Subject: [DNSOP] on the subject of dnse

From: joel jaeggli <[email-masked]>
Date: Thu, 20 Mar 2014 20:31:11 -0700

https://twitter.com/enginonder/status/446819815106576384/photo/1

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 21 Mar 2014 08:11:45 -0400

This was the use case that originally drove the development of OmniBroker.

If we do DNS Encryption right it is going to be very easy for end
users to chose their DNS provider and very hard for the authorities to
block them.

Security is a balance. Going through 8.8.8.8 rather than direct means
that you are leaking privacy sensitive information to Google. But that
is probably less important here than the censorship attack.

On Thu, Mar 20, 2014 at 11:31 PM, joel jaeggli <[email-masked]> wrote:
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

-- 
Website: http://hallambaker.com/

---

From: Paul Vixie <[email-masked]>
Date: Fri, 21 Mar 2014 07:59:09 -0700

> users to chose their DNS provider and very hard for the authorities to

+1.

> is probably less important here than the censorship attack.

noting, google's public claims about not data mining any part of the
8.8.8.8 query flow, are believable. we also now know that the greater
risk is an on-path nation-state MiTM. i think we should solve for the
latter and not worry about the former.

vixie

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 22 Mar 2014 21:17:15 -0400

> latter and not worry about the former.

I didn't want to bring this up earlier for obvious reasons, the
countermeasure that has been deployed is to just block Google DNS as
well.

We have to have a strategy that does not rely on one party to carry
the net. That just makes them a target.