Subject: [dhcwg] draft-huitema-dhc-anonymity-profile

From: "Bernie Volz (volz)" <[email-masked]>
Date: Sun, 22 Mar 2015 23:44:05 +0000

Christian:

The draft looks good.

However, in section 3 you did not mention the PRL (and also 4.4 for the ORO) and about how device detection using the PRL/ORO are possible (see https://github.com/inverse-inc/fingerbank and http://www.fingerbank.org/). These may be worth mitigating? Techniques might include randomly ordering the PRL/ORO option list and/or randomly including some options that are not desired (picking options to request should be done carefully as picking random numbers might trigger unexpected processing by the server).

We may also want to mention the fingerprinting issue in the Privacy Considerations drafts. (I'm not sure whether anyone has built a database for DHCPv6 clients yet.)

In 4.6, what about Option 17, Vendor-specific Information Option? (In section 3.8 for DHCPv4, you mentioned the DHCPv4 equivalent.)

-          Bernie