Subject: [RRG] perceived privacy issue

From: RJ Atkinson <[email-masked]>
Date: Tue, 8 Jul 2008 15:13:13 -0400

Earlier, Tony Li wrote:
% 2/ also creates a significant security issue.
% If a MAC address is visible outside of the local subnet,
% then it implies that someone can track a host
% as it migrates across the Internet.

If a flat Node Identifier isn't visible to correspondents
outside the local subnet, then it isn't terribly useful
to have a flat Node Identifier.

One of the objectives of an Identifier is for it to be
widely visible to (potential) correspondents.  That way,
if either party moves, the session that has been bound
to the Identifiers can remain up, even though one or
both locations have changed.  This is crucial to both
multi-homing and mobility deployments.

% That's been widely discussed during
% the first iteration of GSE and pretty generally viewed
% as a Bad Idea. At the very least, there needs to be a
% mechanism to escape from the MAC address and jump
% to a separately assigned space.

This concern is misplaced, and there is nothing magic
here about a MAC as the Identifier.  Any Identifier
will have the same essential properties.

Traffic analysis techniques have been employed commercially
since at least the middle 1990s to track users -- even users
that change IP addresses often.  I understand that such methods
continue to be used (and continue to be effective) by a number
of firms on the network.  Note that these methods can track
"users", and are not limited to just tracking "nodes".

While I don't have a URL to hand just this minute, I understand
that recent work at U. Cambridge of late has put additional
network traffic analysis methods into the published literature.

I don't object per se to an "escape mechanism", but I do NOT
believe that there is any real privacy benefit to such a mechanism.
I feel similarly about the IPv6 Privacy Extensions (sic),
which have similar levels of (in)effectiveness.

Yours,

Ran
[email-masked]

--
to unsubscribe send a message to [email-masked] with the
word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/rrg/> & ftp://psg.com/pub/lists/rrg

---

From: "Tony Li" <[email-masked]>
Date: Tue, 8 Jul 2008 13:03:42 -0700

|% That's been widely discussed during
|% the first iteration of GSE and pretty generally viewed
|% as a Bad Idea. At the very least, there needs to be a
|% mechanism to escape from the MAC address and jump
|% to a separately assigned space.
|
|This concern is misplaced, and there is nothing magic
|here about a MAC as the Identifier.  Any Identifier
|will have the same essential properties.

Any identifier space is necessarily going to confront the same issues, it's
true, and require some means of hosts being able to change identifiers at
some point in time.  Obviously, anything associated with the old identifier
is lost in a change, so there is a non-zero cost involved.

|Traffic analysis techniques have been employed commercially
|since at least the middle 1990s to track users -- even users
|that change IP addresses often.  I understand that such methods
|continue to be used (and continue to be effective) by a number
|of firms on the network.  Note that these methods can track
|"users", and are not limited to just tracking "nodes".
|
|While I don't have a URL to hand just this minute, I understand
|that recent work at U. Cambridge of late has put additional
|network traffic analysis methods into the published literature.
|
|I don't object per se to an "escape mechanism", but I do NOT
|believe that there is any real privacy benefit to such a mechanism.
|I feel similarly about the IPv6 Privacy Extensions (sic),
|which have similar levels of (in)effectiveness.

While I cannot disagree with you technically, it does seem to me that those
advocating privacy will definitely raise the issue and that any eventual
engineering solution will need to provide some mechanism for addressing
those concerns, misplaced or not.

Tony

---

From: "William Herrin" <[email-masked]>
Date: Tue, 8 Jul 2008 18:14:56 -0400

> will have the same essential properties.

You are mistaken. As a former employee of comScore (the leading
Internet measurement firm) I can assure you that the concern is most
decidedly *NOT* misplaced.

Furthermore, global publication of the MAC address also theoretically
permits identification of the make, model and firmware revision of the
NIC with a high probability of success. Coupled with an OS
fingerprint, it offers identification of the exact running driver with
a high probability of success. Both are useful knowledge when
attempting to breach a system.

> "users", and are not limited to just tracking "nodes".

This does not accurately describe the state of the art. I can't go
into any detail without breaching a confidentiality agreement, but in
IPv4 the ability to mass-discriminate an individual home PC's traffic
day over day based on the contents of the network traffic alone is
very limited.

Regards,
Bill Herrin

P.S. Just to be clear: I found the folks at comScore to be -very-
ethical in their behavior. Nothing I wrote here should be taken to
suggest otherwise.

-- 
William D. Herrin ................ [email-masked] [email-masked]
3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004

---

From: Peter Sherbin <[email-masked]>
Date: Tue, 8 Jul 2008 16:39:05 -0700 (PDT)

> true, and require some means of hosts being able to change
> identifiers at some point in time.

Is that a must have? E.g. one could think of many useful applications where an identifier never changes during a life time of the id bearer.
Isn't it the whole purpose of an id after all?

Thanks,

Peter

--- On Tue, 7/8/08, Tony Li <[email-masked]> wrote:

> From: Tony Li <[email-masked]>
> Subject: RE: [RRG] perceived privacy issue
> To: "'RJ Atkinson'" <[email-masked]>, "'IRTF Routing RG'" <[email-masked]>
> Date: Tuesday, July 8, 2008, 4:03 PM