more or less any major DNS recursor implementation, for example via RPZ support (see a list here
https://dnsrpz.info/ ). Recursors would simply be useless for professional deployments if they did not have this capability.

Moreover, many of these recursors (including the one developed by my colleagues) are released under free software licenses, which means that we do not "sell" the software, nor we would be able to prevent anyone to use the software for whatever purpose. Of course we sell support, custom development and extensions, which is why we decided, when asked, not to sell DNS-related services to a very big telco located in an authoritarian country just outside of Europe. But we cannot prevent them from downloading and compiling our code, or another free DNS implementation that does the same things - or they could just implement a DNS server themselves, since it is an open protocol.

Finally, I would expect that a likely regulatory response in Europe to DNS recursion moving abroad in mass would be to extend the above legal filtering obligations to global players that operate in Europe, independently from where the service platform is located, as already done for privacy obligations through the GDPR. So the result of all this effort might not be what you expect - in fact, like for the GDPR, some operators might even decide to apply the union of all restrictions to all users.

I hope this clarifies the use case and helps making the discussion more constructive.

--

---

From: S Moonesamy <[email-masked]>
Date: Mon, 18 Nov 2019 12:52:12 -0800

Hi Vittorio,
At 04:49 PM 17-11-2019, Vittorio Bertola wrote:
>and national sovereignty so directly. Whether we like it or not, 
>that concept is what keeps the world together and more or less at 
>peace, granting peoples the right to self-govern. In the end, a good 
>architecture for the DNS would support the ability of each country 
>to make and enforce rules over their citizens' use of it. The 
>opposite, in the end, is only going to replace one jurisdiction with 
>another, which is unacceptable to even the most democratic governments.

I would not disagree with some of the points in the above.

Regards,
S. Moonesamy

---

From: Joe Abley <[email-masked]>
Date: Mon, 18 Nov 2019 16:22:36 -0500

> insufficient protection against state actors or folks with similar

I don't know whether I agree with this or not. This commentary misses
the more general point that if only dissidents use these other
options, it will be obvious to an observer that dissidents are
speaking. Is that ok?

This seems similar to the argument that you only need encryption if
you have something to hide. I thought IETF consensus was different.

The problem with VPNs in general is that naive users (most users) have
no good way to trust their tunnel termination points. There are also
fewer termination points than there are potential users, so this is
another example of centralisation which in general I think is
reasonable to be considered at odds with privacy.

In some sense, tor is a dynamic VPN with source identity protection.
The concentration problem remains.

I don't think this is as simple as some in this thread might suggest.

Joe

---

From: "Glenn Deen" <[email-masked]>
Date: Tue, 19 Nov 2019 06:36:31 +0800

> options, it will be obvious to an observer that dissidents are

I don’t agree with that analysis.   It would require VPN or TOR use to 
be only a tiny portion of network traffic which isn’t true. Both are 
robust and growing.  There is a very healthy and diverse amount of 
network traffic for these today and it’s continuing to grow.

Tor/VPN remains the very best ways to hide if you need and want too.

> you have something to hide. I thought IETF consensus was different.

I don’t think we ever reached consensus on the idea that just throwing 
encryption at something solved the privacy issues.  We did talk about 
the need for solutions to the problem of monitoring, but I thought the 
consensus was that each situation needs analysis, understanding, and 
thought to address.   Encryption may be a tool in some situations, but 
if it’s entirely possible to add encryption but not actually fix the 
monitoring problem you set out to fix.
.

> no good way to trust their tunnel termination points.

That problem is 100% true of DoH and DoT as well.  The surface on that 
issue is unchanged by anything we are discussing here as it’s entirely 
a trust-policy issue and not technical.

> There are also

That’s not entirely accurate.  There are tremendous numbers and 
diversity of VPN endpoints on the network and they are constantly adding 
new ones and removing old ones.

-glenn

---

From: Joe Abley <[email-masked]>
Date: Mon, 18 Nov 2019 17:51:05 -0500

On 18 Nov 2019, at 17:36, Glenn Deen <[email-masked]> wrote:

> I don’t agree with that analysis.

I'm obviously not writing very clearly. My point is that I think the problem deserves more analysis, not that the illustrations of that point I tried to come up with in my e-mail were sufficient.

> I don’t think we ever reached consensus on the idea that just throwing encryption at something solved the privacy issues.

Sure, but that's not actually what I am saying. I'm talking about the idea of encrypting just what needs to be encrypted vs. encrypting everything. There was a groundswell of support for encrypting everything. The prevalence of TLS for HTTP is frequently cited as a great success.

> That problem is 100% true of DoH and DoT as well.

In the sense that I intended that could well be true, except that we have not got as far as designing service discovery mechanisms or specifying the authentication or service description facilities around how those protocols can be deployed, so the door is still somewhat open.

> That’s not entirely accurate.  There are tremendous numbers and diversity of VPN endpoints on the network and they are constantly adding new ones and removing old ones.

I think it's uncontentious to say that the numbers and diversity of endpoints for any VPN (or tor-like network) are definitively less than the number of possible sources of traffic on the Internet. Any routing of traffic through such a network is absolutely a concentration of traffic.

Joe

---

From: "Glenn Deen" <[email-masked]>
Date: Tue, 19 Nov 2019 09:06:47 +0800

On 19 Nov 2019, at 6:51, Joe Abley wrote:

> I'm obviously not writing very clearly. My point is that I think the 
> problem deserves more analysis, not that the illustrations of that 
> point I tried to come up with in my e-mail were sufficient.
>
>> I don’t think we ever reached consensus on the idea that just 
>> throwing encryption at something solved the privacy issues.
>
> Sure, but that's not actually what I am saying. I'm talking about the 
> idea of encrypting just what needs to be encrypted vs. encrypting 
> everything. There was a groundswell of support for encrypting 
> everything. The prevalence of TLS for HTTP is frequently cited as a 
> great success.
>
> In the sense that I intended that could well be true, except that we 
> have not got as far as designing service discovery mechanisms or 
> specifying the authentication or service description facilities around 
> how those protocols can be deployed, so the door is still somewhat 
> open.

While I’m 100% supportive of the work on service discovery mechanisms, 
that’s technical work which I do support being done here.   I would 
still suggest the policy aspects of “who can you trust” will always 
be beyond the scope and ability of an IETF WG to define as it’s a 
subjective evaluation or legal evaluation or regulatory evaluation and 
not a technical one.   I’ll observe that if we can agree on that, it 
will help clear the path forward.

It’s not that I’m saying not to work on protocol features that can 
be used to carry choices, I am saying we keep getting mired in various 
discussions on what people would like to see developed as policy vs how 
would a protocol carry choices.

>> diversity of VPN endpoints on the network and they are constantly 
>> adding new ones and removing old ones.
>
> I think it's uncontentious to say that the numbers and diversity of 
> endpoints for any VPN (or tor-like network) are definitively less than 
> the number of possible sources of traffic on the Internet. Any routing 
> of traffic through such a network is absolutely a concentration of 
> traffic.

This is a great example of a question that leads to policy and not 
technology.     There already are technologies which will let any device 
to act as an endpoint for a VPN or TOR or even other hiding methods such 
as the one that lets any website act as a proxy to any other website.    
  The technology for that has not only been done, but done in a variety 
of flavors.   The choice to deploy or not is a architecture, policy, and 
business choice that is out of scope at the IETF.

Yes there are policy pieces that need someone(else) to work on that 
would use the work in the IETF, but the IETF is not the place to try and 
have such discussions precisely because we don’t have the process, 
people, or practices to come to consensus on them.

I’m suggesting the IETF path forward is to focus only on what work 
product the ABCD WG can produce - things like discovery mechanisms and 
not things that fall into policy.   If it can’t be a practical work 
produce of the WG, it shouldn’t be in the charter beyond identifying 
that there are policy issues that will come in from OUTSIDE of the  
IETF.

Basically I’m advocating for applying a narrow charter on actual 
possible deliverables, that acknowledges there is more in the topic but 
it’s out of scope.

-glenn

---

From: Paul Ebersman <[email-masked]>
Date: Tue, 19 Nov 2019 14:09:14 +0800

ebersman> Agreed. Tor/VPN and similar solve the dissident case; DoH is
ebersman> an insufficient protection against state actors or folks with
ebersman> similar resources.

jabley> The problem with VPNs in general is that naive users (most
jabley> users) have no good way to trust their tunnel termination
jabley> points. There are also fewer termination points than there are
jabley> potential users, so this is another example of centralisation
jabley> which in general I think is reasonable to be considered at odds
jabley> with privacy.

jabley> In some sense, tor is a dynamic VPN with source identity
jabley> protection.  The concentration problem remains.

Tor and VPN certainly have issues also, but DoH (and any other DNS
query/response encryption) is insufficient protection, since the
following web/email/app traffic isn't necessarily encrypted. Other tech
that encrypts everything is still needed.

---

From: Andrew Campling <[email-masked]>
Date: Thu, 21 Nov 2019 07:27:37 +0000

> On 19 November 2019 14:09 Paul Ebersman <[email-masked]> wrote:
>
>> On 19 Nov 2019, at 05:23, Joe Abley wrote: 
>> The problem with VPNs in general is that naive users (most
>> users) have no good way to trust their tunnel termination 
>> points. There are also fewer termination points than there are 
>> potential users, so this is another example of centralisation 
>> which in general I think is reasonable to be considered at odds 
>> with privacy.

Surely the Issue with trust applies to DoH resolvers too?  Possibly more so given apps may opt to use DoH without user knowledge or consent?  The degree of centralization from VPNs is far less of an issue given the many available suppliers, each of which typically has many servers in many countries.  

> Tor and VPN certainly have issues also, but DoH (and any other 
> DNS query/response encryption) is insufficient protection, since 
> the following web/email/app traffic isn't necessarily encrypted. 
> Other tech that encrypts everything is still needed.

Agreed. Also use of VPNs is far more transparent, with the user able to switch it on and off at will, maintaining clarity of when traffic is being routed without having to configure each app individually.  For the dissident use case, such simplicity, clarity and user control seems to me to be of paramount importance.  

Andrew

---

From: Alec Muffett <[email-masked]>
Date: Fri, 22 Nov 2019 00:33:40 +0000

Regards messages like this:

On Thu, 21 Nov 2019 at 07:27, Andrew Campling
<[email-masked]> wrote:
> Surely the Issue with trust applies to DoH resolvers too?  Possibly more
so given apps may opt to use DoH without user knowledge or consent?  The
degree of centralization from VPNs is far less of an issue given the many
available suppliers, each of which typically has many servers in many
countries.

> Agreed. Also use of VPNs is far more transparent, with the user able to
switch it on and off at will, maintaining clarity of when traffic is being
routed without having to configure each app individually.  For the
dissident use case, such simplicity, clarity and user control seems to me
to be of paramount importance.

...and this:

ebersman> Agreed. Tor/VPN and similar solve the dissident case; DoH is an
insufficient protection against state actors or folks with similar
resources.

...these exchanges betray some shocking misconceptions of how information
and network security actually work in the real world.

For instance:

- there is no such thing as "solved" in network security; nor is there any
such thing as "perfect security" - because there's generally a means to
bypass ANY system security, so long as one is willing to spend enough money
on the problem.  Indeed, the deep truth of information security is that is
a cost/benefit war.

- So the "sufficiency" of value of DoH is that it is better than either
Do53 or DoT for some "dissident" (and: normal user) use-cases.  That's all
that DoH needs to be: not "perfect", simply "better, for anti-censorship
purposes, than the extant protocol". It's no more reasonable to say "DoH is
an imperfect, insufficient protection against state actors" than to say
"motorcycle helmets are useless, they're just not adequate to protect you
under combat conditions". The actual question is what your motorcycle
helmet - or DoH - enables you to achieve under your given circumstances,
that you could not do previously.  In combat conditions or otherwise.

- Conversely: anyone who believes that Tor is some magic-wand-waving
panacea for dissidents, is again being presumptuous about dissident needs
in a manner akin to the apocryphal "let them eat cake" of legend*;
motivated nation states can be very successful at blocking access to Tor at
a nation state level, and the only strategy which works in the face of such
is to give the nation state many more and wondrously varied,
"harder-than-average-to-block" protocols to deal with. This will increase
the state's work-factor - it will increase the state's *cost* of censorship.

Similarly, re:

> The problem with VPNs…is that naive users…have no good way to trust their
tunnel termination points. … this is another example of centralisation
which in general I think is reasonable to be considered at odds with
privacy.

...it does not advance our discussion to have statements that contain zero
discussion of whom the user is attempting to be private *from*. Without
clearly stating a "threat model" - the presumptions of what the user will
want to achieve - there can be no meaningful way to judge the value (or
otherwise) of the proposed solution.

I would like to invite other readers ADD to go visit this thread on Twitter:

https://twitter.com/Ammir/status/1196786007225622528
https://twitter.com/Ammir/status/1196798148095725568
https://twitter.com/Ammir/status/1196801992322142208
https://twitter.com/Ammir/status/1196870201121345547
https://twitter.com/Ammir/status/1196897012278595589
https://twitter.com/Ammir/status/1196923749515382784

...which describes that: Tor is being gradually blocked in Iran, that Skype
and Viber are being likewise, and that people in the street are sharing
software of dubious provenance because their own, and that other extant
tools are not sufficiently censorship-resistant. Feel free to read around
the topic, too; lots of people have opined on this list, re: what works and
does not work in state censorship.  Feel free to go check out your
theories, it's a "good" time to do so.

Further down, Andrew writes: "For the dissident use case, such simplicity,
clarity and user control seems to me to be of paramount importance."

Higher than that, higher than all of those "paramount" things is "access" -
because a smartphone which cannot connect is far less useful.

The likes of Skype or Viber, when they hypothetically become DoH-enabled
"Applications Doing DNS", will greatly increase the work factor of the
Iranian government pursuing censorship - and the obvious
"reactionary-tech-nerd" response of "Yes but the Iranian Government will
simply traffic-fingerprint Viber, and block it, so making Viber DoH-enabled
is pointless!" - will yet again miss the point.

The point being: the Iranian Government wouldhave to *do* that.  DoH would
mean that they have to work harder, thereby increasing their cost.

Which is the whole point of the exercise, and anyone who does not expound
from that perspective, is not a security person.

And we still want to give such nation states the ability to turn-off DoH,
upstream? To restrict the ability of Apps to perform their own
name-resolution?

    - alec

* https://en.wikipedia.org/wiki/Let_them_eat_cake

--
http://dropsafe.crypticide.com/aboutalecm

---

From: Vittorio Bertola <[email-masked]>
Date: Fri, 22 Nov 2019 03:11:44 +0100 (CET)

Il 22 novembre 2019 01:33 Alec Muffett <[email-masked]> ha scritto:

- So the "sufficiency" of value of DoH is that it is better than either Do53 or DoT for some "dissident" (and: normal user) use-cases..  That's all that DoH needs to be: not "perfect", simply "better, for anti-censorship purposes, than the extant protocol".

The point IMHO is rather of cost vs benefit. Is this increase in "anti-censorship purposes" worth breaking a ton of stuff and creating disadvantages for many parties, users included, especially when a similar or greater increase can be obtained through Tor/VPN/etc?

And we still want to give such nation states the ability to turn-off DoH, upstream? To restrict the ability of Apps to perform their own name-resolution?

I know that the IETF has taken a formal stance against pervasive monitoring, but I miss the pointer to where IETF has done the same against "censorship" (which, by the way, includes first of all an agreed definition of censorship). Yet this point continues to come up, so the entire discussion would benefit from some clarity once for all: is disempowering "nation states" from regulating Internet content an objective of the IETF, and thus a requirement for work in this area, or not? This would help in not having this argument again and again.

--

---

From: Alec Muffett <[email-masked]>
Date: Fri, 22 Nov 2019 10:59:32 +0000

On Fri, 22 Nov 2019 at 02:11, Vittorio Bertola <
[email-masked]> wrote:

> Do53 or DoT for some "dissident" (and: normal user) use-cases..  That's all
> purposes, than the extant protocol".
>
> The point IMHO is rather of cost vs benefit. Is this increase in
> "anti-censorship purposes" worth breaking a ton of stuff and creating
> disadvantages for many parties, users included, especially when a similar
> or greater increase can be obtained through Tor/VPN/etc?
>

Welcome to China, where installation or possession of "secure" applications
— ie: ones which are secure enough to communicate with "The West" — is
either/both blocked and can get you arrested:

https://twitter.com/RealSexyCyborg/status/1086811226376523777

To assume "awareness" and "capability" of users to assure their own
security, is to create an underclass - a "security peasantry" who are
under-equipped to *either* communicate securely, *or* to lift themselves
out of those circumstances.

"They should just use a VPN" is the modern equivalent of "let them eat
cake".

> I know that the IETF has taken a formal stance against pervasive
> monitoring, but I miss the pointer to where IETF has done the same against
> "censorship" (which, by the way, includes first of all an agreed definition
> of censorship). Yet this point continues to come up, so the entire
> discussion would benefit from some clarity once for all: is disempowering
> "nation states" from regulating Internet content an objective of the IETF,
> and thus a requirement for work in this area, or not? This would help in
> not having this argument again and again.
>

Fortunately, Vittorio, I have an entire essay on that topic.

Go for it:
https://medium.com/@alecmuffett/how-to-help-dissidents-with-technology-lift-all-boats-e6fcb72d0da1

    - alec