Motives and Methods for Managed Private Network DNS

Motives and Methods for Managed Private Network DNS Dr. Paul Vixie, CEO Farsight Security, Inc. 2020 -02

Abstract • With Resolverless DNS, and before that DNS over HTTPS, and soon HTTP/3 (QUIC), the web industry is making a very strong attempt to completely control the DNS metadata required for web browsers to reach web services. While there are some political aspects to this redrawing of the DNS resolution path, there also security implications for operators of managed private networks which are not public, are not regulated, and have no "customers". These operators have reasons they consider important for keeping DNS resolution out of the hands of device, browser, and other app makers. In this presentation, Dr. Vixie will enumerate the DNS-related risks posed to operators of managed private networks by the increasing dominance of DNS-related web industry ambitions. Some proposals will be described as to the costs and benefits of absolute insistence upon local network control over DNS resolution.

Cooperation Is Alignment User 2019 -09 Browser Plugins Client OS Operator Near ISP © Farsight Security 2019 – All rights reserved. Far ISP Service 3

Cooperation Is Was Alignment User 2019 -09 Browser Plugins Client OS Operator Near ISP © Farsight Security 2019 – All rights reserved. Far ISP Service 4

DNS System Architecture (Internet Era) DNS Answers Authority Servers Observation & Analysis tap s dn DNS Cache Recursive Servers (Full Resolvers) RPZ Response Policy PII Stub Resolvers 2019 -09 © Farsight Security 2019 – All rights reserved. DNS Questions 5

DNS System Architecture (Web Era) DNS Answers Authority Servers Observation & Analysis Recursive Servers (speaking Do. H) tap s dn DNS Cache Recursive Servers (Full Resolvers) RPZ Response Policy PII Apps Doing DNS 2019 -09 Stub Resolvers © Farsight Security 2019 – All rights reserved. DNS Questions 6

Motives • Here’s the setup: • • Managed private networks (personal, family, corporate) have prerogatives Public (ISP) networks have the ability to exercise the same prerogatives State-level actors (intelligence, law enforcement) also have such abilities (Autocratic? ) governments can insist on (unpopular? ) ISP behaviour • Here’s where the resulting tension goes: • • On the Internet, unilateralism just begets more unilateralism Thus VPNs including Tor; anonymous remailers; PGP And now DNS over HTTP, Transport Layer Security 1. 3, Encrypted SNI MPN prerogatives are indistinguishable on the wire from “bad” behaviour

Methods • To conserve their prerogatives, every MPN will have to: • • • Firewall off any protocol whose transaction initiation cannot be detected Identify and block all HTTPS service IP’s which are known to support Do. H Force the use of an explicit HTTPS proxy Live without Io. T (can’t and won’t use an explicit proxy) Abandon transparent HTTPS interception Come to terms with BYOD • Public networks cannot do these things • Usurping MPN prerogatives only goes so far • So, the main purpose of Do. H will be served

Implications • Many new and higher costs: • • • It’s going to be very expensive (money, privacy, time, fragility, quality) Some apps just won’t work unless they can reach their own Do. H services will proliferate, sometimes from rage, sometimes for lulz ISP networks, even in autocratic states, may find the price too high State-level actors will pay the most (but, they have the most) • Cooperation is passe • Web is the age of unilateralism

What’s a State-level Actor’s Next Move? User 2019 -09 Browser Plugins Client OS Operator Near ISP © Farsight Security 2019 – All rights reserved. Far ISP Service 10

Discussion Starters • This is a new battle in the long war for control over DNS resolution • • NXD redirection Site. Finder www. google. com redirection DNS over HTTP you are here • This is the web insisting that the Internet be “just a dumb pipe” • “trust us, we’re your app” • Trust without possible verification is untenable for many