Re: [art] [Pearg] Fwd: Side meeting for IP address privacy on the web

[Fernando Gont <[e-mail]>]

Folks,

Unfortunately I will not be attending the next IETF meeting, but I felt 
like posting a few comments on the topic.

Some of us have done a fair share of work in the area of "address 
privacy", among others, please see:

* RFC7217/RFC8064: which replaces traditional stable IPv6 addresses with
                    something more sensible (from a privacy point of
                    view)

* draft-ietf-6man-rfc4941bis: A revision of RFC4941 to fix a number of
                    flaws in it.

* RFC7721: Privacy analysis of IPv6 addresses.

* draft-gont-6man-address-usage-recommendations: A document that,
                    among other things identifies gaps that prevent us
                    from doing more appropriate usage of IPv6 addresses.


They try to address as much of the problem as is "addressable": Modulo 
the IID part of an address (which may unnecessarily leak information), 
all the topologically-dependent bit of an address are simply serving 
their purpose. Put another way, an address is a topologically-dependent 
identifier. So it *will* leak the position of the node in the network 
topology (that's why you use adressses in the first place, such that the 
network knows how to get packets back to you!).


The browser "solutions" listed below are not really solutions: e.g., a 
VPN simply adds one extra layer of indirection, and essentially choose a 
different point in the network that gets to see all of the users' 
traffic, and is able to track users in a very easy way. dVPN would be, 
in a way, something along the lines of Tor? -- If so, why not Tor?

As with DoH, relying on a single party to behave nicely, based on the 
(questionable) assumption that some party (in this case the local ISP) 
is evil, while another is just nice (in this case the VPN concentrator, 
or analogous for the browser extension) leads to, IMO, a more scary 
scary situation where a single entity could potentially go rogue, or be 
hacked, affecting the privacy of many more users.

As with e.g. DoH, you don't really get privacy, but rather get to pick 
how gets to peak at your traffic.

This is an important message to state clearly... and hopefully an 
argument such that browsers *never* enable this king of thing by 
default, as was the case with DoH in some cases.

Thanks!

Cheers,
Fernando




On 21/2/20 00:33, Allison Mankin wrote:
> Hi PEARG,
> 
> This is likely of interest to many of you.
> 
> See you at IETF 107.
> 
> ---------- Forwarded message ---------
> From: *Paul Jensen* <pauljensen=[e-mail] 
> <mailto:[e-mail]>>
> Date: Fri, Feb 14, 2020 at 14:58
> Subject: [art] Side meeting for IP address privacy on the web
> To: <[e-mail] <mailto:[e-mail]>>
> 
> 
> I intend on holding a side meeting at IETF 107 to talk about IP address 
> privacy on the web.  As many browsers work to combat fingerprinting on 
> the web, a user's IP address, the single most identifying 
> fingerprintable surface, remains largely unprotected. Various browsers 
> have acknowledged the fingerprintability of IP addresses or have 
> proposed a solution: Chrome (https://github.com/bslassey/ip-blindness), 
> Firefox 
> (https://blog.mozilla.org/blog/2019/09/10/firefoxs-test-pilot-program-returns-with-firefox-private-network-beta/), 
> Safari (https://webkit.org/tracking-prevention-policy/), Brave 
> (https://brave.com/vpn0-a-privacy-preserving-distributed-virtual-private-network/).  
> I'd like to hold a side meeting on this topic to start the conversation 
> around IP address privacy on the web.  Specifically with the goal of 
> preventing IP from being used as a tracking vector, but trying to do so 
> without breaking beneficial use cases such as DoS, fraud, spam and other 
> abuse prevention.  Agenda might look something like this:
>>
>>   * What IP is used for
>>       o Spam, abuse, fraud, DoS protection
>>       o Geo IP
>>       o Ad targeting
>>       o others?
>>   * Privacy research
>>       o IP reidentification
>>       o IP fingerprinting
>>   * Proposals for IP blindness
>>       o VPN0
>>       o FPN
>>       o Willful IP Blindness
> If you're interested in attending please let me know which days you have 
> conflicting obligations in the morning slot.
> 
> Paul
> _______________________________________________
> art mailing list
> [e-mail] <mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/art
> 


-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492