Re: [Ideas] Concerns of privacy and identity

Hi Tom,

Couple of replies inline, <ALEX>

On a general level, performing a detailed analysis of implications on anonymity and privacy are part of the charter.   I think this is the context in which we should be having this discussion, i.e. to perform the analysis.  I don't think we need updates to the charter (that we just converged on); it is already covered.  

>From a personal perspective, I certainly have as big concerns about privacy as a private citizen as anybody else.  The ability to provide greater privacy while protecting myself against attackers who want to phish/impersonate/otherwise attack me is from my perspective a very important motivator for this work.  The current state of the art isn't so great from this perspective, or is it?   Let's work on providing some better alternatives.  I think in IDEAS we can make interesting contributions here and by all means we will need to include a detailed analysis.  And we can absolutely update wording in draft-cc-ideas-identity-use-cases as needed.  

Regards
--- Alex

-----Original Message-----
From: Ideas [mailto:ideas-bounces@ietf.org] On Behalf Of Tom Herbert
Sent: Saturday, September 23, 2017 9:05 AM
To: ideas@ietf.org
Subject: [Ideas] Concerns of privacy and identity

Hello,

I still have deep concerns about the identity concepts in IDEAS and the potential for abuse and breaking users' fundamental privacy and anonymity.

I find the last paragraph is section 4.1 of
draft-ccm-ideas-identity-use-cases-01 to be particularly worrisome.
Reading this, I don't see how it's not describing a global database of individual users' identities on the Internet that governments will be able access at their discretion .

<ALEX> 
Really we are talking about endpoints here.  I think many of the concerns that you raise concern peoples personally identifiable information like social security or passport numbers.  This is what is needed nor implied here.  

A service provider may of course still have a customer database, with customers' private information, credit card information, etc.   A SP today is able to correlate this information with your phone number, with your IP lease information, with your port information.  All of this is orthogonal to IDEAS.  
 </ALEX>

A key sentence is:

"to convey an authorized network entity who is behind a given
(ephemeral) IDf that is visible on the wire."

The "who" could be construed as meaning individuals here. "authorized network entity" could mean anyone in the path including governments that would assume they are self-authorized to track users.

The rest of the lines in the paragraph mentions "legitimate need to know" and " Legitimate parties include ... regulatory authorities".
What is legitimate is subjective-- what one party considers a legitimate need to know, another may not. Regulatory authority pretty much means government.

<ALEX> The implication behind a system like GRIDS is that an end user has a trust relationship with their network provider.  So, if you don't trust your network provider, there is an issue, and in that way, clearly there is potential for abuse.  You should probably stop using your mobile phone service as well  - how do you know Verizon does not share your information (including your customer records and current location) in real time with the government or with cyber criminals?  

Legitimate uses can include uses that are needed to provide a service feature, for example accounting and charging, or providing security features such as protection against impersonation, both people who try to impersonate you, and people who try to impersonate someone else when they contact you.    

In addition to the network provider, there is everybody else.  This is where we find a lot of potential attack vectors and security threats, and we should be able to protect our privacy and remain anonymous.  So, the contribution of IDEAS will be to provide greater privacy/anonymity/protection against outside threats and observers.    

So, how can we better word this in the draft to bring this across?  

</ALEX>

I believe the identity effort has good intentions and there may be real benefits. Perhaps the idea is that a policy will be articulated on who the authorized parties are and what the authorized uses of the data. The obvious problem with that is that IETF, nor anyone else, can enforce policy across the Internet. Besides that, it's almost becoming a daily occurrence that databases with personally identifying information is hacked-- a global database of Internet users would be subject to similar attacks.

It seems to me that the only guaranteed way prevent misuse of identity is to either build the mechanism such that misuse is provably impossible, or to not build a mechanism at all.

<ALEX> Proving that misuse for a mechanism will be impossible will be a very high bar to clear.  We should provide detailed analysis and security considerations, but not make this an entrance criteria.  </ALEX>

In any case, I suggest the following be added to the charter:

"IDEAS will not create a protocol, mechanism, or database that records or disseminates identities of individuals or any other personally identifiable information. IDEAS will not create any mechanism that could allow a third party in communications to track packets back to individual users."

<ALEX> 
I don't think we need an addition to the charter.  We will provide a detailed analysis of privacy etc ramifications, which is already contained in the charter.  
</ALEX>

Thanks,
Tom

_______________________________________________
Ideas mailing list
Ideas@ietf.org
https://www.ietf.org/mailman/listinfo/ideas