Subject: [Pearg] About hiding in crowds

From: Christian Huitema <[email-masked]>
Date: Mon, 10 Aug 2020 16:24:32 -0700

A lot of the privacy extensions recently developed amount to "hiding in
crowds". For example, SNI encryption assumes that multiple servers are
accessible through the same IP address. If the SNI is hidden, outside
observers won't know which one was accessed. DNS encryption makes the
same assumption in an indirect way. It assumes that we gain privacy by
hiding the DNS exchange that maps www.example.com to an IP address. This
is fine, except for the fact that most servers have their own IP
address. You can hide the DNS exchange, you can hide the SNI, but
outside observers will still be able to understand which servers you are
accessing by simply looking at the address header. If we want real
privacy, we will need something else!

How do I know? I started with the Majestic Million list of domain names,
and resolved 25,000 of these names, and found out that on average a
given IP address was shared by about 1.21 names, as explained in:
https://huitema.wordpress.com/2020/08/09/can-internet-services-hide-in-crowds/).
And then I resolved the next 25000 names to be more sure of the results.
The average increased slightly, from 1.21 to 1.22, which does not change
the results much. 74.6% of domains use an address that is unique to
them, 8.7% use an address shared by 2 domains, and only 8% use an
address shared by 10 or more servers. DNS encryption and SNI encryption
do bring privacy for a minority of connection, for which it may well be
important. But they do not improve privacy in 75% of the cases.

I understand that privacy-warriors can use VPN, proxies or Tor. But
these tools are far from perfect -- see the recent Sybil attacks against
Tor, or the outveiling of shady business practices by many VPNs. In any
case, these tools at best provide "privacy for a few active users". But
that leaves aside the bulk of Internet users. Thus my question for this
program: how would we provide privacy for the masses?

-- Christian Huitema

---

From: Eliot Lear <[email-masked]>
Date: Tue, 11 Aug 2020 12:00:22 +0200

Hi Christian

What you describe below is something that Barbara Fraser and I noted some years ago at the STRINT workshop.  We argued at the time that providing points in the network to aggregate traffic was an appropriate approach to both blend and blind.  It requires end user trust in those aggregation points that some might call middle boxes.  This is effectively what Mozilla has done with Cloudflare.  This notion of agency is still something that I think is worth exploring.

Eliot

> On 11 Aug 2020, at 01:24, Christian Huitema <[email-masked]> wrote:
> 
> Signed PGP part

---

From: Mirja Kuehlewind <[email-masked]>
Date: Tue, 11 Aug 2020 12:22:11 +0000

Hi Christian, hi Eloit,

also you need is address translation by at least one hop in the middle (assuming the observer can only observe one side of the middle point or there are enough simultaneous users). This is one use case for MASQUE.

Mirja

On 11.08.20, 12:00, "Pearg on behalf of Eliot Lear" <[email-masked] on behalf of lear=[email-masked]> wrote:

    Hi Christian

    Eliot

---

From: Shivan Sahib <[email-masked]>
Date: Thu, 13 Aug 2020 15:59:09 -0700

Thanks for the note Christian. I remember that a similar point was brought
up in the *"What can you learn from an IP?" *paper presented by Nikita
Borisov at ANRW 2019 last year:
https://dl.acm.org/doi/10.1145/3340301.3341133, video of presentation:
https://youtu.be/pEnT2BJvyv0?t=106
In the discussion after, it was brought up that IPv6 could make things
better (more to choose from, so less stickyness if servers wanted) or worse
(less incentive to have the same IP address for multiple services). There
was also some discussion around what

   - the CDNs can do
   - the websites can do, and
   - clients can do

Sara and I were chatting today and we reckoned this was an architectural
consideration (with research input) for Internet privacy. It seemed to us
that a first step might be to write up the concern and possible solutions
in an Internet Draft.

Thanks also for the blog post
<https://huitema.wordpress.com/2020/08/09/can-internet-services-hide-in-crowds/>;
I tried checking out https://github.com/private-octopus/centraldns but got
a 404.

On Mon, Aug 10, 2020 at 4:25 PM Christian Huitema <[email-masked]>
wrote:

> --
> Pearg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/pearg
>

---

From: Christian Huitema <[email-masked]>
Date: Thu, 13 Aug 2020 21:47:35 -0700

Sorry about the 404. I messed up with the GitHub project, and did not
realized it was set as "private". Fixed now. If you want to work on an
Internet draft, I am happy to collaborate.

-- Christian Huitema

On 8/13/2020 3:59 PM, Shivan Sahib wrote:
> Thanks for the note Christian. I remember that a similar point was
> brought up in the /"What can you learn from an IP?" /paper presented
> by Nikita Borisov at ANRW 2019 last
> year: https://dl.acm.org/doi/10.1145/3340301.3341133, video of
> presentation: https://youtu.be/pEnT2BJvyv0?t=106 
> better (more to choose from, so less stickyness if servers wanted) or
> worse (less incentive to have the same IP address for multiple
> services). There was also some discussion around what
>
>   * the CDNs can do 
>   * the websites can do, and
>   * clients can do
>
> Sara and I were chatting today and we reckoned this was an
> architectural consideration (with research input) for Internet
> privacy. It seemed to us that a first step might be to write up the
> concern and possible solutions in an Internet Draft. 
>
> I tried checking out https://github.com/private-octopus/centraldns but
> got a 404. 
>
> On Mon, Aug 10, 2020 at 4:25 PM Christian Huitema <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>     hiding the DNS exchange that maps www.example.com
>     <http://www.example.com> to an IP address. This
>     [email-masked] <mailto:[email-masked]>