Re: [ietf-privacy] Fwd: New Version Notification for draft-iab-privacy-considerations-01.txt

[SM <[e-mail]>]

Hi Alissa,
At 02:28 23-10-2011, Alissa Cooper wrote:
>Per the announcement below, a new draft of the privacy 
>considerations document, formerly 
>draft-morris-privacy-considerations-03 and now 
>draft-iab-privacy-considerations-01, has been submitted.* The major 
>changes from the previous version are:

 From Section 2:

   "As an example, consider HTTP [RFC2616], which was designed to allow
    the exchange of arbitrary data.  A complete analysis of the privacy
    considerations for uses of HTTP might include what type of data is
    exchanged, how this data is stored, and how it is processed.  Hence
    the analysis for an individual's static personal web page would be
    different than the use of HTTP for exchanging health records.  A
    protocol designer working on HTTP extensions (such as WebDAV
    [RFC4918]) is not expected to describe the privacy risks derived from
    all possible usage scenarios, but rather the privacy properties
    specific to the extensions and any particular uses of the extensions
    that are expected and foreseen at design time."

There are several other protocols which are designed to allow the 
exchange of arbitrary data.  The above mentions that a complete 
analysis should cover:

  (1) Type of data being exchanged

  (2) How the data is stored

  (3) How it is processed

and mentions personal web pages and health records as examples.  This 
sounds more like usage of a technology instead of privacy 
considerations in designing a protocol.  My view of privacy 
considerations in protocol design is to consider implications when 
making design decisions.  As an example, HTTP has a Referer 
request-header field.  That field leaks information.  From a protocol 
design perspective, it is good to consider the privacy implications 
in having such a field and whether it is really needed for the 
protocol to work.

I'll give another example.  draft-vandergaast-edns-client-ip-01 
defines an EDNS0 to carry network range information.  It's an 
extension of the DNS protocol.  That protocol already discloses the 
source IP address.  If the extension functions the same way as the 
basic protocol, we do not have to get into privacy 
considerations.  As the extension is designed to communicate 
information to another party (something that the basic protocol does 
not do), there are privacy implications.

If you want me to discuss usage scenarios, I am going to say:

   This protocol is designed to discloses personal information and it
    offers no privacy.

It's going to the classic fare for most protocols (it's like crying 
wolf) and it goes against the purpose of having privacy considerations.

I like the guidelines in Section 4.  It lists easy questions for the 
protocol designer to think about.

Regards,
-sm