Subject: [hrpc] Comments on draft-irtf-hrpc-anonymity-00

From: Wendy Seltzer <[email-masked]>
Date: Wed, 11 Jul 2018 18:41:44 -0400

Long-delayed better than never! Here are some comments on the anonymity
draft:

1. Intro

Reference k-anonymity and differential privacy.
https://dataprivacylab.org/dataprivacy/projects/kanonymity/paper3.pdf
https://dl.acm.org/citation.cfm?id=2097284

especially differential privacy's notion of "auxiliary data" -- adding
more potentially linkable information to a data set reduces the
privacy/anonymity expectations of its subjects.

3. "Should protocols promote?"
An additional reason to promote anonymity as a primitive or starting
point is that it's more straightforward to build strong identity on top
of anonymity than to anonymize previously identified data, so we should
start on the anonymity side of the one-way gate, component by component.
Many attempts at de-identification fail (see, e.g. Narayanan and
Shmatikov; and Ohm,
https://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1016&context=hightechevents
). Whereas public key cryptography and biometrics can provide assurances
of identity when an individual chooses to be identified (or chooses an
interaction that requires proof of identity).

Like Nick, I don't think it's that "anonymity will always be a balancing
act" so much as that the policy goals of anonymity will often be in
tension with those of identification and accountability. If we/protocol
designers look more closely at the underlying policy goals, we may find
different means of satisfying them than "identity", such as
rate-limiting, moderation, and revocable pseudonymous tokens. See
Kapadia, https://www.cs.indiana.edu/~kapadia/papers/perea-tissec.pdf

5. Practical advice
It would probably help this section to find concrete examples where
anonymity considerations would be stronger than or different from the
existing privacy guidance. Perhaps from rtcweb and its IP handling?

Editorial (sec 1):
There are initiatives on the Internet to improve end users anonymity,
"...to improve the anonymity of end-users" would read more clearly.

Thanks,
--Wendy

-- 
Wendy Seltzer -- [email-masked] +1.617.715.4883 (office)
Strategy Lead, World Wide Web Consortium (W3C)
https://wendy.seltzer.org/        +1.617.863.0613 (mobile)