Subject: [homenet] privacy vs subnet-id

From: Michael Richardson <[email-masked]>
Date: Mon, 14 Nov 2011 21:26:30 -0500

Brian Carpenter raised the point at the mic that we have to pay
attention to privacy when it comes to the subnet-id.  We shouldn't make
it possible for members of the household to spy on each other.

My understanding of the purpose of RFC4941 privacy extensions is to make
is hard for an (off-path) observer (including web server operator) to
trivially track a user from location to location by their EUI-64. 

The question is, do we have any similar requirements that we want to
apply to subnet-id.  The example that Brian gave in XMPP was:

BEC> And if you have a separate subnet for the kids' bedroom...
BEC> 'Honey, one of the kids is using Facebook again'

if there is only one possible host on a particular subnet, then RFC4941
can't help disguise who is doing what.  

My question is: what is the real issue here.  It seems that the kind of
things that 4941 deals with, are neither better nor worse.  But maybe
there are other things that we need to concern ourselves with.

-- 
]       He who is tired of Weird Al is tired of life!           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
   Kyoto Plus: watch the video <http://www.youtube.com/watch?v=kzx1ycLXQSE>
	               then sign the petition.

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 15 Nov 2011 15:53:31 +1300

> there are other things that we need to concern ourselves with.

Waxing philosophical, you can obfuscate an ID but you can't obfuscate
a locator. I really don't see a way out of this. If the admin can
run Wireshark, she can see the locator.

    Brian

---

From: Tim Chown <[email-masked]>
Date: Tue, 15 Nov 2011 03:03:34 +0000

So at the moment all the arch text says on privacy is:
   Privacy considerations

      There are no specific privacy concerns for this text.  It should
      be noted that most ISPs are expected to offer static IPv6 prefixes
      to customers, and thus the addresses they use would not generally
      change over time.
What would you like to say here instead?

Note 4941 isn't just about source address from location to location but also source address over time.

The LNP for IPv6 text (RFC4864) talks about this issue a bit, but this is more about obfuscating the topology externally to the user's network, rather than internally.   In my view we should probably only consider a similar perspective here?

Tim

On 15 Nov 2011, at 02:53, Brian E Carpenter wrote:

> _______________________________________________
> homenet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/homenet

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 15 Nov 2011 16:20:49 +1300

> What would you like to say here instead?

Maybe point out that a homenet can be protected against external privacy
threats (possibly citing 4864 etc) but that whatever hosts do, the homenet
admin has the capability to perform traffic analysis down to the subnet level.

    Brian

> ------------------------------------------------------------------------
>

---

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Tue, 15 Nov 2011 05:35:49 +0100

> admin has the capability to perform traffic analysis down to the subnet level.
And I think it MUST have that capability to avoid problems arising from any abuse originated there, especially at the guest subnet...

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D

e-mail: [email-masked]
Tel:      +34 913 129 041
-----------------------------------------

Este mensaje se dirige exclusivamente a su destinatario. Puede consultar nuestra política de envío y recepción de correo electrónico en el enlace situado más abajo.
This message is intended exclusively for its addressee. We only send and receive email on the basis of the terms set out at.
http://www.tid.es/ES/PAGINAS/disclaimer.aspx

---

From: Fred Baker <[email-masked]>
Date: Wed, 16 Nov 2011 07:30:31 +0800

> admin has the capability to perform traffic analysis down to the subnet level.

The admin can do traffic analysis to the individual host level, and can sniff traffic that comes by them.

Personally, I think that this is a place where privacy advocates need to think carefully about their position. In at least the US courts, there is a concept called a "reasonable expectation of privacy". If I have an object in my home or on my person, an investigator needs my permission or a court order to gain access to it; if it's in my trash bin on the street, I have no "reasonable" expectation of privacy, and the investigator is permitted to simply raid it. Someone that understands the Internet will tell you that stuff on your computer is hard to see outside the computer, but the minute you put it on a wire or its radio equivalent the fact that you did so is visible, and if it's not encrypted, the content is as well. If you are reachable on the Internet - if you have an address - I can traceroute and get some notion of where you are.

As you said, you can obfuscate an identifier, but not a locator.

Ways to obfuscate that sort of thing probably include TOR routing, but even that is tracable to a degree. If I am watching Bob, see a transfer of N bytes from Alice to Bob, and immediately thereafter see a transfer of approximately N bytes from Bob to Carol, I can infer that there is some likelihood that Alice is talking with Carol. Wars have been fought by traffic analysis...