Re: [ietf-privacy] Accurate history

[Vasilenko Eduard <[e-mail]>]

Hi S. Moonesamy,
The context was about IPv6 addressing only, not the privacy on the general scope.
The second half of IPv6 address bits (64 from 128) are used only for privacy now. RFC 8981.
IPv6 is 64-bit addressing architecture because of this, not 128 as many believe.
The host generates different pseudo-random IIDs (64-bits) and uses them to create many temporary addresses for different sessions.
Keith Moore mentioned that it is privacy. Hence, the good wastage of (2^64-1)/2^64 of IPv6 address space.
I was arguing that it is fake privacy. Hence, not a justification to waste so huge address space.
Eduard
-----Original Message-----
From: S Moonesamy [mailto:[e-mail]] 
Sent: Saturday, November 6, 2021 10:41 AM
To: Vasilenko Eduard <[e-mail]>; [e-mail]
Subject: RE: Accurate history

Hi Vasilenko,

I moved the thread to another mailing list.

At 12:55 AM 05-11-2021, Vasilenko Eduard wrote:
>Privacy is a myth.
>
>OTTs deliver 70% of traffic. They could correlate users by 100 
>parameters (including your browser window size).
>Just changing IID would not impact their correlation. Not at all.
>
>Your carrier has to know all your sessions for Lawful Intercept.
>
>Whom you are trying to mislead by IID changes?
>
>It just creates a heavy load on logs collection for troubleshooting, 
>forensic, and legal intercept.

The point which you made correlation is correct.

Session-level information is sometimes collected for network management purposes.  An external party can request access to it for investigating, for example, a crime [1].  I doubt that the external party would use information generated through correlation (using, for example, browser information) in their investigation.

IIDs, as designed, did not address privacy concerns.  It could be because the assumptions were incorrect.

As a response to your comment about privacy, I noticed that some participants changed their identification information over the last few years.  It may have been influenced about concerns about privacy.

Are you trying to say that the IETF participants' expectation of privacy does not match reality?

Regards,
S. Moonesamy

1. It depends on the jurisdiction.