Re: [Captive-portals] [homenet] [Int-area] Evaluate impact of MAC address randomization to IP applications

[Stephen Farrell <[e-mail]>]

Hiya,

On 23/09/2020 01:13, Brian Dickson wrote:
> IMNSHO, MACs should be relegated to the role reflected in their name: Media
> Access Control, basically a disambiguator, not an identity.

With s/disambiguator/local disambiguator/ I would entirely
agree I think.

> The work being done by the exposure notification may be a good reference
> model.
> (Google Apple Exposure Notification, aka GAEN, for the SARS-CoV-2 aka
> Covid-19 protocols for privacy-first automatic exposure notification over
> BLE).
> That too uses identifiers that are non-linkable and rotate periodically (on
> the order of 10 minutes IIRC).

I don't think the GAEN system is a good example.

Mainly because, despite what I think are the good
intentions of all involved (that I've talked to anyway),
I doubt it could ever work reliably (and so is to some
extent theatre) but also because it's inherently vulnerable
to replay attacks, implementations can be very privacy
unfriendly, and the governance part is pretty sucky. It
also turns out that integrating GAEN into a real contact
tracing system seems quite failure prone too. (Apologies
for the self-references but our reports at [1] cover all
the above and more.)

That said, some of the protocol constructs used by GAEN may
well be good things to re-use though - there are some good
ideas there, in addition to the unjustified optimism. (*)

Cheers,
S.

[1] https://down.dsg.cs.tcd.ie/tact/

(*) "unjustified optimism" isn't quite right - I figure
it was more a case of "something must be done; <this> is
something that is less bad than <that>, therefore <this>
will be done."


> 
> Brian
> 
> 
> _______________________________________________
> homenet mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/homenet
>