Subject: Re: HOMENET working group proposal

From: Martin Rex <[email-masked]>
Date: Fri, 1 Jul 2011 20:07:24 +0200 (MEST)

james woodyatt wrote:
>
>                                     There is nothing about NAT or
> dynamic subscriber IP assignment that provides any mitigation
> whatsoever of the risks

I'm more than a little concerned by the message that you're sending
here.  European legislators have enacted a "E-Privacy Directive"
also dubbed "European Cookie Directive" in order to protect the
privacy of citizens, and you're suggesting here that the IETF
should actively subvert this legislation and similar ongoing
legislative initiatives in the US by assigning static IPv6
addresses to home DSL subscribers so that cookies are completely
obviated and everyone can be trivially tracked based on his
static IP-Address.  This means you want to make IPv6 addresses
and all communications with that address direct personally
identifiable information, something for which a "must informed
beforehand", let alone an "opt opt" is technically impossible?

james woodyatt wrote:
> 
> On Jun 30, 2011, at 18:46 , Martin Rex wrote:
> > 
> > And that [false police report incident] is really among
> > the mild unpleasant things...
> 
> It's also not even remotely relevant.  Under the regime where that
> incident happened, it's not even news anymore when the police do
> that without any provocation at all.

That regime where this happened was the US.  So you're declaring
the entire US out-of-scope and the entire European Union out-of-scope?

I was under the impression we were talking about _the_Internet_
for which the IETF is usually producing standards and technology,
and seem to have confused this with your discussion about matters
of some other network somewhere, that happend to got redistributed
by the IETF mailing list exploder only by accident.

-Martin

---

From: Joel Jaeggli <[email-masked]>
Date: Fri, 1 Jul 2011 11:34:21 -0700

> beforehand", let alone an "opt opt" is technically impossible?

The IETF has several times veered away from the deep water where internet standards cross paths with regulatory requirements.

http://tools.ietf.org/html/rfc2804
 
We are not legal experts we are not qualified to interpret the statutory requirements of various nation states, our own or others. We need to be clear on what is in vs out of scope for IETF work. Focus on what would be percieved to be in the best interests the users and the network. Nation states will do whatever they do and sovereign by definition can impose whatever mandate they find necessary on their network operations and citizens.

---

From: Scott Brim <[email-masked]>
Date: Fri, 1 Jul 2011 14:55:55 -0400

> We are not legal experts we are not qualified to interpret the statutory requirements of various nation states, our own or others. We need to be clear on what is in vs out of scope for IETF work. F…

Joel, the issue is very clear: what the IETF does must not make
privacy and confidentiality impossible.  It's not just some arbitrary
regulation from a committee, there are whole cultures who take this
very seriously.  You cite the wiretapping decision -- note we didn't
make wiretapping impossible, we just didn't support it.  In this case
it is very easy to make privacy (the right to control personal
information) and confidentiality (the right to know that private
information you share with one party will be kept within that scope)
impossible -- that's a position you may not take as someone making the
Internet work, since the ultimate stakeholders are those humans out at
the edges.  See also "Changes to Internet Architecture Can Collide
With Privacy" <http://www.ietf.org/proceedings/79/slides/intarea-3.pdf>
for a discussion of mobility.

When you think "oh right, I have to come up with a security
considerations section", include privacy and confidentiality
implications in your checklist of things to think about.

As to the technical issues here, higher layers don't need to use IP
addresses as identifiers, they have their own.  The only layer that
needs to care about IP addresses is the IP layer itself.  Privacy
addresses are well-defined and well-deployed.  The only issue with
using them is monitoring and logging activity.  The first hop router
can make the necessary correlations, but some access providers think
that's expensive.  Lawsuits over breach of confidentiality can be even
more expensive.  So is reworking protocols when a third of the world
won't use them.

Scott

---

From: Joel Jaeggli <[email-masked]>
Date: Fri, 1 Jul 2011 12:12:27 -0700

> for a discussion of mobility.

You and I are in complete agreement when is comes to not making privacy or confidentiality impossible... 

Where I object strenuously is when a directive wether it comes from the EU, the USA or the PRC becomes the consideration for framing a debate. The dictates of sovereigns are likely effectively impossible to reconcile if included fully in this space.

in 2804 the summary position is quite succinct in this regard:

   The IETF has decided not to consider requirements for wiretapping as
   part of the process for creating and maintaining IETF standards.

We know therefore without equivocation where a doucment like the following fits in the IETF standards context.

http://tools.ietf.org/html/rfc3924

we do not disallow the publication of such a document, in fact we should enoucorage it. but we also don't design to the soverign's requirements in the protocol specific.

> implications in your checklist of things to think about.

In this context if we fail that badly we have a problem.

---

From: Cameron Byrne <[email-masked]>
Date: Fri, 1 Jul 2011 12:42:00 -0700

> Where I object strenuously is when a directive wether it comes from the EU, the USA or the PRC becomes the consideration for framing a debate. The dictates of sovereigns are likely effectively impo…

Bases some "Wikipedia research", there is some regulations about
browser cookies, and no mention of IP addresses.

There is some mention about web servers not retaining info without an
opt-out clause...  My analysis is very high level, i don't have the
details, but at first brush it seems like there is some conflation
going on here between cookies and IP addresses and what a home network
looks like vs what web servers retain in their logs.

I fail to see how this an IPv4 vs IPv6 issue?  Static vs Dynamic?

Cameron

> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf
>

---

From: Masataka Ohta <[email-masked]>
Date: Sat, 02 Jul 2011 16:20:33 +0900

Martin Rex wrote:

> This means you want to make IPv6 addresses

If what you want is "opt out" from static IP addresses, use proxies
at an application layer or IP over IP at the network layer.

						Masataka Ohta

---

From: Keith Moore <[email-masked]>
Date: Sat, 2 Jul 2011 10:52:08 -0400

> implications in your checklist of things to think about.

Very much agree. 

I strongly disagree with the statement that every home network should have only ephemeral external addresses and that it should NAT to stable internal addresses.  I also strongly disagree with the assertion that EU law requires IETF to make it so.  But the underlying concerns are quite valid and important.  

I don't want to cripple all home networks and applications by imposing ephemeral addresses and/or NATs on them.  But having a stable address prefix associated with every device in one's home network that communicates with the public Internet can indeed threaten the user's privacy.  (Note that privacy addresses don't really solve the problem as they still all have the same prefix.)  Some applications and hosts require stable addresses; others do not.   So it might be that a home network needs to be able to support two prefixes - a stable one that can be used by those applications that need it, and an ephemeral one that can be used by everything else.   That's not difficult to do by itself, but my next question is how to arrange these things such that ordinary consumers can understand such details and manage them?

Anyway, to me it seems reasonable for the HOMENET group to consider privacy issues associated with address assignment.

> needs to care about IP addresses is the IP layer itself.  

This has been demonstrated many times to be false.

Keith

---

From: Martin Rex <[email-masked]>
Date: Mon, 4 Jul 2011 03:44:21 +0200 (MEST)

Keith Moore wrote:
> 
> Some applications and hosts require stable addresses; others do not.

Very few, and they should be carefully selected and such apps definitely
should obtained informed consent of the user before they use a
static/fixed address.

>
> So it might be that a home network needs to be able to support two
> prefixes - a stable one that can be used by those applications that
> need it, and an ephemeral one that can be used by everything else.
> That's not difficult to do by itself, but my next question is how
> to arrange these things such that ordinary consumers can understand
> such details and manage them?

Two addresses might work.  The ephemeral address needs to be short-lived
regularly randomly reassigned from a pool and shared by as many
ISP customers as possible.

ALL of the outgoing connections should use the ephememeral address.

And I believe even incoming connections should use the ephemeral
one, obtained by something like IGDP-via-UPnP or NAT-PMP.  Using the
static address should require significantly more work than the ephemeral
one, or we'll see too many apps that will take the easy route.

I know that there are a few hundred million folks that strip naked
at varying levels on social networks.  But we should not make it
difficult to folks that care about privacy to _not_ get laid by
careless (or on-purpose) apps.  Apps similar to customer affiliation
programs from supermarkets, where lots of folks loose their privacy
for a few pennies.

legislators can regulate browser cookies, but there is little legislators
could do to protect citizens that use static IPv6 addresses.

>
> I also strongly disagree with the assertion that EU law requires IETF
> to make it so.

I never said that.  I said that by issuing static/fixed IPv6 addresses
to home DSL subscribers (or personal mobile devices) that you're
subverting legal initiatives to protect privace, such as the
E-Privacy directive that exists in the EU, and the "do not track"
in discussion in the US.  For someone with a static IPv6 address,
you do not need any cookies at all.  The IP address itself becomes
personally identfiable (PII) information.

Collecting PII is regulated in the EU, and allowed only under very
specific conditions.  With IPv6 static addresses issued to personal
devices and private households, logging client IP-Addresses will
become, without any doubt, subject to Data Privacy legislation, and
that means in many cases illegal.

This isn't actually new, and it has already been decided to apply to
current IPv4 addresses as well by a german court in 2007
http://www.daten-speicherung.de/data/Urteil_IP-Speicherung_2007-03-27.pdf

> 
> I don't want to cripple all home networks and applications by imposing
> ephemeral addresses and/or NATs on them.

You're not crippling anything here and you are significantly exaggerating
the burden.  Just asking for some extra effort to protect privacy.
Think about it, most addresses for personal mobile devices and for home
subscribers are currently using NAT-ed dynamic IPv4 addresses already,
so it works fine, its being done, and internet is still usable.

>
> But having a stable address prefix associated with every device in
> one's home network that communicates with the public Internet can
> indeed threaten the user's privacy.

Public information to map a static IP-address to a name accumulates
in a matter of a several days to a few weeks, at most.  With static
addresses, you will not have "false positive", so one single
datum that correlates a name with that address, and privacy is gone.

It's like a photo with your name being exposed to internet search engines
just once, you can hardly undo that (maybe do damage control by having
your real name changed, but that nothing you want everyone having to
do every few months, would you?

>
> (Note that privacy addresses don't really solve the problem as
> they still all have the same prefix.)

Full anonymity is not possible at all.  What we need and can achieve
is what is currently done: share the addresses among a huge number
of subscribers and randomly reassign new addresses from the pool.

> 
> Anyway, to me it seems reasonable for the HOMENET group to
> consider privacy issues associated with address assignment.

Definitely.

-Martin

---

From: Keith Moore <[email-masked]>
Date: Sun, 3 Jul 2011 22:07:37 -0400

I'm not going to keep debating this on the ietf list.  I think I said already that this would be a good discussion topic for the WG.

> should obtained informed consent of the user before they use a

...

etc.