Subject: [Ltru] Security and nationality

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 28 Dec 2006 11:31:00 +0100

-02 currently says:

   Language tags used in content negotiation, like any other information
   exchanged on the Internet, might be a source of concern because they
   might be used to infer the nationality of the sender, and thus
   identify potential targets for surveillance.

I suggest a broader text:

   Language tags used in content negotiation, like any other information
   exchanged on the Internet, might be a source of concern because they
   might be used to infer private information about the sender, such
   as his or her nationality, and, in some cases, some of his or her
   political opinions or religious beliefs, and thus
   identify potential targets for surveillance.

Rationale: in countries like Moldavia or the former Yugoslavia, asking
for the cyrillic or the latin script is not innocent and is often tied
to political views.

_______________________________________________
Ltru mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ltru

---

From: "Jukka K. Korpela" <[email-masked]>
Date: Thu, 28 Dec 2006 13:46:52 +0200 (EET)

>   identify potential targets for surveillance.

The phrase "like any other information exchanged on the Internet" might be 
seen as watering down the statement. The text should deal with specifics, 
not vague generalities like "life is risky". I think the HTTP/1.1 protocol 
contains good formulations in clause 14.4,

"It might be contrary to the privacy expectations of the user to send an 
Accept-Language header with the complete linguistic preferences of the 
user in every request."

and in more detail in clause 15.1.4, see
http://www.w3.org/Protocols/rfc2616/rfc2616-sec15.html#sec15.1.4

>   identify potential targets for surveillance.

I think the idea of broadening is good but perhaps it sounds _too_
paranoic without some additional explanations. (I use the word "paranoic" 
loosely in an everyday sense and in the spirit of the Internet security 
guideline "paranoia is _good_".)

I'd say that nationality is personal information rather than private.

> for the cyrillic or the latin script is not innocent and is often tied

This reminds me of yet another possibility: for political reasons, a 
person might use a language tag containing a country id that is not 
official any more, such as YU or SU. While this would be intentional, it 
is not necessary something that the person wishes to disclose e.g. 
whenever visiting a web page. In general, the choice of an identifier for 
a language, country, or version of a language - either within officially 
defined alternatives or otherwise - may reveal information that is not 
meant to be revealed to the outside world.

In the so-called real world, we also have poorly written software that 
does very nasty things at times. In particular, the Thunderbird email 
program, following an old Netscape/Mozilla tradition, automatically 
inserts an X-Accept-Language header, with values taken from the settings 
in the Mozilla/Firefox web browser. It even includes that header into 
Usenet postings. Thus, information intended for selecting between 
different language versions of web pages is thereby sent, without 
informing the user, in all outgoing email and Usenet messages. This is of 
course all wrong, but it's probably not formally wrong by any 
specification.

Here's my suggestion, large written as a generalization of the HTTP/1.1 
formulation and with some of the suggested additions embedded in a way:

In content negotiation, language tags may reveal personal information
to a greater extent than intended and understood by the user. A list of 
language tags could be used to infer ethnic information, because the 
understanding of particular languages is often strongly correlated to the 
membership of a particular ethnic group. Moreover, subtags for country 
and script may be used to infer the user's nationality and even political,
religious, and other opinions and beliefs. The choice of a particular
country tag or other subtag, in cases of dispute, may itself constitute a 
political choice.

Thus, user agents that participate in content negotiation should inform 
the user about the use of language preferences settings and should let the 
user control whether and how the preferences are sent in Internet message 
headers.

An approach that limits the loss of privacy would be for a user agent to 
omit the sending of language preferences information by default, and to 
ask the user whether or not to start sending it if it detects a situation 
where such sending could improve the quality of service, such as a 
Vary header in a response from a web server.

-- 
Jukka "Yucca" Korpela, http://www.cs.tut.fi/~jkorpela/

---

From: John Cowan <[email-masked]>
Date: Thu, 28 Dec 2006 12:22:04 -0500

> for the cyrillic or the latin script is not innocent and is often tied

+1

-- 
John Cowan   [email-masked]   http://ccil.org/~cowan
I must confess that I have very little notion of what [s. 4 of the British
Trade Marks Act, 1938] is intended to convey, and particularly the sentence
of 253 words, as I make them, which constitutes sub-section 1.  I doubt if
the entire statute book could be successfully searched for a sentence of
equal length which is of more fuliginous obscurity. --MacKinnon LJ, 1940

---

From: Addison Phillips <[email-masked]>
Date: Thu, 28 Dec 2006 10:20:37 -0800

This text dates from and is unchanged from RFC 1766. I agree that the 
information inferred from language tags is broader than the 
"nationality", if one narrowly defines "nation" as synonymous with 
"nation-state"--a notion that is increasingly quaint in an era of 
revived "tribalism".

Plus, I think the proposed edit is rather unwieldy. Perhaps:

--
Languages and language variations are often closely associated with 
specific social, national, or ethnic affinities. Thus, language tags 
used in content negotiation, like other information exchanged on the 
Internet, might be a source of concern because they might be used to 
infer information about the sender and thus identify potential targets 
for surveillance.
--

Best Regards,

Addison

-- 
Addison Phillips
Globalization Architect -- Yahoo! Inc.

Internationalization is an architecture.
It is not a feature.

---

From: Frank Ellermann <[email-masked]>
Date: Fri, 29 Dec 2006 00:11:18 +0100

Okay.  Jukka's proposal is also fine (maybe a bit long).  I like the
keyword "private" in Stephane's version (Jukka has "personal", you've
only "information").

Frank