Re: [apps-discuss] Comments on draft-ietf-appsawg-http-forwarded-02

[SM <[e-mail]>]

Hi Alissa,
At 14:29 17-05-2012, Alissa Cooper wrote:
>    As a general matter, the Forwarded extention does not seek to make hosts
>    any more identifiable than they would be if their traffic were 
> not passing through a proxy. [Wondering if there are corner cases 
> here. See note 2 below.]
>
>    The trust placed in the information conveyed by the Forwarded 
> extension is likely
>    to be the same as for current practices with source IP addresses.  In
>    that sense, a forwarded IP address can be spoofed.  Furthermore, 
> users of anonymous proxies may be capable of stripping forwarded
>    information before it reaches its destination.

With all due respect I beg to disagree about this.  There are cases 
when the proxy is selected by the user so that their host is not 
identifiable.  The user is intentionally trying not to have the 
client host identified.

The spoofing is an interesting point.  The user agent could add the 
relevant header.  That can be traced though.  User agents, by 
default, may not offer such functionality.

How can users of anonymous proxies strip forwarded information before 
it reaches its destination?

>2. I'm wondering if, in addition to the information leak problem 
>discussed in 8.2, there is also an issue of distinguishability of 
>multiple users who are all behind the same NAT/proxy but may not all 
>be behind the same chain of proxies. That is, suppose A and B are 
>the only two hosts behind a particular NAT and A installed the NAT 
>to help protect his identity. B's traffic passes through 2 further 
>proxies that use Forwarded headers before arriving at C. A's traffic 
>passes through no proxies to arrive at C. C can now effectively 
>identify A. This is just one case -- I'm not sure how realistic it 
>is, but I'm sure there are others. Seems like this is worth more 
>thought/discussion in the text.

The NAT case is different as the user cannot affect "chaining" unless 
he/she has control over the infrastructure.

Web Proxy chaining is used in an attempt to make it more difficult to 
"trace back" to the client.  There can be multiple proxy hops, which 
the user does not operate, before the destination is reached.

Regards,
-sm