Subject: [Add] draft-pauly-dprive-oblivious-doh

From: Eliot Lear <[email-masked]>
Date: Mon, 1 Nov 2021 08:53:03 +0100

Just for the record, I think this draft leads to a situation where 
miscreants can hide their tracks.  Section 10.1 of that document is... 
weak.  This has the potential to leave web sites unable to determine who 
is attacking them, and also prevents service providers from backtracing 
such attacks.

This demonstrates precisely why an appropriately strong applicability 
statement is necessary in any ADD output.

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 1 Nov 2021 06:11:33 -0700

such attacks.

Huh?  If someone is attacking the Web site, they will need to actually send
packets
to the site, which will either (1) contain their IP or (2) will be proxied.
In the former
ase, they can determine who is attacking them and in the latter case, they
can
proxy the DNS requests through the proxy and don't need ODoH, which is
primarily
a performance improvement over generic proxying.

-Ekr

---

From: Tommy Pauly <[email-masked]>
Date: Mon, 01 Nov 2021 07:37:45 -0700

As Ekr says, Oblivious DoH is about a DoH server choosing to be accessible through a proxied setup so that the DoH server is not exposed to direct client IP addresses. This limits the ability of a public DNS server to collect information about clients, and makes it harder to provide targeted responses that can be used for fingerprinting.

ODoH doesn’t in any way affect the connections that a client will make to a web site, in either how the server or the network views the end to end IP connection traffic.

Tommy

> On Nov 1, 2021, at 6:11 AM, Eric Rescorla <[email-masked]> wrote:
> 
> On Mon, Nov 1, 2021 at 12:53 AM Eliot Lear <[email-masked] <mailto:[email-masked]>> wrote:
> Huh?  If someone is attacking the Web site, they will need to actually send packets
> to the site, which will either (1) contain their IP or (2) will be proxied. In the former
> ase, they can determine who is attacking them and in the latter case, they can
> proxy the DNS requests through the proxy and don't need ODoH, which is primarily
> -- 
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add