Subject: [DNSOP] DNS privacy problem statement

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 11 Nov 2013 13:25:16 +0100

This new I-D started in perpass but may be better here. It has two
parts, analyzing the privacy problems with the DNS, and suggesting
possible solutions, some of them not changing the protocol and
therefore may be a possible work item for this group.

http://tools.ietf.org/html/draft-bortzmeyer-perpass-dns-privacy

---

From: Tony Finch <[email-masked]>
Date: Mon, 11 Nov 2013 14:16:44 +0000

> http://tools.ietf.org/html/draft-bortzmeyer-perpass-dns-privacy

Looks good!

Another thing to mention is the risk due to third-party secondary
authoritative servers.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Forties, Cromarty: East, veering southeast, 4 or 5, occasionally 6 at first.
Rough, becoming slight or moderate. Showers, rain at first. Moderate or good,
occasionally poor at first.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 12 Nov 2013 21:53:37 +0100

On Mon, Nov 11, 2013 at 02:16:44PM +0000,
 Tony Finch <[email-masked]> wrote 
 a message of 15 lines which said:

> > draft-bortzmeyer-perpass-dns-privacy
...
> Another thing to mention is the risk due to third-party secondary

While it was not explicitely specified, the idea of this draft is to
document the privacy risks for the end-user (the one perforing DNS
requests). 

Here, if I understand correctly, you talk about the privacy risks for
the holder of a zone who decides to host it (partially or totally) on
name servers she does not control, and which will be able to see the
traffic. Am I correct?

---

From: Tony Finch <[email-masked]>
Date: Wed, 13 Nov 2013 10:17:05 +0000

> name servers she does not control, and which will be able to see the

I was thinking along the lines of the draft's existing discussion of query
privacy. It talks about the root and TLD servers getting (some) view of
users' queries, as well as the authority servers for the domain itself.
But not all these servers are run by the organizations that superficially
might appear to run them. For instance, queries for names in .fr can be
sent to the ISC or SIDN or Netnod as well as nic.fr. This might be a
surprising reduction of privacy for some people, perhaps similarly
surprising to the fact that the root and TLDs see entire queries.

Tony.

---

From: Jim Reid <[email-masked]>
Date: Wed, 13 Nov 2013 10:32:27 +0000

On 13 Nov 2013, at 10:17, Tony Finch <[email-masked]> wrote:

> But not all these servers are run by the organizations that superficially might appear to run them.

That's a non-sequitur. Whenever someone outsources (part of) their DNS service, this usually involves a contract and certain service level commitments. These may well include "management reports" that could well provide access in one way or another to the underlying query data. Some of the better DNS hosting providers have already been doing this for years. Whether a customer chooses to look at that data or use those facilities is another matter of course.

BTW Stephane is well ahead of the rest of us when it comes to the issues of privacy and data protection -- and their second-order effects -- relating to DNS query streams, particularly in a European context.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 13 Nov 2013 11:36:54 +0100

On Wed, Nov 13, 2013 at 10:17:05AM +0000,
 Tony Finch <[email-masked]> wrote 
 a message of 34 lines which said:

> But not all these servers are run by the organizations that
> superficially might appear to run them. For instance, queries for
> names in .fr can be sent to the ISC or SIDN or Netnod as well as
> nic.fr. This might be a surprising reduction of privacy for some
> people,

OK, I get it. Added in the next version of the draft.

Note: .us is entirely hosted in the US. And there are people in the US
who complain when Brazil wants brazilian data to be stored in the
country... <http://www.slate.com/articles/technology/future_tense/2013/10/internet_balkanization_may_be_a_side_effect_of_the_snowden_surveillance.html>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 13 Nov 2013 11:43:10 +0100

On Wed, Nov 13, 2013 at 10:32:27AM +0000,
 Jim Reid <[email-masked]> wrote 
 a message of 16 lines which said:

> Whenever someone outsources (part of) their DNS service, this
> usually involves a contract 

Contracts do not solve everything: let's assume the manager of the
ccTLD .cp outsources one name server to a company in the USA. The
contract clearly states that the contractor MUST NOT send collected
DNS traffic data to anyone but the registry. Now, a FBI agent comes to
the contractor and, invoking the Patriot Act, request the data (with,
of course, a gag order preventing the contractor to warn its
client). What would the contractor do?

> These may well include "management reports" that could well provide
> access in one way or another to the underlying query data. Some of
> the better DNS hosting providers have already been doing this for
> years. Whether a customer chooses to look at that data or use those
> facilities is another matter of course.

The real problem is "reasonable user expectation". Imagine a secondary
name server of .cp hosted in China. Most users of the TLD .cp would be
quite surprised to know that their data is potentially captured there.

> BTW Stephane is well ahead of the rest of us when it comes to the
> issues of privacy and data protection -- and their second-order
> effects -- relating to DNS query streams, particularly in a European
> context.

This work started inside CENTR <https://centr.org/> so I think we
could all thank the CENTR members.

---

From: Jim Reid <[email-masked]>
Date: Wed, 13 Nov 2013 11:30:29 +0000

> client). What would the contractor do?

Decline contracts from customers who have those requirements since they can't meet them. Though those customers will/should be taking their business to companies outside USA^W^Win other jurisdictions anyway. And surely the customer will be obliged to enter contracts that comply with their national law anyway? We have this in Europe already wrt Data Protection: personal data can't be exported to a jurisdiction that does not have an equivalent or better Data Protection regime.

BTW, you seem to be making an assumption that the DNS query data for some domain is "owned" by the domain name holder. I'm not sure that's the case. However we should leave that layer-9+ discussion to the lawyers and keep it well away from the IETF.

> quite surprised to know that their data is potentially captured there.

I'm struggling to see why anyone could have that sort of expectation these days. The vast majority won't even be aware DNS is involved in their use of the interwebs at all. [Or what google, facebook, $CloudProvider, et al is harvesting from their activity.] They send a lookup into the public Internet, have no way of knowing which DNS server answers (or where it is located), or who might be listening in to that traffic. Given the recent Snowden revelations, anyone who is vaguely awake must realise they have next to no expectation of privacy or anonymity whenever they use the Internet or PSTN as supplied by their ISP or telco.

---

From: Tony Finch <[email-masked]>
Date: Wed, 13 Nov 2013 11:55:00 +0000

Jim Reid <[email-masked]> wrote:
>
> I'm struggling to see why anyone could have that sort of expectation these days.

I think this is the "hope / demand" meaning of expect rather than the
"anticipate" meaning. Like when you tell a child that you expect them to
behave well even when you anticipate they will not.

Tony.

---

From: Edward Lewis <[email-masked]>
Date: Wed, 13 Nov 2013 09:12:09 -0500

On Nov 13, 2013, at 5:36, Stephane Bortzmeyer wrote:
> 
> Note: .us is entirely hosted in the US. 

No longer true.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis             
NeuStar                    You can leave a voice message at +1-571-434-5468

Why is it that people who fear government monitoring of social media are
surprised to learn that I avoid contributing to social media?

---

From: "Rose, Scott" <[email-masked]>
Date: Wed, 13 Nov 2013 14:36:13 +0000

I think the document should also include the risk of cache inspection.  An eavesdropper with access to the same recursive cache as the victim can examine the cache to get a picture of the DNS queries the victim(s) performed and when based on the TTL of cached RRsets. While the attacker can't say for sure which user made the query just from the cache contents, it does provide a trail of what DNS queries the user has been making.  This is a bigger risk in open resolvers for a WiFi hotspot, etc. and not that useful with large caches like an ISP. 

There are some early papers on the risks back from 2004 http://cs.unc.edu/~fabian/course_papers/cache_snooping.pdf

Scott

On Nov 11, 2013, at 7:25 AM, Stephane Bortzmeyer wrote:

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

===================================
Scott Rose
NIST
[email-masked]
+1 301-975-8439
Google Voice: +1 571-249-3671
http://www.dnsops.gov/
===================================

---

From: Suzanne Woolf <[email-masked]>
Date: Wed, 13 Nov 2013 11:04:28 -0500

> Decline contracts from customers who have those requirements since they can't meet them. Though those customers will/should be taking their business to companies outside USA^W^Win other jurisdictio…

I'm nervous of any assumption that any jurisdiction won't compromise its Data Protection regime under some conditions. I'd simply assume such contracts can't be reliably kept inside the US or outside, unless I'm sure that the data doesn't exist to be turned over.

IOW-- I know as a USan I can be expected to say this, but other agencies besides the USG spy, and yes, even in places with stronger Data Protection if only because other jurisdictions tend to have "national security" carve-outs in them too. 

I thought one of the features of the "revised threat model" is that not only is metadata more interesting than we knew, it's more available than we knew to a determined adversary, state-sponsored or not. We'd do well to generalize further than to assume US-based government-sponsored threats.

> BTW, you seem to be making an assumption that the DNS query data for some domain is "owned" by the domain name holder. I'm not sure that's the case. However we should leave that layer-9+ discussion…

+1

> I'm struggling to see why anyone could have that sort of expectation these days. The vast majority won't even be aware DNS is involved in their use of the interwebs at all. [Or what google, faceboo…

I'm wary of bringing "user expectation" in here either way, especially as more and more people interact with the interwebs in ways that don't visibly include the DNS at all. I think Jim's right that it's all very vast and mysterious, so the data-gathering that goes on shouldn't surprise even a naive user, but it also feels to many people like such an extension of themselves and their homes that they're shocked by the notion that anything they're doing online could be happening "in" a foreign country or under hostile eyes.

I've already sent some comments privately to Stephane on his draft. I really think this is a useful discussion, and that analyzing DNS in this way is (frustratingly?) typical of the work we have to do on existing protocols if we're serious about responding to the revised threat model for internet privacy. 

There's a lot more discussion on [email-masked], which is archived in the usual way at ietf.org for those who might not want to sign up for the full list experience.

best,
Suzanne

---

From: Patrik Fältström <[email-masked]>
Date: Wed, 13 Nov 2013 19:44:23 +0000

> IOW-- I know as a USan I can be expected to say this, but other agencies besides the USG spy, and yes, even in places with stronger Data Protection if only because other jurisdictions tend to have…

The only thing we can do is to require frameworks around these measures.

See for example this list of rules that Foreign Minister of Sweden published in NY Times early November 2013:

<http://www.regeringen.se/sb/d/7416/a/227782>

I am not saying that is a perfect list (I have my own -- <http://stupid.domain.name/node/1684>), but that is what I claim is a goal that is "reachable".

   Patrik

---

From: Jim Reid <[email-masked]>
Date: Wed, 13 Nov 2013 20:00:41 +0000

On 13 nov 2013, at 16:04, Suzanne Woolf <[email-masked]> wrote:

> IOW-- I know as a USan I can be expected to say this, but other agencies besides the USG spy,

Indeed.

> and yes, even in places with stronger Data Protection if only because other jurisdictions tend to have "national security" carve-outs in them too. 

The bar's usually much lower than that. "Crime prevention" (whatever that might mean) is usually enough to over-rule Data Protection considerations.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 13 Nov 2013 22:43:00 +0100

On Wed, Nov 13, 2013 at 02:36:13PM +0000,
 Rose, Scott <[email-masked]> wrote 
 a message of 34 lines which said:

> I think the document should also include the risk of cache
> inspection. 

I hesitate. For me, giving the amount of privacy violations by the NSA
(and may be by smaller and less-funded other agencies), cache snooping
seems a very small problem. What is the opinion of the group participants?

RIPE Atlas probes users may read this thread about cache snooping by
the Atlas probes
<http://www.ripe.net/ripe/mail/archives/ripe-atlas/2013-October/001075.html>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 13 Nov 2013 22:38:12 +0100

On Wed, Nov 13, 2013 at 11:30:29AM +0000,
 Jim Reid <[email-masked]> wrote 
 a message of 43 lines which said:

> I'm struggling to see why anyone could have that sort of expectation
> these days. The vast majority won't even be aware DNS is involved in
> their use of the interwebs at all. [Or what google, facebook,
> $CloudProvider, et al is harvesting from their activity.] They send
> a lookup into the public Internet, have no way of knowing which DNS
> server answers (or where it is located), or who might be listening
> in to that traffic. 

An important goal of this draft is precisely to document this sort of
issues for people who were not even aware of it. The draft is
obviously IETF-style (not Joe User-style) because my experience in
perpass showed that many IETFers were not aware of these
questions. So, the goal is to enlighten them, then to enlighten a more
general public. Since we are DNS experts (are we?), if it's not our
job to perform this enlightnement, whose job it is?

People who go to the land of churrascos for the ICANN meeting will
notice that ICANN spent a lot of time discussing whois privacy issues
and zero discussing DNS privacy issues.

> Given the recent Snowden revelations, anyone who is vaguely awake
> must realise they have next to no expectation of privacy or
> anonymity whenever they use the Internet or PSTN as supplied by
> their ISP or telco.

That's precisely what we are trying to change, since the Vancouver
meeting. (Yes, I'm an optimistic.)