Re: [ANCP] Privacy issue in draft-ietf-ancp-mc-extensions-12

[Tom Taylor <[e-mail]>]

I propose to say in the main section that implementations MUST provide a 
mapping capability, either table-based or algorithmic, to map between 
device MAC and device identifier. Rather than separate requesting 
address and requesting MAC TLVs, define a single requesting device 
identifier TLV. Then in the Security Considerations section I can say 
that operators SHOULD deploy that mapping capability in the interest of 
privacy and untrackability.

Tom

On 05/12/2013 11:02 AM, Ted Lemon wrote:
> On Dec 5, 2013, at 9:56 AM, Roberta Maglione <[e-mail]> wrote:
>> In my opinion using the source MAC  address for conditional access purposes seems in-line with this approach, so I would prefer to keep a link with the MAC address (or the device id) in the ANCP message, mitigating the privacy issues either by using an optional hashing/mapping function as you suggested or by adding some clarifications notes as proposed by Francois.
>
> Roberta, I understand where you are coming from.   However, the way these things go is that you do something expedient at time T, which seems harmless.   Then at time T+N, you learn that there are negative consequences to doing that thing.   There is never any time T+M, where M>N, at which the cost of implementing a better solution is lower than it is at time T+N.   So either you fix the problem once you've discovered it, or you don't fix the problem.
>
> So I'm asking you, now that we understand the problem, to fix it.   I would also encourage you to work within the BBF to get the next version of TR-146 to switch over to using the same identifier we are proposing to use here.   I think this is a better approach in the long run than doing nothing, although I fully understand that it is not without cost.
>
>