Subject: [Geopriv] Identity and IP address considerations

From: "Rosen, Brian" <[email-masked]>
Date: Tue, 28 Jul 2009 03:38:26 -0400

In the HELD Identity draft, one of the uses is a 3rd party OBO request
for location.  An example use case is interim deployment of VoIP
emergency calls, before the device is upgraded to query a LIS via an LCP
itself.  It will be common to use an IP address in this case.

The draft does not discuss the cautions we have long discussed when
using an IP address as an identifier.  It's quite clear that an IP
address WILL be used for this case, and denying it is silly.
Considerations for its use should be provided.  I think we want text
that discusses issues such as the effect of NAT and VPNs, perhaps a
discussion of needing return routability testing to assure the 3rd party
that it has a good IP address, etc.

Some of the latter considerations may also apply to other forms of
identity that may be used with this draft.

Brian

---

From: Richard Barnes <[email-masked]>
Date: Tue, 28 Jul 2009 11:06:49 +0200

It seems like the risks of IP addresses as identifiers are pretty 
well-trodden territory.  How would your notional text differ from what's 
already in l7-lcp-ps and HELD?
--Richard

Rosen, Brian wrote:
> _______________________________________________
> Geopriv mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/geopriv
>

---

From: "Rosen, Brian" <[email-masked]>
Date: Tue, 28 Jul 2009 07:37:34 -0400

Well, first of all the draft has no discussion of the issues, even the
references to HELD and l7-lcp-ps (for this subject).  Then, I think the
issues for 3rd party use of IP as an identifier is different somewhat
from first party use.  Among other things, for example, a device can
often bypass a VPN, whereas the 3rd party can't.

Brian

> -----Original Message-----
> From: Richard Barnes [mailto:[email-masked]]
> Sent: Tuesday, July 28, 2009 5:07 AM
> To: Rosen, Brian
> Cc: [email-masked]
> Subject: Re: [Geopriv] Identity and IP address considerations
>

---

From: "Thomson, Martin" <[email-masked]>
Date: Tue, 28 Jul 2009 06:53:30 -0500

So I can work with this.  It's not an insurmountable problem.

Basically, we need to mention that the authorized third party and the LIS/LS need to have a shared understanding of any identifier, and that IP addresses can be masked in a way that would prevent this.  NAT and VPN can cause problems.  We also need to mention that some identifiers are transient.

To some extent this is in l7-lcp-ps, but a short description of these properties would not hurt.

There is some discussion on the issue of transience with respect to port numbers, but more general guidance as well as specific guidance on each identifier might be useful.

I can take a stab at this in the next revision.

--Martin

> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Rosen, Brian
> Sent: Tuesday, 28 July 2009 1:38 PM
> To: Richard Barnes
> Cc: [email-masked]
> > > emergency calls, before the device is upgraded to query a LIS via
> an
> > LCP

------------------------------------------------------------------------------------------------
This message is for the designated recipient only and may
contain privileged, proprietary, or otherwise private information.  
If you have received it in error, please notify the sender
immediately and delete the original.  Any unauthorized use of
this email is prohibited.
------------------------------------------------------------------------------------------------
[mf2]

---

From: "Winterbottom, James" <[email-masked]>
Date: Tue, 28 Jul 2009 17:55:42 -0500

Hi Martin et al,

I would prefer to see the milestones created and the documents, as they
are, posted prior to these changes being made. This ensures that the
baseline that people agreed to in the meeting is the same as the
baseline that gets posted.

Cheers
James

> From: [email-masked] [mailto:[email-masked]] On
Behalf
> Of Thomson, Martin
> Sent: Tuesday, 28 July 2009 9:54 PM
> To: Rosen, Brian; Richard Barnes
> Cc: [email-masked]
> Basically, we need to mention that the authorized third party and the
> LIS/LS need to have a shared understanding of any identifier, and that
IP
> addresses can be masked in a way that would prevent this.  NAT and VPN
can
> cause problems.  We also need to mention that some identifiers are
> transient.
> 
> There is some discussion on the issue of transience with respect to
port
> numbers, but more general guidance as well as specific guidance on
each
> identifier might be useful.
> 
> > > > discussion of needing return routability testing to assure the
3rd
> > > party
------------------------------------------------------------------------
--
> ----------------------
------------------------------------------------------------------------
--
> ----------------------