Re: [hiaps] some discussion in the press...

[joel jaeggli <[e-mail]>]

On 10/29/14 7:10 AM, [e-mail] wrote:
> Hi Brian,
> 
> I echo your comment. 
> 
> None of the proposals inventoried in the HOST_ID effort is trying to do the same thing as X-UIDH header. Moreover, none of these proposals is endorsing the following headers (but not limited to) nor aims at revealing a customer ID, account ID, profile ID, etc.: 
> 
> HTTP_MSISDN, HTTP_X_MSISDN, HTTP_X_UP_CALLING_LINE_ID,
> HTTP_X_NOKIA_MSISDN, HTTP_X_HTS_CLID, HTTP_X_MSP_CLID,
> HTTP_X_NX_CLID, HTTP__RAPMIN, HTTP_X_WAP_MSISDN,
> HTTP_COOKIE, HTTP_X_UP_LSID, HTTP_X_H3G_MSISDN,
> HTTP_X_JINNY_CID, HTTP_X_NETWORK_INFO, ...
> 
> Cheers,
> Med
> 
> -----Message d'origine-----
> De : hiaps [mailto:[e-mail]] De la part de Brandon Williams
> Envoyé : mercredi 29 octobre 2014 14:55
> À : joel jaeggli; [e-mail]
> Objet : Re: [hiaps] some discussion in the press...
> 
> Agreed. Inserting a publicly visible user identifier is a bad idea. 
> That's why all the proposals that have come from people on the hiaps 
> list (to the best of my knowledge) have focused on relaying _host_ 
> identifiers that are already publicly visible (generally the public IP 
> address) through to the other side of middleboxes that are hiding such 
> publicly visible identifiers. If there are proposals out there that 
> violate this principle, I agree entirely that they should be abandoned.

imho one of the assumptions I see in the work is that the host
identifier being relayed was previosuly not publicly visible, hence the
need for hostid injection.  That applies to nat translation for example
it also  applies to differentating between prefix sharing UE's in IPV6
by something other than source address.

http://tools.ietf.org/html/draft-boucadair-intarea-host-identifier-scenarios-07
http://tools.ietf.org/html/rfc6269

that's part of the reason for hiaps bof proposal to consider the problem
of securing such an identifier from differentiation by surveillance.

> --Brandon
> 
> On 10/29/2014 12:06 AM, joel jaeggli wrote:
>> this is pretty much exactly what I would have expected from injection on
>> the wire of an identity token...
>>
>> http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works/
>>
>> http://www.wired.com/2014/10/verizons-perma-cookie/
>>
>> http://www.forbes.com/sites/kashmirhill/2014/10/28/att-says-its-testing-unkillable-tracker-on-customers-smartphones/
>>
>