lookedopenerdns

IETFDNSPrivacy1ICANN-TechDay/Dublin,.
IE-10/2015-Ver:01WarrenKumariAshortintroductionandupdateonDPRIVEWhat'stheproblem2What'stheproblem2Ihatedoingexpensereports…What'stheproblem2Ihatedoingexpensereports…soIprocrastinate…What'stheproblem2Ihatedoingexpensereports…soIprocrastinate……andtidyupmydeskWhat'stheproblem2Ihatedoingexpensereports…soIprocrastinate……andtidyupmydesk…andcleanallthecrumbsoutofmykeyboardWhat'stheproblem2Ihatedoingexpensereports…soIprocrastinate……andtidyupmydesk…andcleanallthecrumbsoutofmykeyboard…anddothelaundryWhat'stheproblem2Ihatedoingexpensereports…soIprocrastinate……andtidyupmydesk…andcleanallthecrumbsoutofmykeyboard…anddothelaundry…andthenstartreadingWikipedia….
What'stheproblem(cont)3Attribution:xkcdislicensedbyRandallMunroeunderaCreativeCommonsAttribution-NonCommercial2.
5License-XKCDfromhttp://imgs.
xkcd.
com/comics/the_problem_with_wikipedia.
pngWhat'stheproblem(cont)3"99Luftballons"Attribution:xkcdislicensedbyRandallMunroeunderaCreativeCommonsAttribution-NonCommercial2.
5License-XKCDfromhttp://imgs.
xkcd.
com/comics/the_problem_with_wikipedia.
pngWhat'stheproblem(cont)3"99Luftballons"→"99RedBalloons"Attribution:xkcdislicensedbyRandallMunroeunderaCreativeCommonsAttribution-NonCommercial2.
5License-XKCDfromhttp://imgs.
xkcd.
com/comics/the_problem_with_wikipedia.
pngWhat'stheproblem(cont)3"99Luftballons"→"99RedBalloons"→NuclearaccidentsAttribution:xkcdislicensedbyRandallMunroeunderaCreativeCommonsAttribution-NonCommercial2.
5License-XKCDfromhttp://imgs.
xkcd.
com/comics/the_problem_with_wikipedia.
pngWhat'stheproblem(cont)3"99Luftballons"→"99RedBalloons"→Nuclearaccidents→[Threehoursoffascinatedclicking]Attribution:xkcdislicensedbyRandallMunroeunderaCreativeCommonsAttribution-NonCommercial2.
5License-XKCDfromhttp://imgs.
xkcd.
com/comics/the_problem_with_wikipedia.
pngWhat'stheproblem(cont)3"99Luftballons"→"99RedBalloons"→Nuclearaccidents→[Threehoursoffascinatedclicking]→websitesontheefciencyofcentrifugalenrichmentofuranium-235Attribution:xkcdislicensedbyRandallMunroeunderaCreativeCommonsAttribution-NonCommercial2.
5License-XKCDfromhttp://imgs.
xkcd.
com/comics/the_problem_with_wikipedia.
pngSowhat4Sowhat4AlloftheURLsIwenttowerehttps://,sothecontentisprotected,no-oneislikelytogetthewrongidea…Sowhat4AlloftheURLsIwenttowerehttps://,sothecontentisprotected,no-oneislikelytogetthewrongidea……butmanyofthedomainnamesthatmymachinelookedupwere,um,suspicious,especiallyiftakenoutofcontext.
Sowhat4AlloftheURLsIwenttowerehttps://,sothecontentisprotected,no-oneislikelytogetthewrongidea……butmanyofthedomainnamesthatmymachinelookedupwere,um,suspicious,especiallyiftakenoutofcontext.
.
.
.
andithasbecomeclearthatgovernmentsandpervasivemonitorsareusingactivelyexploitingmetadatafortargeting.
Sowhat4AlloftheURLsIwenttowerehttps://,sothecontentisprotected,no-oneislikelytogetthewrongidea……butmanyofthedomainnamesthatmymachinelookedupwere,um,suspicious,especiallyiftakenoutofcontext.
.
.
.
andithasbecomeclearthatgovernmentsandpervasivemonitorsareusingactivelyexploitingmetadatafortargeting.
AmIreallyconcernedaboutthisparticularcaseNah,I'mnotthatparanoid,butitmakesagoodexample:-)RFC7258-PervasiveMonitoringIsanAttack5TheIETFcommunity'stechnicalassessmentisthatPMisanattackontheprivacyofInternetusersandorganisations.
TheIETFcommunityhasexpressedstrongagreementthatPMisanattackthatneedstobemitigatedwherepossible,viathedesignofprotocolsthatmakePMsignificantlymoreexpensiveorinfeasible.
QNAMEMinimization6draft-ietf-dnsop-qname-minimisation*[*]:SubmittedtoIESGforPublicationHowDNSworks7Root.
comexample.
comhttp://www.
example.
comDNSHowDNSworks7Root.
comexample.
comhttp://www.
example.
comwww.
example.
comDNSHowDNSworks7Root.
comexample.
comhttp://www.
example.
comwww.
example.
comwhereis.
comDNSHowDNSworks7Root.
comexample.
comhttp://www.
example.
comwww.
example.
comwhereis.
com.
comisat1.
2.
3.
4DNSHowDNSworks7Root.
comexample.
comhttp://www.
example.
comwww.
example.
comwhereis.
com.
comisat1.
2.
3.
4whereis.
example.
comDNSHowDNSworks7Root.
comexample.
comhttp://www.
example.
comwww.
example.
comwhereis.
com.
comisat1.
2.
3.
4whereis.
example.
comexample.
comisat2.
3.
4.
5DNSHowDNSworks7Root.
comexample.
comhttp://www.
example.
comwhereiswww.
example.
comwww.
example.
comwhereis.
com.
comisat1.
2.
3.
4whereis.
example.
comexample.
comisat2.
3.
4.
5DNSHowDNSworks7Root.
comexample.
comhttp://www.
example.
comwhereiswww.
example.
comwww.
example.
comisat3.
4.
5.
6www.
example.
comwhereis.
com.
comisat1.
2.
3.
4whereis.
example.
comexample.
comisat2.
3.
4.
5DNSHowDNSworks7Root.
comexample.
comhttp://www.
example.
comwhereiswww.
example.
comwww.
example.
comisat3.
4.
5.
63.
4.
5.
6www.
example.
comwhereis.
com.
comisat1.
2.
3.
4whereis.
example.
comexample.
comisat2.
3.
4.
5DNSHowDNSactuallyworks8Root.
comexample.
comhttp://www.
example.
comDNSHowDNSactuallyworks8Root.
comexample.
comhttp://www.
example.
comwww.
example.
comDNSHowDNSactuallyworks8Root.
comexample.
comhttp://www.
example.
comwww.
example.
comwhereiswww.
example.
comDNSHowDNSactuallyworks8Root.
comexample.
comhttp://www.
example.
comwww.
example.
comwhereiswww.
example.
com.
comisat1.
2.
3.
4DNSHowDNSactuallyworks8Root.
comexample.
comhttp://www.
example.
comwww.
example.
comwhereiswww.
example.
com.
comisat1.
2.
3.
4whereiswww.
example.
comDNSHowDNSactuallyworks8Root.
comexample.
comhttp://www.
example.
comwww.
example.
comwhereiswww.
example.
com.
comisat1.
2.
3.
4whereiswww.
example.
comexample.
comisat2.
3.
4.
5DNSHowDNSactuallyworks8Root.
comexample.
comhttp://www.
example.
comwhereiswww.
example.
comwww.
example.
comwhereiswww.
example.
com.
comisat1.
2.
3.
4whereiswww.
example.
comexample.
comisat2.
3.
4.
5DNSHowDNSactuallyworks8Root.
comexample.
comhttp://www.
example.
comwhereiswww.
example.
comwww.
example.
comisat3.
4.
5.
6www.
example.
comwhereiswww.
example.
com.
comisat1.
2.
3.
4whereiswww.
example.
comexample.
comisat2.
3.
4.
5DNSHowDNSactuallyworks8Root.
comexample.
comhttp://www.
example.
comwhereiswww.
example.
comwww.
example.
comisat3.
4.
5.
63.
4.
5.
6www.
example.
comwhereiswww.
example.
com.
comisat1.
2.
3.
4whereiswww.
example.
comexample.
comisat2.
3.
4.
5DNSQNAMEattacksurface9Root.
comexample.
comhttp://www.
example.
comwhereiswww.
example.
comwww.
example.
comisat3.
4.
5.
63.
4.
5.
6www.
example.
comwhereiswww.
example.
com.
comisat1.
2.
3.
4whereiswww.
example.
comexample.
comisat2.
3.
4.
5DNSQNAMEattacksurface9Root.
comexample.
comhttp://www.
example.
comwhereiswww.
example.
comwww.
example.
comisat3.
4.
5.
63.
4.
5.
6www.
example.
comwhereiswww.
example.
com.
comisat1.
2.
3.
4whereiswww.
example.
comexample.
comisat2.
3.
4.
5DNSQNAMEattacksurface9Root.
comexample.
comhttp://www.
example.
comwhereiswww.
example.
comwww.
example.
comisat3.
4.
5.
63.
4.
5.
6www.
example.
comwhereiswww.
example.
com.
comisat1.
2.
3.
4whereiswww.
example.
comexample.
comisat2.
3.
4.
5DNSQNAMEattacksurface9Root.
comexample.
comhttp://www.
example.
comwhereiswww.
example.
comwww.
example.
comisat3.
4.
5.
63.
4.
5.
6www.
example.
comwhereiswww.
example.
com.
comisat1.
2.
3.
4whereiswww.
example.
comexample.
comisat2.
3.
4.
5DNSQNAMEattacksurface9Root.
comexample.
comhttp://www.
example.
comwhereiswww.
example.
comwww.
example.
comisat3.
4.
5.
63.
4.
5.
6www.
example.
comwhereiswww.
example.
com.
comisat1.
2.
3.
4whereiswww.
example.
comexample.
comisat2.
3.
4.
5DNSQNAMEMinimizationReallyshortsummaryisthatitmakesthebehaviorbehowpeopledescribeit…Onlyinclude.
comwhenqueryingtheroot,onlyincludeexample.
comwhenquerying.
com,etc.
Basicallysendtheveryminimuminfoneededtoresolvethename.
10DPRIVE11Root.
comexample.
comhttp://www.
example.
comwhereiswww.
example.
comwww.
example.
comisat3.
4.
5.
63.
4.
5.
6www.
example.
comwhereis.
com.
comisat1.
2.
3.
4whereis.
example.
comexample.
comisat2.
3.
4.
5DNSDPRIVE11Root.
comexample.
comhttp://www.
example.
comwhereiswww.
example.
comwww.
example.
comisat3.
4.
5.
63.
4.
5.
6www.
example.
comwhereis.
com.
comisat1.
2.
3.
4whereis.
example.
comexample.
comisat2.
3.
4.
5DNSDPRIVEWGThistakesDNSprivacyevenfurtherEncryptstheDNSmessagesthemselvesAddressesmuchmoreactiveattacksComplementsQNAMEminimization12NoPrivacy15:48:29IP204.
42.
252.
2.
26838>199.
19.
53.
1.
53:Awww.
aa.
org.
ar:.
OPTUDPsize=4096OK0x0000:45000043a40a00004011125ecc2afc02E.
.
C…0x0010:c713350168d60035002fc48293110000.
.
5.
h.
5.
0x0020:00010000000000010377777702616103www.
aa.
0x0030:6f726700000100010000291000000080org.
0x0040:0000.
.
.
15:48:29IP199.
19.
53.
1.
53>204.
42.
252.
2.
26838:q:Awww.
aa.
org.
0/6/1ns:aa.
org.
NSns2.
rackspace.
com.
,aa.
org.
NSns.
rackspace.
com.
0x0000:45000260414a000038117b01c7133501E.
.
`AJ.
.
8.
{.
.
.
5.
0x0010:cc2afc02003568d6024c230093118000.
*…5h.
.
L#….
.
0x0020:00010000000600010377777702616103www.
aa.
0x0030:6f72670000010001c010000200010001org.
13WithDPRIVE15:59:51IP204.
42.
252.
2.
42607>185.
49.
141.
38.
10210x0000:4500015bc9b0400040066167cc2afc02E.
ag.
*.
.
0x0010:b9318d26a66f03fdda34fe90e31ee965.
1.
&.
o…4.
.
.
.
.
e0x0020:801800e50fd300000101080a783c373ex0x0030:d637f74516030101220100011e0303d6.
7.
E.
0x0040:62f0d139ed30428d51e9802bfc89376eb.
.
9.
0B.
Q.
.
+.
.
7n0x0050:09ddacbe0a20d6a5af716a70f9d6ea00qjp.
.
.
.
0x0060:0088c030c02cc028c024c014c00a00a3.
.
.
0.
0x0070:009f006b006a0039003800880087c032.
.
.
k.
j.
9.
8.
.
.
.
.
20x0080:c02ec02ac026c00fc005009d003d003550x0090:0084c012c00800160013c00dc003000a0x00a0:c02fc02bc027c023c013c00900a2009e14.
.
.
andnow.
.
.
15