Subject: [DNSOP] draft-ietf-dnsop-svcb-https: HTTPS RRtype versus STS

From: Paul Hoffman <[email-masked]>
Date: Sun, 25 Oct 2020 20:21:01 +0000

See <https://emilymstark.com/2020/10/24/strict-transport-security-vs-https-resource-records-the-showdown.html>. Emily is a well-known developer on the security side of Chrome browser development.

--Paul Hoffman

---

From: "Ralf Weber" <[email-masked]>
Date: Mon, 26 Oct 2020 08:41:57 +0100

Moin!

On 25 Oct 2020, at 21:21, Paul Hoffman wrote:

> See 
> <https://emilymstark.com/2020/10/24/strict-transport-security-vs-https-resource-records-the-showdown.html>. 
> Emily is a well-known developer on the security side of Chrome browser 
> development.
Upgrading the user to https is only one use case for the HTTPS resource 
record. In fact it is not the required behaviour as all of my HTTPS RR 
testing so far has been with http as I didn’t want to get certificates 
for the 10+ domains with different behaviour I created.  Works fine with 
the current clients (iOS 14/MacOS 11). It also solves the CNAME at the 
APEX problem and allows more options for transport before the initial 
setup of the connection.

I also think that any list hardcoded in browser/OS deployments is a bad 
idea for a long term solution (that include auto upgrades of DoH servers 
;-) and it looks like STS has already shown that. DNS being an 
distributed mechanism is far better suited as it does not require an 
update of the end device.

Just my .02 cents as a DNS guy ;-).

So long
-Ralf
——-
Ralf Weber

---

From: Vittorio Bertola <[email-masked]>
Date: Mon, 26 Oct 2020 10:54:28 +0100 (CET)

> Il 26/10/2020 08:41 Ralf Weber <[email-masked]> ha scritto:
> 

In fact, this "client-side hardcoded list vs TOFU discovery vs dynamic discovery via DNS" discussion - also addressed by the post - comes up quite often in a number of different places (HTTPS, DoH, DANE/MTA-STS...). I also think that dynamic discovery is better and is the only solution fully in line with the decentralized nature of the Internet, but I see the performance and security advantages of hardcoding some values that are known to be valid and stable (e.g., in the case of HTTPS, Google could do that for their own properties). Perhaps a general analysis and best practice document on this topic could be useful.

-- 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked] 
Office @ Via Treviso 12, 10144 Torino, Italy