Re: [DNSOP] DNS privacy, recursive-to-authoritative

2015-09-03 Thread Jacob Appelbaum
On 9/3/15, John R Levine wrote: >> Until the invention of quantum computers, we can protect data from >> being instantly available to most of these groups most of the time. > > Aw, come on. There are root servers in China. > I'm much more worried about the root servers run by people who also dep

Re: [DNSOP] DNS privacy, recursive-to-authoritative

2015-09-03 Thread John R Levine
Until the invention of quantum computers, we can protect data from being instantly available to most of these groups most of the time. Aw, come on. There are root servers in China. My outline is as follows: everyone and every system should have security and privacy in the form of forward-secr

Re: [DNSOP] DNS privacy, recursive-to-authoritative

2015-09-03 Thread Jacob Appelbaum
On 9/2/15, Paul Vixie wrote: > > > John R Levine wrote: >> ... >> >> Tor is one approach to query security that seems to work pretty well >> give or take side channel leakage. Dunno if there are any others, but >> it is clearly a very hard problem, and not one we're going to solve >> any time soo

Re: [DNSOP] DNS privacy, recursive-to-authoritative (Was: reservations on reservations, was Barry Leiba's Abstain

2015-09-02 Thread Ian Maddison
> On 03 Sep 2015, at 00:20, Paul Vixie wrote: > NSA (et al) is a form of "us" and that we will > not stop "us" with math. real change there will come in the voting booth. t-shirt idea ! almost beats Jacob saying the special use request for .onion is for those who’ve probably never used Tor :)

Re: [DNSOP] DNS privacy, recursive-to-authoritative (Was: reservations on reservations, was Barry Leiba's Abstain

2015-09-02 Thread Paul Vixie
John R Levine wrote: > ... > > Tor is one approach to query security that seems to work pretty well > give or take side channel leakage. Dunno if there are any others, but > it is clearly a very hard problem, and not one we're going to solve > any time soon. i think we have to be realistic. the

Re: [DNSOP] DNS privacy, recursive-to-authoritative (Was: reservations on reservations, was Barry Leiba's Abstain

2015-09-02 Thread Wessels, Duane
> On Sep 2, 2015, at 3:08 PM, Paul Vixie wrote: > > > > Stephane Bortzmeyer wrote: >> On Wed, Sep 02, 2015 at 08:28:10AM +1000, >> Mark Andrews wrote: >> >>> ... >>> >>> 1. Recommend *every* recursive server holds a copy of the root zone. >> >> The problem is more general than that. It is

Re: [DNSOP] DNS privacy, recursive-to-authoritative (Was: reservations on reservations, was Barry Leiba's Abstain

2015-09-02 Thread Paul Vixie
Stephane Bortzmeyer wrote: > On Wed, Sep 02, 2015 at 08:28:10AM +1000, > Mark Andrews wrote: > >> ... >> >> 1. Recommend *every* recursive server holds a copy of the root zone. > > The problem is more general than that. It is not only the root (well, > the sniffers along the path to the root na

Re: [DNSOP] DNS privacy, recursive-to-authoritative (Was: reservations on reservations, was Barry Leiba's Abstain

2015-09-02 Thread John R Levine
1. Recommend *every* recursive server holds a copy of the root zone. The problem is more general than that. It is not only the root (well, the sniffers along the path to the root name servers), it is a recursive-to-authoritative problem. Your solution does not work for .com or even .fr. It see

[DNSOP] DNS privacy, recursive-to-authoritative (Was: reservations on reservations, was Barry Leiba's Abstain

2015-09-02 Thread Stephane Bortzmeyer
On Wed, Sep 02, 2015 at 08:28:10AM +1000, Mark Andrews wrote a message of 49 lines which said: > This is recursive resolver to root server privacy which is off charter > for DPRIVE. > > Now there are two ways to solve this as the root is signed. > > 1. Recommend *every* recursive server hold