Subject: [Doh] ISP position re. hardcoded DoH servers

From: David Lamparter <[email-masked]>
Date: Thu, 25 Jul 2019 20:36:57 +0200

Hi all,

it happens to be that I run a small ISP in Germany.  Probably one of the
smallest, but this does give me the advantage that I have no company
politics blocking me from things like sending this mail.

First of all, I'm hoping to implement DoH as soon as possible on our
ISP-side DNS caches.  When that happens depends on the availability of
an open source DoH cache, or maybe a DoH to "classical" converter that
we can stack on top of our existing cache.  We'd throw the DNS queries
into our existing resolver either way, so I'd actually prefer a proxy
over a full cache.

At the same time, I will be working to send an all-users bulletin asking
our users for their opinions regarding blocking any known hardcoded DoH
servers in any application.  Since I know our userbase reasonably well,
I can predict that we will indeed be implementing this.  Since we don't
look at any layer 4 headers, this will take the form of simple IP/Prefix
blackhole routes.

Of course you can try and make this as painful as possible by stacking
the DoH service onto something that users will miss.  Maybe some
well-visited front page.  I have no way to isolate DoH traffic from
other HTTPS traffic, and I wouldn't want it any other way.  But I'll
still block anything you hardcode, on layer 3.

I'm doing this because you do not have informed consent from the users
if you ship a general purpose application with some default DoH server.

(btw: Single-purpose applications (e.g. Video streaming services) are a
different story, nothing wrong with hardcoding an e.g. Netflix DoH
server into the Netflix App.  This is about general-purpose things like
browsers.)

The only way you can get informed consent is to present the user with a
dialog box that asks "Do you want to perform all web name queries
through <Service>?  [Yes] [No]".  If you do that, I'll turn into your
advocate instead of adversary.

And while we're at it, I'd like to point out that a hardcoded DoH in an
application is probably illegal in Germany.  German law prohibits /
invalidates "surprising" clauses (BGB §305c), and I'm reasonably
confident a court will agree that sending all unrelated name lookups to
a DoH server of the browser vendor's choice is surprising.  The only way
to fix that is to make it, well, not a surprise.  Maybe ask your lawyers
before you get the GDPR bill.

(again, Netflix app sending DoH to Netflix: no surprise.  Browser
sending all name queries to some DoH: big surprise.)

(I'm not a lawyer, the above is not legal advice, I'm just pointing out
there might be a legal angle to this too.)

It is what it is.  Sorry about that.

-David

P.S.: I don't believe it is useful to respond to this mail.  There's
nothing technical to be discussed here, only philosophy.

---

From: Ted Lemon <[email-masked]>
Date: Thu, 25 Jul 2019 15:43:37 -0400

I think there is an assumption in the approach you are taking that the threat model is centralized resolvers tracking users in a transparent way. I don’t think it’s really a philosophical question to ask whether this is indeed the threat mode about which users should be concerned. 

Sent from my iPhone

> On Jul 25, 2019, at 2:36 PM, David Lamparter <[email-masked]> wrote:
> 
> Hi all,
> 
> 
> _______________________________________________
> Doh mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/doh

---

From: David Lamparter <[email-masked]>
Date: Thu, 25 Jul 2019 22:12:12 +0200

On Thu, Jul 25, 2019 at 03:43:37PM -0400, Ted Lemon wrote:
> I think there is an assumption in the approach you are taking that the
> threat model is centralized resolvers tracking users in a transparent
> way. I don’t think it’s really a philosophical question to ask whether
> this is indeed the threat mode about which users should be concerned.

Ok, let's get into a discussion about whether it's philosophical or
not...

But, first, just for completeness sake, it's been pointed out to me that
browser vendors tried to clarify that they're putting up a user choice
and there is FUD involved here.  I'm perfectly happy if browsers offer
the users the choice to use some DoH server.  That's informed consent.

To Ted's point, I don't care about how to value the threat model of
centralized resolvers tracking their users.  I'm actually not /that/
worried about the resolver operators doing it out of malice.

The problem is that this ends up creating centrally administered
high-value targets.  This concerns me:
- technically, since instances of the same DoH anycast service are
  likely set up close to identically, and likely to be subject to
  similar security issues
- structurally, since a greater number of users can be compromised, or
  even just lose service, by breaking a smaller number of targets
- philosophically, since one centrally administered / coordinated
  structure is more susceptible to subversion or legal compromise than a
  decentralized one.

We live in the age of headline news on database leaks and privacy
breaches.  Of course we'll all do our best to audit our code and
operational practices and make them as unlikely as possible.  But, sh*t
/will/ hit the fan at some point...  I decided I prefer a few smaller
turds over one big one.

These *are* problems even if people have informed consent.  But, if they
opted to use Gooflare or Netzilla DNS - they made their choice, they got
it.

(And we're back to philosophy, because I do see some merit in the
argument that a few competent people might build more secure and private
DNS than a million incompetent ones.)

Cheers,

-David

---

From: JW λ John Woodworth <[email-masked]>
Date: Thu, 25 Jul 2019 18:19:46 -0400

-------- Original message --------From: David Lamparter <[email-masked]> > Ok, let's get into a discussion about whether it's philosophical> or not...> But, first, just for completeness sake, it's been pointed out to me> that browser vendors tried to clarify that they're putting up a user> choice and there is FUD involved here.  I'm perfectly happy if> browsers offer the users the choice to use some DoH server.> That's informed consent.Agreed.I don't personally have an issue with implementing a new transport mechanism and for the most part the encryption.Actually, as a _user_ I love the encryption aspect of DoT and DoH.  My _personal_ preference would be a local service à la nsswitch to offer some consistency around my UX.However, as that same user, I don't want the proverbial rug pulled out from under me.  Applications that do the unexpected are generally considered buggy or malware (sometimes both?).  In other words -- when it comes to moving my cheese, ask, or for the love of everything sacred -- don't do.2¢,User John