Re: [Apn] Further revised draft Charter

[Donald Eastlake <[e-mail]>]

Certainly there is privacy and security work to be done. What I
objected to is what appeared to me to be an assertion that every
provider and enterprise network link is always being surveilled by
possibly malign outside observers. But that happens sometimes which is
another reason for taking into account privacy and security concerns.

Thanks,
Donald
===============================
 Donald E. Eastlake 3rd   [phone] (cell)
 2386 Panoramic Circle, Apopka, FL 32703 USA
 [e-mail]

On Fri, Jan 20, 2023 at 5:41 AM Adrian Farrel <[e-mail]> wrote:
>
> Ted, you beat me to it.
>
>
>
> Yes, the whole point of “exposure” is not that it is being wilfully displayed, but that an attacker (who finds a way of viewing or copying traffic) can see every non-encrypted field every packet (on a link or at a node).
>
>
>
> While enterprise networks may consider themselves better protected than service provider networks (where the links are in public spaces), it turns out that enterprises are similarly vulnerable, partly because their traffic may be more valuable.
>
>
>
> A
>
>
>
> From: Ted Hardie <[e-mail]>
> Sent: 20 January 2023 08:54
> To: Donald Eastlake <[e-mail]>
> Cc: [e-mail]; [e-mail]
> Subject: Re: [Apn] Further revised draft Charter
>
>
>
> Hi Donald,
>
>
>
> On Fri, Jan 20, 2023 at 6:05 AM Donald Eastlake <[e-mail]> wrote:
>
>
> The use of the APNET Field inside an APNET network domain would not
> generally expose it to "outside observers" unless all the traffic in
> the domain was so exposed
>
>
>
> I agree with the statement above and disagree with the statement below.  I think you're entirely right to say that the field would only be exposed if the network traffic were generally exposed.  On the other hand, the lesson of pervasive surveillance is and was that the amount of traffic being hoovered up is always more than you think.  Presuming it will be available to an attacker is a far safer assumption than assuming that this is rare.  Certainly I would expect the security considerations to presume that such attackers were within the threat model.
>
>
>
> regards,
>
>
>
> Ted Hardie
>
>
>
>
>
>
>
> which I think is something that would rarely
> happen rather than "necessarily" happen. But some more could be said
> about privacy and security
>