Subject: Re: [Model-t] Minimization

From: Jari Arkko <[email-masked]>
Date: Tue, 8 Mar 2022 18:02:39 +0200

Hi Martin, hi all,

Just wanted to send an update that there’s a new version of the minimization draft, inspired largely by your comments Martin. I like the direction of making smaller number of statements and shorter overall text, and focusing of course on established principles. Comments appreciated.

The draft is available here:

Name:		draft-arkko-iab-data-minimization-principle
Title:		Data minimization
URL:            https://www.ietf.org/archive/id/draft-arkko-iab-data-minimization-principle-01.txt <https://www.ietf.org/archive/id/draft-arkko-iab-data-minimization-principle-01.txt>
Htmlized:       https://datatracker.ietf.org/doc/html/draft-arkko-iab-data-minimization-principle <https://datatracker.ietf.org/doc/html/draft-arkko-iab-data-minimization-principle>
Diff:           https://www.ietf.org/rfcdiff?url2=draft-arkko-iab-data-minimization-principle-01 <https://www.ietf.org/rfcdiff?url2=draft-arkko-iab-data-minimization-principle-01>

Jari

---

From: <[email-masked]>
Date: Wed, 16 Mar 2022 11:03:42 -0400

> Just wanted to send an update that there’s a new version of the
> minimization draft, inspired largely by your comments Martin. I like the
> direction of making smaller number of statements and shorter overall
> text, and focusing of course on established principles. Comments
> appreciated.

A few possible interesting points to include ... I can provide text suggestions if it's useful.

-- Reducing the amount of information shared between devices/subsystems within a larger system not only increases security, it also protects privacy.
-- Reducing the amount of information shared (the depth of the interaction surface) can help to reduce coupling between subsystems, hence increasing system resilience while also increasing security.
-- Reducing the amount of information shared also reduces the attack surface by reducing the amount of control an attacker might gain over any given subsystem through a given interface.
-- Reducing the number of places (physical or logical) in the system where information is shared (the breadth of the interaction surface) can help reduce the attack surface in meaningful ways.
-- For both privacy and security, care should be taken to _destroy_ information in a timely manner ... protocols should be designed, where possible (it's not always possible), to not rely on information being present "forever."
-- Not only should the minimal amount of information be shared, the most abstract, or least specific, information should be shared to "get the job done."

I don't know if all of these are useful or not, just throwing them out there for discussion.

😊 /r

---

From: "Martin Thomson" <[email-masked]>
Date: Thu, 17 Mar 2022 10:50:53 +1100

All of these are good points.

There is also performance to consider.  Smaller = faster, even if we don't notice the effect on a single interactions, at the scale of the Internet it can matter.  At the point that you avoid sending an extra packet, you have a massive impact.

On Thu, Mar 17, 2022, at 02:03, [email-masked] wrote:
> -- Reducing the amount of information shared between devices/subsystems 
> within a larger system not only increases security, it also protects 
> privacy.
> -- Reducing the amount of information shared (the depth of the 
> interaction surface) can help to reduce coupling between subsystems, 
> hence increasing system resilience while also increasing security.
> -- Reducing the amount of information shared also reduces the attack 
> surface by reducing the amount of control an attacker might gain over 
> any given subsystem through a given interface.
> -- Reducing the number of places (physical or logical) in the system 
> where information is shared (the breadth of the interaction surface) 
> can help reduce the attack surface in meaningful ways.
> -- For both privacy and security, care should be taken to _destroy_ 
> information in a timely manner ... protocols should be designed, where 
> possible (it's not always possible), to not rely on information being 
> present "forever."

This, I think, strays a little from the central thesis.

> -- Not only should the minimal amount of information be shared, the 
> most abstract, or least specific, information should be shared to "get 
> the job done."

Isn't this just data minimization too?

---

From: Mirja Kuehlewind <[email-masked]>
Date: Thu, 17 Mar 2022 19:12:28 +0100

I agree these are good points!

I also just had a quick read and to me it seem that there might also be a point about identity. Often information is only sensitive if it can be associated to a certain identify, so providing data in an anonymous way whenever possible might also be a good approach. Not sure if this belongs in this document or if that is a separate point….

> On 17. Mar 2022, at 00:50, Martin Thomson <[email-masked]> wrote:
> 
> -- 
> Model-t mailing list
> [email-masked]
> https://www.iab.org/mailman/listinfo/model-t

---

From: Christian Huitema <[email-masked]>
Date: Thu, 17 Mar 2022 12:18:16 -0700

> I also just had a quick read and to me it seem that there might also be a point about identity. Often information is only sensitive if it can be associated to a certain identify, so providing data…

Yes, but there are also many examples of allegedly anonymized datasets 
that were then shown to contain enough information to identify the 
subjects. If we want to say something like that, then we need to be 
rather cautious, and distinguish between statistics and hidden 
identities. Saying "out of 1,000,000 connections, we observed that 10% 
had a delay larger than 100 ms" is one thing. Having data on individual 
sessions, even without explicitly storing PII, is another.

The flip side of that is of course debugging. It is hard to debug a 
complex failure without extensive data, such as a trace of all packets 
in a connection...

-- Christian Huitema