Subject: [Ltru] An example of the use of language tags for tracking users

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 9 Nov 2007 14:54:11 +0100

The ICANN Anti-Phishing Working Group has put forward a set of best
practice recommendations, currently in draft state:

http://gnso.icann.org/mailing-lists/archives/registrars/msg05187.html

One of them is relevant to us. They ask for the registrar to collect
and store "technical details of the registration" and mention, among
other things, some HTTP headers. Accept-Language is explicitely
mentioned.

For me, it is a good example of why the Security Considerations need
to explain the privacy issue associated with language tags. Because
other parts of the draft mention reputation systems, we may seen that
users whose Accept-Language indicate, say, russian, being screened
more...

_______________________________________________
Ltru mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ltru

---

From: "Frank Ellermann" <[email-masked]>
Date: Sat, 10 Nov 2007 02:18:12 +0100

> http://gnso.icann.org/mailing-lists/archives/registrars/msg05187.html

Thanks for the link.  I'm not too impressed by a DOC attachement with
a reference to SORBS, the content appears to be okay, though.

> They ask for the registrar to collect and store "technical details 
> of the registration" and mention, among other things, some HTTP 
> headers. Accept-Language is explicitely mentioned.

Yeah, I knew why I sabotaged it with Netscape 2.02.  OTOH I didn't
try to sabotage it again with IE6 and FF2.
 
> to explain the privacy issue associated with language tags.

They do.

> we may see that users whose Accept-Language indicate, say, russian,
> being screened more...

Wrt to the (shaky) GeoIP the drift of the draft is apparently about
plausibility, Russian is perfectly plausible for a registration from
somebody with a "Russian IP" and an address in Russia.  It's less
plausible with a German DialUP IP from somebody claiming to live in
Florida.  I'd be surprised if "Leo" feels threatened by such simple
plausibility checks.

 Frank
-- 
http://www.spamhaus.org/rokso/listing.lasso?spammer=Leo%20Kuvayev%20/%20BadCow