Re: [saag] [Pearg] Ten years after Snowden (2013 - 2023), is IETF keeping its promises?

[Tony Rutkowski <[e-mail]>]

With NIS2 coming now coming into force, and the CRA being finalized, 
sorting out some of the threats is underway, although there are now 50 
relevant EU Directives and 55 EU Regulations in force with 16 coming 
into force in 2023 at present count...plus an assortment of Decisions 
and Resolutions that all effect electronic communication mandates.  Most 
of them have extraterritorial application.  In the real world, there are 
many competing requirements, and as Meta recently found out, with 
significant adverse consequences for non-compliance.  It is worth noting 
that while this list resides in the IETF domain, there are several 
hundred standards bodies - many of which are far larger, encompassing 
more of industry, and more relevant than the IETF. So to borrow a Clint 
Eastwood phrase, a venue has got to know its limitations.

--tony r

On 1/5/2023 6:13 AM, John Mattsson wrote:
>
> Agree that there is not a single threat, and I don’t think it is so 
> important to determine which one of the threats that are the biggest. 
> The last 10 years IETF has been quite good at securing transit (which 
> is great and something we should celebrate) while at the same time 
> mostly ignoring endpoint threats. As Vittorio writes, this poses a 
> risk to damage IETF’sreputation. Assuming that endpoints are not 
> compromised, not malicious, and that the interests align with the 
> interests of the end-users feels quite outdated with today’s zero 
> trust principles.
>
> Cheers,
> John
>
> *From: *Ted Hardie <[e-mail]>
> *Date: *Thursday, 5 January 2023 at 11:36
> *To: *Vittorio Bertola <[e-mail]>
> *Cc: *Eric Rescorla <[e-mail]>, John Mattsson 
> <[e-mail]>, [e-mail] <[e-mail]>, 
> [e-mail] <[e-mail]>, [e-mail] <[e-mail]>, saag 
> <[e-mail]>
> *Subject: *Re: [Pearg] [saag] Ten years after Snowden (2013 - 2023), 
> is IETF keeping its promises?
>
> A quick response in-line.
>
> On Thu, Jan 5, 2023 at 10:00 AM Vittorio Bertola 
> <vittorio.bertola=[e-mail]> wrote:
>
>         Il 04/01/2023 20:33 CET Eric Rescorla <[e-mail]> ha scritto:
>
>             I still think this was a big fail; in fact, this implies
>             that counteraction against surveillance capitalism
>             practices can only happen elsewhere, at the regulatory
>             level, as the IETF community either does not know what to
>             do about it, or does not want to do anything about it.
>
>         I don't think this is true at all.
>
>         First, the IETF *is* working on issues around privacy and
>         preventing various forms of surveillance capitalism. That's in
>         part what initiatives like DoH, QUIC, TLS 1.3, ECH, OHAI,
>         MASQUE etc. are about.
>
>     Of course you will disagree with what I am going to say, but here
>     is the common (though not unanimous) viewpoint from the technical
>     policy community of a different part of the world - no offense
>     implied.
>
>     In Europe, "surveillance capitalism" is basically synonymous with
>     a set of a few very big American companies that happen to be the
>     ones promoting and deploying the standards you mention.
>
> First, I'm not sure that it is reasonable to assume that there is a 
> single European position on anything. Brussels is not Lisbon and 
> neither is Oslo or Budapest.  And within each of those, academics, 
> regulators, and civil society may have different opinions.  As in the 
> US, there are folks cheering for DoH and people opposed; there are 
> people delighted with OHAI and folks depressed about it.
>
> Second, I think we have to be careful to talk as if there is a single 
> threat model here.  At least one of the threat models is truly about 
> pervasive surveillance, which reflects an updated understanding that 
> an attacker may be omnipresent across the network and thus able to 
> correlate activities that a sender or receiver previously assumed 
> could not be linked. That's what RFC 7624, Section 5 described.   Many 
> of the key characteristics of protocols like QUIC were designed with 
> this threat model in mind; they provide increased confidentiality on 
> the wire. Because that threat model is focused on observation, rather 
> than the capabilities of the parties, it has little to do with 
> concerns that a small set of players is a party to many different 
> sorts of communications.  That's a different threat, and some of the 
> work to address it, like OHAI, starts from very different principles 
> as a result.
>
> Both amongst ourselves and when talking to those working in policy 
> circles, I think it is very important to be clear on what threat we 
> perceive and what responses target that.   Lumping all the threats and 
> all the responses together makes it difficult to see the progress that 
> has been achieved and even more difficult to identify where work still 
> needs to be done.
>
> Just my personal opinion, of course,
>
> regards,
>
> Ted Hardie
>
>     So, it will be hard to convince people in Brussels or Berlin that
>     those standards are meant to put the business model of their
>     proponents under check. Actually, they are more likely to lead to
>     the conclusion that the IETF is being used as an instrument to
>     further that business model, and that the encrypted network
>     architecture that it is promoting is meant to disempower end-users
>     and any other party (including European law enforcement and
>     privacy authorities) from checking what the endpoints do, which
>     information they send and who they send it to, facilitating
>     uncontrolled data extraction practices by the private companies
>     that mostly control the endpoints, i.e. the above ones.
>
>     There is a general feeling that the bigger threats to user privacy
>     are now not in transit, but in or before the endpoints. So, the
>     fact that the IETF does not want to consider threats in the
>     endpoints is seen as additional evidence for the above.
>
>     -- 
>
>     Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
>     [e-mail]  
>     Office @ Via Treviso 12, 10144 Torino, Italy
>
>
> _______________________________________________
> saag mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/saag