Subject: [Add] Auditing apps

From: "STARK, BARBARA H" <[email-masked]>
Date: Wed, 7 Aug 2019 17:51:02 +0000

> One of the downsides of encryption is it will be much harder to 
> actually audit the data being sent by applications to resolvers.
> 
> I'm not against encryption, but I'm bothered when things are encrypted 
> for my protection but are also invisible to me.
> 
>   I'm relatively sure there will be researchers who will make the 
> effort to keep the big browser makers honest, but the ability for 
> others apps to add DoH and undisclosed http headers for tracking is likely something we should
> expect to see in the future.   This is a specific worry to DoH since it's over
> http.
> 
> My point is that we shouldn't be complacent here and be too quick to 
> dismiss worries. Instead it would be nice if researchers were engaging 
> now up front to poke at things and explore where the abuse opportunities are.

I'm concerned with this too. Lenovo at one time was shipping laptops with a MS OS and IE browser they had customized to insert a "trusted" certificate that allowed Superfish to break browser encryption and insert ads. They had to stop that (but defended it) because of public backlash [1], but not because there was any rule against it [2]. From what I can see, there is nothing that would prevent a laptop/tablet manufacturer/provider from including a custom browser that is branded and looks just like the non-customized version of the same browser, but uses DoH to send all DNS traffic to the manufacturer's 3rd party partner DoH provider -- complete with lots of headers, cookies, and everything else needed to thoroughly track a user. This doesn't even break encryption. It's clear there's nothing the honest browser and DoH providers can do to prevent this. But this is a problem created by IETF standards, that IETF has an obligation (IMO) to try to fix before the abuses become rampant.

[1] https://www.theverge.com/2015/2/19/8067505/lenovo-installs-adware-private-data-hackers
[2] https://cdt.org/insight/is-breaking-web-encryption-legal/

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 7 Aug 2019 10:58:55 -0700

On Wed, Aug 7, 2019 at 10:51 AM STARK, BARBARA H <[email-masked]> wrote:

> I'm concerned with this too. Lenovo at one time was shipping laptops with
> a MS OS and IE browser they had customized to insert a "trusted"
> certificate that allowed Superfish to break browser encryption and insert
> ads. They had to stop that (but defended it) because of public backlash
> [1], but not because there was any rule against it [2]. From what I can
> see, there is nothing that would prevent a laptop/tablet
> manufacturer/provider from including a custom browser that is branded and
> looks just like the non-customized version of the same browser, but uses
> DoH to send all DNS traffic to the manufacturer's 3rd party partner DoH
> provider -- complete with lots of headers, cookies, and everything else
> needed to thoroughly track a user. This doesn't even break encryption. It's
> clear there's nothing the honest browser and DoH providers can do to
> prevent this. But this is a problem created by IETF standards, that IETF
> has an obligation (IMO) to try to fix before the abuses become rampant.
>

I certainly agree that fake malicious versions of common applications are a
risk, but that risk exists with or without DoH. If you have a malicious
browser which wants to track the user, it doesn't need to send it via DoH
but can just form an ordinary connection back to the manufacturer and send
the user's data.

-Ekr

> [1]
> https://www.theverge.com/2015/2/19/8067505/lenovo-installs-adware-private-data-hackers
> --
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add
>

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 7 Aug 2019 19:10:04 +0100

Hiya,

On 07/08/2019 18:46, STARK, BARBARA H wrote:
> But this is a problem created by IETF standards, that IETF has an
> obligation (IMO) to try to fix before the abuses become rampant.
Do53 can be used in DDoS reflection attacks. We don't
plan to not use DNS because of that. We do try to
document the issues and maybe reduce the amplification
factors. Doing analogously in the case of ADD would
seem reasonable but I'm not at all sure this is
well-described as a case where there's a thing to
simply "fix."

And talk of abuses becoming rampant seems to ignore
the real existence of other benefits.

Anyway, I figure many recent mails to this list are
really people repeating their starting positions.
(So I'll also shut up for a bit:-)

Cheers,
S.

---

From: Bret Jordan <[email-masked]>
Date: Wed, 7 Aug 2019 12:55:19 -0600

You bring up excellent points Barbara.  I think it is also important to note that the application developer may purposefully use embedded DoH to track users everywhere they go.   Right now a threat actor would need to compromise every network a user uses and the DHCP server that they use, to be able to track a user.  With DoH, and the way it is being deployed, this becomes so much easier to impact people’s privacy. 

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> On Aug 7, 2019, at 11:51 AM, STARK, BARBARA H <[email-masked]> wrote:
>

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 7 Aug 2019 20:11:37 +0100

Ok, I will shut up after this but...

On 07/08/2019 19:55, Bret Jordan wrote:
> I think it is also important to note that the application developer
> may purposefully use embedded DoH to track users everywhere they go.
> Right now a threat actor would need to compromise every network a
> user uses and the DHCP server that they use, to be able to track a
> user.

That's pure nonsense. Tracking a user does not require
DoH, there are myriad ways to do that without DoH,
including all forms of DNS, HTTPS, mail, irc and in
fact pretty much any protocol at all, if the two
endpoints are colluding for that purpose.

And if I've control over an application and a peer
with which that communicates I really have no need
at all to compromise a network or DHCP server.

Can we not stop with the counter-factual fluff?
There really has been too much of that.

S.

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 7 Aug 2019 12:18:19 -0700

Indeed. It's worth noting that many modern apps phone home for various
reasons (getting data from the server, checking for software updates,
telemetry, etc.) and so if you want to track the user's behavior, there's
already a very straightforward channel for that.

-Ekr

---

From: Adam Roach <[email-masked]>
Date: Wed, 7 Aug 2019 14:56:37 -0500

On 8/7/19 12:51, STARK, BARBARA H wrote:
>  From what I can see, there is nothing that would prevent a laptop/tablet manufacturer/provider from including a custom browser that is branded and looks just like the non-customized version of the same browser...

There is: trademark law. See, e.g., 
https://www.mozilla.org/en-US/foundation/trademarks/distribution-policy/

/a

---

From: "STARK, BARBARA H" <[email-masked]>
Date: Wed, 7 Aug 2019 20:28:28 +0000

> >  From what I can see, there is nothing that would prevent a laptop/tablet
> looks just like the non-customized version of the same browser...
> 
> <url destroyed by my firewall>

The version of Firefox and IE that I have on my corporate laptop (that have been customized by my employer) look just like the versions on my personal computers -- unless you go deep in the settings. I'm pretty sure this customization is being done under license of the browser, and not in violation of any law.

To do the customization I described in my example (device manufacturer changing the default DoH server in pre-loaded browser), the only change that's needed is to the supplied DoH config file, if I understand the DoH spec correctly. I'm pretty sure that doesn't impact the trademark or any licensing agreement. But it is a customization.
Barbara

---

From: Adam Roach <[email-masked]>
Date: Wed, 7 Aug 2019 16:01:43 -0500

> The version of Firefox and IE that I have on my corporate laptop (that have been customized by my employer) look just like the versions on my personal computers -- unless you go deep in the setting…

Right. That's explicitly supported by the enterprise policy feature 
built into Firefox, to allow the laptop's owner (your employer in this 
case) to configure the browser.

> To do the customization I described in my example (device manufacturer changing the default DoH server in pre-loaded browser), the only change that's needed is to the supplied DoH config file, if I…

IANAL, but I believe that would disqualify that vendor from being 
allowed to use the Firefox name and logo in the version they distribute. 
While modified preferences or enterprise policy isn't explicitly cited 
in the examples, it's clearly an alteration that runs afoul the 
top-level "You may distribute unaltered copies of Mozilla Firefox..." 
clause. This is why such agreements typically include phrases like "but 
are not limited to".

/a