Re: privacy at layer 7 and above (was: A common problem with SLAAC in "renumbering" scenarios)

[Alexandre Petrescu <[e-mail]>]

Le 15/02/2019 à 10:30, Jan Zorz - Go6 a écrit :
[...]

> /64 for each device is fine. What I'm questioning is if we really need 
> to make underlying to be something that was never meant to be if L7 and 
> above is broken? I think L7 and above needs to be fixed first and then 
> changing of addresses in transport layer can have any effect. Until then 
> - let's transport packets in a way that doesn't break often and make 
> user grumpy.
> 
> To put "lipstick on a pig" is a rhetorical expression, but quite useful 
> in our case :) :) :)

I do not know what putting lipstick on a pig means, although I do 
remember this expression being used by or in relationship with a politician.

Signed contractual allocation of permanent IPv6 address, and of an IPv6 
prefix, to a (group of) mobile device, is an excellent thing for session 
continuity.

The privacy concerns are matters of L7 and above, specifically politics, 
computer-assisted human interactions, graphical user interfaces.  GDPR 
is one a politics answer for privacy.

GDPR itself has some issues when it comes to implementation: websites 
now invite the user to accept or not cookies, but the manner in which 
this is performed - a technical implementation - leads to accept more, 
or less.  Some times end users feel confident their privacy is 
respected, other times they feel they loose control of it, and worse - 
outright cheated.

In time, an example of this GDPR-enforced dialogue is the following 
related to cookie acceptance:
- first, there was 2 answers possible: yes, or no.  Exclusively.  You
   had to press something.
- then came the little cross on the window corner, to avoid answering
   altogether - do not leave any trace.  YEt the end user did not
   know whether the answer was yes or no when pressing that cross.
- recent dialogues involve a cross with only one default answer
  'Accept'.  How dare they to take my cross pressing as Accept.  I did
   not say 'Accept'.  I pressed a cross, or Escape button, to avoid
   answering the question.
- what I want in the future is cross closing the dialogue box and tell
   the website to shut up, dont trace me, dont use cookies.  Dont even
   record the fact that I pressed that cross.

Is that 3rd option part of GDPR?

This reminds of the cartoon showing the options possible for vote, 
during a particular campaign, in which only one option was actually 
possible: whatever button one pressed, the end result was the same.

This is the kind of privacy issues that need to be addressed.  It is 
level 7 and above.

This looks far from being a matter of using or not using stable IP 
addresses when querying a website.

Alex

> 
> Cheers, Jan
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>