Subject: [hrpc] "Paul Vixie and Peter Lowe on Why DoH is Politically Motivated"

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 15 Nov 2021 13:17:04 +0100

It's funny (no, actually, it's sad) that some people, in 2021, still
use "political" as an insult and criticizes a protocol as being
"political" (specially in the fields of security and privacy where
things are even more political than the average network protocol).

https://www.dnsfilter.com/blog/paul-vixie-and-peter-lowe-on-why-doh-is-politically-motivated

What do they think? That encryption can avoid political discussions?

---

From: Bill Woodcock <[email-masked]>
Date: Mon, 15 Nov 2021 13:32:48 +0100

> On Nov 15, 2021, at 1:17 PM, Stephane Bortzmeyer <[email-masked]> wrote:
> 

Well, I agree that the word “political” is not a useful one in this context.

But in reading what they said, I don’t find much else to disagree with…  DoH is a black mark on the reputation of the IETF, and its adoption as a standard was a sad day for privacy.

                                -Bill

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 15 Nov 2021 04:53:08 -0800

I don't think it's that useful to argue about the bigger picture, *but* I
also think that the attribution of this to DoH is rather misplaced. There
are a number of reasons--primarily technical--that Firefox at least elected
to use DoH, but we could have just as well used DoT and the situation would
be very much the same.

-Ekr

On Mon, Nov 15, 2021 at 4:33 AM Bill Woodcock <[email-masked]> wrote:

> But in reading what they said, I don’t find much else to disagree with…
> DoH is a black mark on the reputation of the IETF, and its adoption as a
> standard was a sad day for privacy.
>
>                                 -Bill
>
> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc
>

---

From: Bill Woodcock <[email-masked]>
Date: Mon, 15 Nov 2021 14:01:21 +0100

> On Nov 15, 2021, at 1:53 PM, Eric Rescorla <[email-masked]> wrote:
> We could have just as well used DoT and the situation would be very much the same.

Not for the threat models that DoH enables.

                                -Bill

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 15 Nov 2021 05:05:16 -0800

> Not for the threat models that DoH enables.

I don't really understand what you're saying here, so perhaps you could
elaborate?

-Ekr

---

From: Paul Wouters <[email-masked]>
Date: Mon, 15 Nov 2021 10:16:36 -0500 (EST)

> What do they think? That encryption can avoid political discussions?

I also found it interesting how they talked about censorship by "bad
actors", and bad vendors delivering solutions to authoritarian regimes,
yet they don't see themselves as facilitating this by fighting DoH.

I do agree with Paul Vixie about why google encrypts. it has always
been about ensuring only they can datamine the user. The google page
using HTTPS was to prevent others like Microsoft from buying search
keywords from ISPs sharing google.com traffic to build up their own
search/avertisement business. That the same process extended to DNS
is not a surprise. Like everyone else, with ubiquitous web encryption,
the second best source of keyword information is DNS.

And _this_ is why the DNS is now political. It is the last unencrypted
service left to use for censorship, surveillance, security software,
parental control, nation states, and every other good or bad actor,
to try and determine what your packets are doing.

Where I disagree with Paul Vixie is whether you should blame DoH or
the IETF for this. I don't think so. All of this was obviously going
to happen. It is a chain link reaction. You can't blame DoH because
DoH is the expected solution to a previous problem.

Similarly (but yet completely different) is NAT. It is not needed
anymore, yet it will remain there because it inevitably supports all
current business models of selling you a service that you need because
you are behind NAT. All your smart devices could operate without a vendor
service if there is no NAT. But where is the profit in that? Where in the
past, NAT was needed by ISPs first because of lack of address spaces,
but secondary to allow it to build sub-par networking to endusers and
sell premium hosting services. Now that the Three Clouds have taken that
mostly away, ISPs have no real commercial reason for NAT anymore. In a
real free market, it would go away.

I guess in the end, the internet is jus a series of companies trying to
sell unique identifiers so humans and things can find each other. And
we will keep building layers upon layers of identifiers.

What is worse?  Censorship for business reasons or censorship for political
reasons? I'll let the historians decide later.

<end of morning coffee rant>

Paul

---

From: Jacob Appelbaum <[email-masked]>
Date: Mon, 15 Nov 2021 17:00:44 +0100

Hello Bill,

> Well, I agree that the word “political” is not a useful one in this

Indeed. What seems especially not useful here is that the default
situation isn't critically examined as a political choice; only the
reactionary designs to that default choice are called political? Huh,
okay.  This is to say nothing of the fact that it is uncontroversial
to claim to be performing DNS intelligence at all. Huh, strange...

> But in reading what they said, I don’t find much else to disagree with…

Does this mean you don't disagree with people doing "intelligence" on
the DNS as is claimed in the discussion? I have always found this a
perplexing aspect of the DNS - it is vulnerable to network
surveillance and even censorship by (only slightly obfuscated) design.

> DoH
> is a black mark on the reputation of the IETF, and its adoption as a

I find this position perplexing - was it a sad day for privacy when
the IETF (a.k.a. the king makers of the DNS standards) did not pursue
query/response privacy on the wire as a first class goal? Or when it
refused to adopt TLS or another secure protocol that provides query
and response privacy as the DNS server-to-server protocol for all
communications? I realize that such a radical change would interfere
with some countrie's desire to be able to perform DNS surveillance and
censorship.

As the DNS is secured, the censorship infrastructure will improve,
they claim. These improvements will be tied to the technological and
economic capabilities of the adversary attacking users, of course.
This observation of theirs seems true, but does that mean that we
should thus leave the DNS vulnerable to interception, analysis, and
often tampering? No, it doesn't follow. DNSSEC solves part of this
problem but not all of it. The surveillance and censorship
infrastructure will improve in almost every case regardless of the DNS
privacy offerings.

Isn't it completely obvious that until, and unless the DNS (eg:
starting with the root servers) offers meaningful security, that
someone or some company, will add it somewhere else? The notion of
meaningful security includes authenticity, integrity, and *especially*
confidentiality (aka privacy) of queries and responses. This notion of
confidentiality that isn't even end-to-end (like DNSCurve, also
mentioned by the two gentlemen). In either case, strict
confidentiality is a property that even DNSSEC failed to deliver.

If all (especially authoritative) DNS servers, including the root
servers, offered encrypted, authenticated communications channels, few
would need a centralized DoH or DoT service to achieve query
confidentiality. A major driving force from my perspective behind DoH
and DoT is that people don't trust their local network not to extract
information from the DNS (as Paul Vixie observed in this discussion).
Another major driving force is related to censorship desires of users
and network administrators. I think the DNS makes a lot of compromises
to accommodate censorship and surveillance requests and there
certainly isn't as much transparency as might be desired by users of
the DNS. It doesn't seem that people here are objecting to the
censorship or surveillance practices of certain providers as much as
other issues, for example, who does it now vs who did it previously.

Users and network administrators often use DoH or DoT because of ease
of use, well populated caches, censorship features (eg: blocking
specific kinds of names on specific kinds of networks), and other
features that appeal to network administrators as well as business
administrators. It seems almost inevitable that someone would offer a
secure way to connect to the DNS, and with it, they will bring in
centralization, and other kinds of controls. One way to fight against
the centralization is clearly to ensure that the centralized service
doesn't offer something that is so appealing that it becomes
worthwhile - for example a TLS endpoint.

>From my perspective there also appears to be significant conflicts of
interest abound. Consider that some companies and some people who run
important DNS infrastructure also run surveillance operations (eg:
passive DNS surveillance) against the network traffic reaching that
service while also not offering a secure way to reach that very same
server. It is the lack of a secure connection that enables passive
(and active!) surveillance of DNS queries/responses near the DNS
servers as well as at every point along the network path. We're not
even discussing the ability to make an anonymous query which is yet
another problematic issue that remains unaddressed by the DNS
generally. This is especially frustrating since there has been next to
no deployed work on how we might solve actual anonymous querying at
scale. So even with encryption we're not really speaking of anonymity.
Several types of DNS surveillance will still learn information about
the querying party by source IP and this can be correlated with logs
that are also often kept by operators of the DNS.

My sense is that those doing DNS surveillance don't want to give up
any power at all, and DoH/DoT essentially ends the conversation in a
fairly rude way. The DoH/DoT provider is able to see the source of the
query, and the query itself, as well as any responses. Meanwhile,
upstream the DNS just sees a collection of huge proxies which deprives
them of client IP addresses, client queries, and of course, the
related responses. So the DNS surveillance at the root becomes less
effective, and the surveillance abilities moves to the DoH/DoT
provider/network. Huh, how might we fix that?

Why in 2021 do we still lack a standard, secure way to reach every
root server as well as any other DNS server?

Surveillance and censorship, of course!

More specifically, it looks like surveillance capitalism[0], and it
appears that there are at least two major factions arguing over who
shall see and thus own the data. The people who
design/deploy/run/monitor the DNS, and the people who run large
caching servers with TLS endpoints as well as other features. I think
application developers generally want this to be a solved problem, so
they're simply using the solutions that solve their problems. What
alternatives exist for them other than saying no, no query privacy for
you? Not many.

Perhaps the interests of decentralization vs centralization will
finally break this tug of war. Ideally the root servers will finally
offer a secure way to reach them, obviating the need for TLS based
privacy enhancements provided by DoH/DoT, especially those that are
run as large centralized services. Yes, those ports will be censored
by some parties (eg: entire countries), and this will be something
that can be seen by everyone. It's uncomfortable to bring this dirty
laundry out into the open, I realize.

It goes without saying that if there was a way to have end-to-end
encrypted queries/responses (eg: as DNSCurve did years ago) it would
largely ensure that those centralized services would be unable to
extract almost anything of value. That's a major part, but not the
only part, of why they exist - they're not running those services for
altruistic reasons. Adopting an end-to-end encrypted design has
caching downsides, so I don't expect people to push for it anytime
soon. Caching is clearly another large motivation behind centralized
services as latency improvements provide an advantage over other
distributed/decentralized systems like using the DNS directly at
times.

If we look at what Zuboff says with her surveillance capitalist
critique [0] then we might be well served to consider DoH/DoT as a
market response to performance, control, as well as the obvious
privacy concerns. What will the response of the IETF or DNS operators
be to this shift in the market? Maybe it might include giving up
passive DNS surveillance as it is performed today? Might it include
finally designing, and deploying meaningful query/response privacy in
the DNS system at every point?

I hope so but it seems doubtful to me. After all, the various
conflicts of interests are still highly relevant to the possible
solution space. The benefits of performing the surveillance by various
operators seems to outweigh the value of even the infrastructure
itself to those same operators. DoH/DoT appears to be changing that
value proposition in a way that clearly makes the "old guard" (no
ageism implied here) of the DNS uncomfortable. Though Zuboff's
surveillance capitalism analysis lens, we might be correct to say that
we are watching two (and sometimes more) extractive surveillance
capitalists camps complain about fairness of who does the
surveillance. It really is something to watch from a distance.

Perhaps there is another choice... What if we... did away with DNS
"intelligence" and actually secured the DNS with regard to
confidentiality of user queries/responses as well as server-to-server
confidentiality? What if we agreed to purposefully blind all these
network sniffing and injecting adversaries? Answering "no thanks" is
of course a valid option, and it's why there are people who use
DoH/DoT, or similar systems like DNSCrypt, and even DNSCurve. This is
to say nothing of secure decentralized solutions like Namecoin. My
guess is that these alternative options will not beat out the DNS any
time soon but eventually "secure" centralized systems will likely
become a serious existential threat to the DNS. Frustratingly DNSSEC
does not really help us here as it even invites untrusted third
parties to be involved in relaying data.

Kind regards,
Jacob

[0] https://news.harvard.edu/gazette/story/2019/03/harvard-professor-says-surveillance-capitalism-is-undermining-democracy/

---

From: farzaneh badii <[email-masked]>
Date: Mon, 15 Nov 2021 11:42:31 -0500

Unearthing motivation is hard and not a pretty game but I wish if people’s
biz model or previous biz model was based on the data that DoH is gonna
encrypt, they would say so.
I think the surveillance capitalism concept is too overloaded but if I
could find one good example of surveillance capitalism it would be threat
intelligence firms and DNS security companies that monitor and mine
people’s data and the sad thing about it is they easily say it’s for your
security and good for the society and a world almost brainwashed by
security theatre nods and doesn’t scrutinize them. I don’t think these
methods (some of the threat intelligence /OSINT methods) are inherently bad
and with ethical processes in place it can be ok. But when privacy tools
are found to enhance people’s privacy, unfortunately some go all against it
instead of changing biz models and their processes. So in essence there is
a huge push back against it from the crowd that profited from that data
either in DoH or my other favorite example: WHOIS. And I think they should
mention every time they speak against DoH and Privacy in domain name
registration that their biz is in danger or they built their career on that
data. Then they can add that they are also working for the safety and
security of the people and want to fight with bad actors.

-- 
Farzaneh

---

From: Vittorio Bertola <[email-masked]>
Date: Mon, 15 Nov 2021 19:09:26 +0100 (CET)

> Il 15/11/2021 13:53 Eric Rescorla <[email-masked]> ha scritto:
> 
> 
> I don't think it's that useful to argue about the bigger picture, *but* I also think that the attribution of this to DoH is rather misplaced. There are a number of reasons--primarily technical--that Firefox at least elected to use DoH, but we could have just as well used DoT and the situation would be very much the same.
> 
Not really - DoT is a protocol designed to operate in the clear and to be easily detected and controlled, while DoH was designed with the explicit objective of masquerading the traffic within other HTTPS exchanges and make it impossible to block or even detect the communication. This is, indeed, a political choice and a political stance.

However, "political" is not a bad word. The pretense that code and protocols are "just technical stuff" has been wiped away since "Code Is Law" times, and many things we do, as citizens and even more as companies, have socio-economic consequences and thus are political. It's better to recognize this than to pretend otherwise.

The problem IMHO is that the IETF is taking political stances without any kind of proper political analysis or understanding. Especially when public policy and governments come into play, and with no offense meant to anyone, the debate at the IETF seems often out of touch with the reality.

Governments are commonly depicted in caricatural forms, only interested in enslaving their population and controlling their minds through censorship, which includes any form of content scrutiny (even the voluntary ones) and which should be countered by ensuring unfettered, uncontrollable, anonymous, encrypted circulation of anything, legal or not.

The objective problems that this circulation has created - democracies being endangered through unaccountable political propaganda, people dying for believing in antivax rubbish generously spread by social algorithms because it generates clicks, or the marginalization of the less technical user groups because phishing and cheating and security issues become so ubiquitous that it's impossible for them to cope, and there would be many more - are just dismissed. Issues around sovereignty, the tension between a global network and huge national differences in laws and values, are all handwaved away in a second as "Internet fragmentation". People that try to foster a more nuanced conversation are immediately attacked as wannabe dictators or motivated by their own sketchy business objectives. It is very frustrating.

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked] mailto:[email-masked]
Office @ Via Treviso 12, 10144 Torino, Italy

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 15 Nov 2021 11:20:26 -0800

On Mon, Nov 15, 2021 at 10:09 AM Vittorio Bertola <
[email-masked]> wrote:
> Not really - DoT is a protocol designed to operate in the clear and
> to be easily detected and controlled, while DoH was designed with
> the explicit objective of masquerading the traffic within other
> HTTPS exchanges and make it impossible to block or even detect the
> communication.

I don't think responding to the broader points you are making is
likely to get us anywhere productive, but I did want to respond
to your comparison of DoH and DoT, which I don't think is really
that accurate.

The usual reasoning here is that it's hard to filter DoH because
it shares the same ALPN and port number with HTTPS, whereas
DoT does not. However, this is misleading in several respects.

However, at present, it is generally possible to filter DoH because
DoH and ordinary HTTPS are usually on different hosts and therefore
you can use SNI. It's true that it's possible to co-host DoH in such a
way that it is indistinguishable from non-DoH HTTPS traffic, but it is
*also* possible to co-host DoT and HTTPS in this way, provided that
(1) you use a non-standard port and (2) you use ECH. The point here is
that either DoH or DoT can be run in a way that makes it hard to filter
if that's what you're trying to do.

-Ekr

---

From: Vittorio Bertola <[email-masked]>
Date: Tue, 16 Nov 2021 17:36:16 +0100 (CET)

> Il 15/11/2021 20:20 Eric Rescorla <[email-masked]> ha scritto:
> 
That's exactly why the difference between DoT and DoH is political way more than technical: I trust you that both may be used in ways that make them hard to block, but for DoT it is an unintended consequence, while for DoH it is an intended objective of the designers, stated in the specification itself and in several public statements.

--

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 16 Nov 2021 08:51:48 -0800

On Tue, Nov 16, 2021 at 8:36 AM Vittorio Bertola <
[email-masked]> wrote:

> That's exactly why the difference between DoT and DoH is political way
> more than technical: I trust you that both may be used in ways that make
> them hard to block, but for DoT it is an unintended consequence, while for
> DoH it is an intended objective of the designers, stated in the
> specification itself and in several public statements.
>

As I said previously, I'm not interested in debating whether DoH is
political or not. My point was merely that:

1. It's a deployment question whether to make DoH or DoT unblockable.
2. Current DoH deployments are generally easily blockable.
3. If people want to deploy DoT in unblockable ways, they can do so.

Therefore the fact that browsers are choosing to deploy DoH  rather than
DoT does not have a significant impact on whether it will be blockable in
practice.

-Ekr

---

From: Ted Lemon <[email-masked]>
Date: Tue, 16 Nov 2021 14:18:22 -0500

On Tue, Nov 16, 2021 at 11:36 AM Vittorio Bertola <vittorio.bertola=
[email-masked]> wrote:

> And this is a great illustration of the good reason why we talk about
political versus technical in the IETF: because if we consider only the
political and not the technical, we can wander off into the weeds doing
things that don't matter.

In this case, you're drawing a distinction of intent, but what matters is
the effect of the protocol, not what was intended. As an example, we've
seen a few people assert that DoH is bad because it makes it possible to
bypass the local resolver in a way that is difficult to detect (which is
actually debatable). But in fact it's trivial without the DoH protocol to
do the same thing—it's just not standardized. So the difference between DoH
and this non-standard protocol that I speculate might exist is merely that
one is documented and the other isn't.

So if we imagine that we are somehow protected when we don't document the
protocol, we are whistling past the graveyard. This is the important
distinction that we lose when we reduce this to a political discussion, and
it's the reason we shouldn't.

---

From: Eliot Lear <[email-masked]>
Date: Tue, 16 Nov 2021 21:55:27 +0100

We run this risk of this discussion getting quite 'meta' (no offense to 
Facebook).  Yes, DoH and DoT are both public protocols, and in 
themselves I don't think they are particularly harmful.  It is precisely 
when they bypass local infrastructure when things get messy.  You may 
say, “but a private mechanism can do the same thing.”  This is true.  
But when a private mechanism does the same thing, we can in fact place 
controls on the infrastructure to either prevent it or reduce it 
substantially, "simply" by binding network access to name resolution 
(ok, it's not THAT simple but it can and has been done).  But that 
doesn't work unless the the local resolvers are used.

Do motivations matter?  Certainly.  That's how work gets done. If 
motivations can be impacted, that's how work is directed.  But I tend to 
agree with you that it is the outcome that matters by orders of 
magnitude more, as far as we are concerned.  And here, we really can't 
say if there is a good outcome or a bad outcome – yet.  It depends on 
what information is lost, and whether Bad Guys are covertly using newly 
created channels, and whether you are even able to identify that.  The 
jury is still out (a phrase that has some interesting meaning today).

More data needed.  But where is that data?

Eliot

On 16.11.21 20:18, Ted Lemon wrote:
> On Tue, Nov 16, 2021 at 11:36 AM Vittorio Bertola 
> <vittorio.bertola=[email-masked]> wrote:
>
>     That's exactly why the difference between DoT and DoH is political
>     way more than technical: I trust you that both may be used in ways
>     that make them hard to block, but for DoT it is an unintended
>     consequence, while for DoH it is an intended objective of the
>     designers, stated in the specification itself and in several
>     public statements.
>
> political versus technical in the IETF: because if we consider only 
> the political and not the technical, we can wander off into the weeds 
> doing things that don't matter.
>
> In this case, you're drawing a distinction of intent, but what matters 
> is the effect of the protocol, not what was intended. As an example, 
> we've seen a few people assert that DoH is bad because it makes it 
> possible to bypass the local resolver in a way that is difficult to 
> detect (which is actually debatable). But in fact it's trivial without 
> the DoH protocol to do the same thing—it's just not standardized. So 
> the difference between DoH and this non-standard protocol that I 
> speculate might exist is merely that one is documented and the other 
> isn't.
>
> So if we imagine that we are somehow protected when we don't document 
> the protocol, we are whistling past the graveyard. This is the 
> important distinction that we lose when we reduce this to a political 
> discussion, and it's the reason we shouldn't.
>