Subject: RE: [Ltru] WGLC security considerations

From: "Addison Phillips" <[email-masked]>
Date: Tue, 16 Aug 2005 12:03:22 -0700

I agree that "sender" is not the most specific term and that it is possible to envision, for example, DoS attacks on a site because of its content (and that such attacks might be automated based on language tags at that site). But the more we add, the less and less clear the text becomes. Enumerating the reasons for malfeasance doesn't strike me as a worthwhile exercise; such a list cannot be complete in any event.

The matching draft can be more explicit about this, since ranges and tags naturally must dovetail for any kind of surveillance or attack.

I would tend to suggest that, if there were actually a need to modify the text (and I don't really think there is: there isn't much difference in what I'm about the propose), that the change could be the rather plain text suggested below (insertions vs. draft-11 between /* */):

--
Language tags used in content negotiation, like any other information exchanged on the Internet, might be a source of concern because they might be used to infer /*, for example, information about the content or about */ the nationality of the sender, and thus identify potential targets for surveillance /* or attack */.
--

Addison P. Phillips
Globalization Architect, Quest Software
Chair, W3C Internationalization Core Working Group

Internationalization is not a feature.
It is an architecture. 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Peter Constable
> Sent: 2005?8?16? 11:44
> To: [email-masked]
> Subject: RE: [Ltru] WGLC security considerations
> 
> > From: [email-masked] [mailto:[email-masked]]
> On Behalf Of
> > Jefsey Morfin
> 
> > The concern of security is only related in this text to the sending host
> -
> > which is the least threat since it may be identified in many other ways.
> 
> While I agree that there is greater concern in content negotiation in
> relation to the requester than the provider, "sender" in this case may be
> either party: the requester sends a request that includes a particular
> language tag, and the provider sends a response (a negotiation header or
> content) that includes a language tag.
> 
> 
> > This text does not consider the intelligence which may be gathered on
> the
> > receiver and the impact on the content.
> 
> True, inferences might also be made about the receiver.
> 
> 
> > I think the following text would be more appropriate:
> 
> I'd be open to a change along the lines suggested.‎ I don't think a change
> is essential for completion of this milestone, though. I agree with
> Randy's recent comment that will always be improvements that can be made,
> and we just need to cut things off at some point. ‎If there are other
> changes pending, I'd suggest the text below. If there are no other ‎changes
> to be made, however, I'd suggest the following text be used for revision
> in ‎‎3066ter.‎
> 
> 
> ‎"Like any other information exchanged on the Internet, language tags
> exchanged with content or in content negotiation may present a security
> risk to the extent that they might be ‎used to infer information about the
> sender or receiver. Specifically, they may be used to infer linguistic,
> ethnic or national identity of users, or the interests of users or content
> providers. They could be used as a basis for selecting targets of
> information gathering, for controlling information exchange for political
> or other such purposes, or for other actions outside of the network
> context."
> 
> 
> 
> Peter Constable
> 
> _______________________________________________
> Ltru mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ltru

_______________________________________________
Ltru mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ltru

---

From: "Peter Constable" <[email-masked]>
Date: Tue, 16 Aug 2005 12:14:38 -0700

I sent my previous msg before seeing Randy's notice regarding closure of
the WG last call. (I actually started writing it earlier, but was
interrupted.) I do not wish to see the WG last call re-opened. I would
be open to the revision I've suggested during the IETF last call.

Peter Constable

---

From: "Peter Constable" <[email-masked]>
Date: Tue, 16 Aug 2005 13:50:44 -0700

On Behalf Of
> Randy Presuhn

> As a technical contributor, I strongly object to the addition of such
text.
> The receipt of a language tag permits no inferences about the
recipient.

One cannot make a valid logical deduction, but one can certainly infer
anything one wants to infer -- in the sense of merely drawing a
conclusion (valid or not). See the fourth sense below:

in*fer:
 
1.  vti conclude something on the basis of reasoning: to conclude
something on the basis of evidence or reasoning  
2.  vt suggest: to suggest or lead to something as a conclusion  
3.  vt imply: to imply or suggest something  
4.  vt guess something: to make a reasonable guess at something  

The point is, if I discover that party X is receiving Vietnamese
content, I may choose to conclude on that basis alone that X is
Vietnamese and take actions based on that.

To the extent that one cannot validly deduce anything about a recipient,
the same is true of a sender: just because X sends out Vietnamese
content doesn't tell us for certain that X is Vietnamese. X may be
sending Vietnamese content for any number of reasons. Again, the point
is that someone may choose to draw conclusions about X on that basis
alone and take actions based on that.

> If security considerations need to include things like "attackers may
draw
> unfounded conclusions from a monitored stream", we've gone to a truly
> surreal threat model.

Well, on that basis, perhaps we might as well revert to what RFC 1766
had to say about security:

<quote>
6.  Security Considerations

   Security issues are not discussed in this memo.
</quote>

:-)

Actually, a better course would be to say:

- nothing can be deduced with certainty about sender or receiver

- nevertheless, some might make assumptions about sender or receiver and
on that basis engage in targeted information gathering or attack

Peter Constable