Subject: [BEHAVE] IP address status in Europe

From: Francis Dupont <[email-masked]>
Date: Tue, 29 Mar 2011 17:10:56 +0200

As I said it is too late in Europe to convince lawyers they are wrong
(if you know a way to convince a lawyer or a journalist about a
technical point :-), for instance:

http://bits.blogs.nytimes.com/2008/01/22/europe-your-ip-address-is-personal/

Worst, I am really afraid this could give as feelings for end-users,
we already had a lot of bad feedlings for IPv6 interface ID, and
this has clearly more solid basis.

Regards

[email-masked]

---

From: <[email-masked]>
Date: Wed, 30 Mar 2011 08:01:31 +0200

Hi Francis,

I think that we are focusing too much on the IP layer while personal information is leaked somewhere else. I invite you to do the test available at: https://panopticlick.eff.org/.

Cheers,
Med 

-----Message d'origine-----
De : [email-masked] [mailto:[email-masked]] De la part de Francis Dupont
Envoyé : mardi 29 mars 2011 17:11
À : [email-masked]
Objet : [BEHAVE] IP address status in Europe

Regards

[email-masked]
_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave

---

From: Scott Brim <[email-masked]>
Date: Wed, 30 Mar 2011 08:19:00 +0200

Mohamed: Are you saying confidentiality is already lost so don't
bother?  Since the barbarians are sneaking in a side door we might as
well open all of the castle gates and invite them in for dinner?
Pardon my rhetoric, but it is still possible to fix the higher layer
leaks, and in the meantime we can avoid degrading the IP layer.

As a general principle: we must not design the Internet such that
privacy is impossible.  Privacy can be voluntary, but it must be an
option.

For example, we must not require a user to use the same persistent
identifiers in every packet, or register a mapping between IP address
and any persistent identifier in DNS in order to be reachable.

Thanks ... Scott

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 30 Mar 2011 19:32:25 +1300

In any case, the point Francis was making, I think, is that
it doesn't matter what we think. If the EU legislators believe
that IP addresses are private information, then they *are*
private information, by law. Of course, the same applies even more
strongly to any kind of  Host ID - it inevitably will become protected
by privacy legislation as soon as the legislators are aware of it.

Regards
   Brian Carpenter

---

From: <[email-masked]>
Date: Wed, 30 Mar 2011 08:48:51 +0200

Dear Scott,

The point I wanted to make is that as a user I have more concern about the leak of my informational information (e.g., name, login, profiles, personal url, etc) at the application layer than revealing my source IP address (which is not IMO a privacy concern; since in today's internet my IP address is seen by the servers!).

I'm more concerned about the usage of some http headers such as referrer, etc.

You can find more reading at:

I know what you will do next summer
Balachander Krishnamurthy
ACM SIGCOMM Computer Communication Review, Volume 40, Number 5, October 2010

Privacy Leakage in Mobile Online Social Networks
Balachander Krishnamurthy and Craig Wills
Proceedings of Workshop on Online Social Networks, June 2010

Prediction Promotes Privacy In Dynamic Social Networks
Smriti Bhagat, Graham Cormode, Balachander Krishnamurthy, Divesh Srivastava
Proceedings of Workshop on Online Social Networks, June 2010

How much is too much? Privacy issues on Twitter
Lee Humphreys, Phillipa Gill, Balachander Krishnamurthy
Conference of International Communication Association, June 2010

On the Leakage of Personally Identifiable Information Via Online Social Networks
Balachander Krishnamurthy and Craig Wills
Proceedings of ACM SIGCOMM Workshop on Online Social Networks, August 2009

Privacy Diffusion on the Web: A Longitudinal Perspective
Balachander Krishnamurthy and Craig E. Wills
Proceedings of the World Wide Web Conference, April 2009

Characterizing Privacy in Online Social Networks
Balachander Krishnamurthy and Craig Wills
Proceedings of ACM SIGCOMM Workshop on Online Social Networks, August 2008

Measuring privacy loss and the impact of privacy protection in Web browsing
Balachander Krishnamurthy and Delfina Malandrino and Craig E. Wills
Proceedings of the Symposium on Usable Privacy and Security, July 2007

Generating a Privacy Footprint on the Internet
Balachander Krishnamurthy and Craig Wills
Proceedings of IMC 2006, October 2006 

BTW, I agree with you general principal but if applied at all levels and if there is a "coordination" between layers. This big-picture view of privacy is missing.

Cheers,
Med

-----Message d'origine-----
De : Scott Brim [mailto:[email-masked]] 
Envoyé : mercredi 30 mars 2011 08:19
À : BOUCADAIR Mohamed OLNC/NAD/TIP
Cc : Francis Dupont; [email-masked]
Objet : Re: [BEHAVE] IP address status in Europe

Thanks ... Scott

---

From: Scott Brim <[email-masked]>
Date: Wed, 30 Mar 2011 08:49:44 +0200

On Wed, Mar 30, 2011 at 08:32, Brian E Carpenter
<[email-masked]> wrote:
> private information, by law.

Well, yes :-).

> Of course, the same applies even more

It doesn't have to be that way.  Use of a "host ID', or any other
identifier at any level, doesn't have to clash with privacy.  The
trick is to design the Internet and its protocols such that
identifiers don't have to be leaked outside of their scopes of
confidentiality (note that concept, scope of confidentiality, it's
pivotal), and then to discipline Internet services to use identifiers
only within their scope of confidentiality.  Pardon me, as you can see
this is something I easily get riled up about.  See privacy work going
on elsewhere e.g. IAB.

Scott

---

From: Scott Brim <[email-masked]>
Date: Wed, 30 Mar 2011 08:55:03 +0200

> The point I wanted to make is that as a user I have more concern about the leak of my informational information (e.g., name, login, profiles, personal url, etc) at the application layer than reveal…

Yes, me too.  Sorry.  I just want to be sure that while we are
fighting those battles, we do not design away even the possibility of
privacy in the lower layers.

Thanks ... Scott

---

From: Christian Huitema <[email-masked]>
Date: Wed, 30 Mar 2011 06:57:59 +0000

> The point I wanted to make is that as a user I have more concern about the leak of my informational information (e.g., name, login, profiles, personal url, etc) at the application layer than reveal…

That's indeed an issue. But application level information should be dealt with by application level developers. And at least some are indeed doing that, if we see the work on deployment of encryption or on privacy filters in various web browsers. On the other hand, nobody but us deals with the IP addresses, so it is indeed our job to get that one right.

By the way, it is not just the network layer. You can see information leakage at lower layers as well. Some EAP variants can leak identities. (The better EAP variants are protected.) The Wi-Fi clients that attempt to connect to "hidden networks" broadcast their home network SSID. Many host will tell a lot of information inside their DHCP requests. Many hosts emit a pattern of DNS requests when they start up or when they connect to a new network. 

It may be a game of whack-a-mole, but it is time for every IETF group to start whacking their respective moles...

-- Christian Huitema

---

From: Scott Brim <[email-masked]>
Date: Wed, 30 Mar 2011 09:15:53 +0200

> By the way, it is not just the network layer. You can see information leakage at lower layers as well. Some EAP variants can leak identities. (The better EAP variants are protected.) The Wi-Fi clie…

and I'm told that GSM sends IMSIs in the clear, for anyone to read.

> It may be a game of whack-a-mole, but it is time for every IETF group to start whacking their respective moles...

Yes!

(Also we need to whack the occasional regulatory moles.  They have
assumptions about technology that are sometimes just wrong.  One of
the foundations of a successful Internet is creating a good cultural
and policy environment for it.)

OK I'll shut up now.

Thanks ... Scott

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 30 Mar 2011 20:52:27 +1300

Scott,

On 2011-03-30 19:49, Scott Brim wrote:
> only within their scope of confidentiality.  

I suspect that is exactly what the legislator is likely to require,
for any 'magic number' that is specific to an individual customer.

   Brian

Pardon me, as you can see

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 30 Mar 2011 11:27:11 +0200

> private information, by law.

Believe me, things aren't that simple.

Also I don't know if "private information" is a good term here. In Dutch we say "persoonsgegeven", which translates as "personally identifiable information". In other words, any piece of information that identifies a person.

There have been huge discussions on whether an IP address is that. There have been a few court decisions in Europe but those tend to ignore relevant information such as the lease time and whether NAT is involved. But even if IP addresses are personally identifiable information, that doesn't mean you never get to see or use it under any circumstances. An address or phone number certainly fall in this category yet these are widely used and stored. Or even sold.

About a host identifier: one way to avoid many issues here would be to have a different one for each site. So when I talk to Google and Bing they don't see a request coming from "iljitsch' computer" but from sha256("Google", "iljitsch' computer", "Google") and sha256("Bing", "iljitsch' computer", "Bing"). (I put the service in there twice to thwart precomputation attacks.)

Cookies also have this limitation. Of course the use of ad networks largely invalidates that layer of protection, which is a source of concern both for existing stuff and future stuff.

---

From: Francis Dupont <[email-masked]>
Date: Wed, 30 Mar 2011 11:36:20 +0200

In your previous mail you wrote:

   I think that we are focusing too much on the IP layer while
   personal information is leaked somewhere else.

=> CGNs are L3/4 beasts so I can't see why to focus on IP and transport
layers are bad. And if a CGN does something perceived as wrong for
privacy the ISP will be sued, so as an ISP employee this should be
important. And it is clearly in the scope of BEHAVE.

   I invite you to do the test available at: https://panopticlick.eff.org/.

=> I don't want to imagine what the EFF could think about HOST_ID and
other anti-privacy proposals...
More seriously the fact some act badly is never an excuse to act badly
yourself.

Regards

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 30 Mar 2011 12:05:11 +0200

>   I invite you to do the test available at: https://panopticlick.eff.org/.

Hm, I find this suspicous: it tells me my iPhone is unique among 1.5 million systems tested so far. Yet the iPhone doesn't allow the user to install any fonts or plugins. So apparently it's mostly the combination of the user agent string (new version of the iPhone firmware came out a few days ago) and my timezone that makes me unique. I'm not impressed.

Of course on the desktop the fonts and plugins do make it possible to really fingerprint your system.