Subject: Re: [Add] Not looking at DNS privacy in isolation

From: Andrew Campling <[email-masked]>
Date: Mon, 2 Dec 2019 12:20:58 +0000

On Nov 29, 2019, at 18:19, Tommy Pauly <[email-masked]> wrote:

> Once the contents of queries and SNI values are encrypted, the number of entities along a path that can easily correlate
> cleartext names with client identifiers is reduced.

True, however the counter to this is that, if centralisation of DNS occurs (which I acknowledge is not a necessary result of encrypted DNS but could be, based on some early implementations), then the risks of the data being compromised increase, as outlined in Jari Arkko’s recent paper.  See https://datatracker.ietf.org/doc/draft-arkko-arch-infrastructure-centralisation/  - “Where such centralised points are created, they will eventually fail, or they will be misused through surveillance or legal actions regardless of the best efforts of the Internet community.  The best defense to data leak is to avoid creating that data store to begin with.”

Andrew

---

From: "Livingood, Jason" <[email-masked]>
Date: Mon, 2 Dec 2019 16:37:00 +0000

> To Patrick's point, however, any entity that has a special relationship with the client, either by knowing more identity information or seeing a broader scope of traffic, can perform such a role more effectively. That can be a local network, a VPN resolver, or even a public resolver that can strongly correlate a connection from a client with a connection that has signed into some account, etc.

[JL] Agree. As a minor aside though, I am not sure a special relationship with a client is required in order to have access to additional datasets that enable reidentification to occur. Given how pervasive and foundational tracking is on the web, I suspect there are a great number of parties that are tracking me (whether by name or pseudonymously) but with whom I do not have a relationship. Bottom line for me is that the threat model should include any network along the E2E path, without limitation as to which hop it is. The risk or ease of reidentification, to your & Patrick's point, will vary depending upon what other datasets a particular network operator has access to in any given example.