Re: Address privacy (was: Re: RFC4941bis: consequences of many addresses for the network)

[Tom Herbert <[e-mail]>]

On Sat, Jan 25, 2020 at 11:21 AM Michael Richardson
<[e-mail]> wrote:
>
>
> Ted Lemon <[e-mail]> wrote:
>     > Another solution that could be useful is to do connections through an
>     > anonymity concentrator that tunnels your flow to the selected server.
>     > The idea here is that your ISP (but it doesn’t have to be your ISP!)
>     > has a bunch of anonymity boxes sitting in their data centers, and when
>     > you want to connect to foo.com <http://foo.com/>, you establish a
>     > connection to the anonymity server.   The anonymity server constructs a
>     > new 5-tuple using its own fixed IP address.   This is effectively a NAT
>     > translation, and of course it can maintain a set of IP addresses large
>
> Except that instead of doing it at layer 4, you do it with IPsec, and extrude
> that /128 to your machine.  This is already a thing :-)
>
>     > Another solution I’ve considered is to have a giant anonymity mesh,
>     > with every ISP’s user participating, and forward flows through this
>     > mesh, treating each customer as an anonymity server.   I think this is
>
> This is also a thing called Tor.
>
Michael,

Doesn't that require that the users must explicitly configure when
they want privacy? I think a general solution should be transparent to
the user and "just works" to ensure their privacy. That in fact is one
of the arguments for NAT. If there is a significantly large enough
pool of users behind a NAT device, then the obfuscation is transparent
to the use and seems to be pretty good privacy (good enough that law
enforcement is concerned about NAT). I suppose a similar effect could
be achieved with a transparent proxy.

You might want to take a look at draft-herbert-ipv6-prefix-address-privacy-00.

Tom

> --
> Michael Richardson <[e-mail]>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------