Subject: [DNSOP] Draft on censorship, and DNS

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 7 Nov 2014 08:39:31 -0800

There is an Internet-Draft "A Survey of Worldwide Censorship
Techniques" draft-hall-censorship-tech-00 which is on the agenda of
the Security Area Open Meeting next week at IETF 91 Honolulu.

I applaud the effort, I've reviewed the DNS part and I find it of low
quality, with sloppy terminology. I sent my remarks to the authors but
may be I was not constructive enough and the good people at DNSOP will
want to do their own review and comment on it? [No venue for
discussion is mentioned in the draft.]

---

From: Alejandro Acosta <[email-masked]>
Date: Sun, 09 Nov 2014 00:09:15 -0430

Hi Stephane,
  Thanks for bringing this up, actually it's a great draft, I was not
aware of it.
  Recently I published a post in my personal blog an article -in
Spanish- called something like: "The bad idea of blocking Internet".
It's about the problem that is left after performing the blocking,
things like if you block one IP address for a certain website and then
this websites changes from IP to another IP, then the ISPs are not
un-blocking the old-IP. If the blocked IP is a shared service or
virtualhosting then many services will be denied, etc, etc. I wonder if
this information should be added to the draft (well, I honestly I don't
think so)

My post in Spanish - original-
http://blog.acostasite.com/2014/10/la-mala-idea-de-bloquear-internet.html

Google translation into English:
https://translate.google.com/translate?sl=es&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fblog.acostasite.com%2F2014%2F10%2Fla-mala-idea-de-bloquear-internet.html&edit-text=

Thanks,

Alejandro,

El 11/7/2014 a las #4, Stephane Bortzmeyer escribió:
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: Danny McPherson <[email-masked]>
Date: Sat, 08 Nov 2014 22:13:42 -0700

> discussion is mentioned in the draft.]

FWIW, there's also some attention given to this topic here (albeit 
expired after IAB consensus and launch to "Community Review"):

https://tools.ietf.org/html/draft-iab-filtering-considerations-06

As well as in SSAC's SAC056:

https://www.icann.org/en/system/files/files/sac-056-en.pdf

-danny

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sat, 8 Nov 2014 19:28:20 -1000

On Sun, Nov 09, 2014 at 12:09:15AM -0430,
 Alejandro Acosta <[email-masked]> wrote 

> Spanish- called something like: "The bad idea of blocking Internet".

On the censorship via DNS, there is also the very good [no, I did not
participate in it] "Report of the AFNIC Scientific Council:
Consquences of DNS-based Internet filtering"

http://www.afnic.fr/en/about-afnic/news/general-news/6584/show/the-afnic-scientific-council-shares-its-report-on-dns-based-internet-filtering.html

---

From: Patrik Fältström <[email-masked]>
Date: Sun, 9 Nov 2014 09:32:08 +0100

> On 9 nov 2014, at 06:13, Danny McPherson <[email-masked]> wrote:
> 

And let me add to this pointed to by Danny also SAC-050 which is a two page document setting a baseline.

<https://www.icann.org/en/system/files/files/sac-050-en.pdf>

Both (SAC-050 and SAC-056) are translated to other UN languages (中文, Français, Español, Русский and العربية).

Please see <https://www.icann.org/resources/pages/documents-2012-02-25-en> for links.

   Patrik

---

From: dikshie <[email-masked]>
Date: Sun, 9 Nov 2014 18:07:55 +0900

Hi,
In Indonesia case:
1.Government asks everyone that MUST use ISPs' DNS servers.
   No third party DNS servers are allowed (for example:  Google's DNS).
   Although I am not sure about the real implementation, ISPs will
redirect DNS request traffic from customers to their DNS servers.

2.ISPs' DNS servers MUST contain blacklist domain names (provided by
government).
   see here: http://trustpositif.kominfo.go.id/   to see domain name blacklists.

Best Regards,

Dikshie Fauzie

---

From: David Conrad <[email-masked]>
Date: Sun, 9 Nov 2014 09:38:58 -1000

Another argument for DNS-over-443.

I think the slogan "F* it, just put it into the DNS" should probably be modified to:

"F* it, just put it into the DNS over HTTPS"

Sigh.

Regards,
-drc

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 9 Nov 2014 13:35:34 -0800

If you want to do anything useful in counter-censorship then you have to think of using steganography

So don't call it DNS and don't put the parts of the plan designed for counter censorship prominently in the draft

Port 443 is loaded with censorship issues. If you want to get your packets past a censor then any well known port is a red flag.

> On Nov 9, 2014, at 11:38 AM, David Conrad <[email-masked]> wrote:
>

---

From: Paul Vixie <[email-masked]>
Date: Sun, 09 Nov 2014 14:52:27 -0800

> David Conrad <mailto:[email-masked]>
> Sunday, November 09, 2014 11:38 AM

+1.

-- 
Paul Vixie

---

From: hellekin <[email-masked]>
Date: Sun, 09 Nov 2014 20:30:22 -0300

> to think of using steganography
*** If you use steganography, that probably means you're sending secrets
over a cleartext protocol that can then be deep-packet-inspected, if you
pardon me the expression, to discover patterns of steganography.  If
you're not, then you're already using encryption, so your possibilities
to avoid censorship are much larger already.

> 
> Port 443 is loaded with censorship issues.
>
*** It's also loaded with commercial applications, and that means
cryptography.  Censors willing to coerce commerce are usually of a rare
kind.  So far escaping the Great Firewall has been done via well-known
ports as well.  You have to be NSA to decipher live traffic, and only
then when the partner companies use the ciphers they're told to, at
best.  The rest of the time, all you can do it store and hope to crack
sooner or later.  But that's already not about censorship anymore.

I find it actually easier to block little used ports than highly used
ones.  DNS, SMTP, IMAP, HTTP, HTTPS all come with encrypted
applications, at minimum using TLS.  Discriminating port 12345 is
certainly easier than any of these 5 ports IMHO.

==
hk

---

From: Alejandro Acosta <[email-masked]>
Date: Sun, 09 Nov 2014 19:08:54 -0430

Hi Stephane,

> http://www.afnic.fr/en/about-afnic/news/general-news/6584/show/the-afnic-scientific-council-shares-its-report-on-dns-based-internet-filtering.html

  Great doc, recommended reading for everyone. Thanks for pointing it out.