Re: Disabling temporary addresses by default?

[Tom Herbert <[e-mail]>]

On Wed, Jan 29, 2020 at 3:07 PM Christopher Morrow
<[e-mail]> wrote:
>
> (I'm going to hate myself in the morning for this, but..)
>
> On Wed, Jan 29, 2020 at 6:54 AM <[e-mail]> wrote:
> >
> > Lorenzo,
> >
> > > So, are you saying that using temporary addresses does not leak the habits of employees?
> > >
> > > I'm saying using temporary addresses makes a number of attacks, including cross-site tracking, more difficult, infeasible, or defeatable by the employee or IT admin. If you believe that to be false, you can always try to see if you can get consensus on a document that says that privacy addresses are not useful and declares RFC 4941 historic. :-)
> >
> > Anything you can cite here?
> > Just because you state it does not make it fact.
> > After almost 20 years of temporary addressing, it seems there is very little data available.
>
> If we're talking about 'employees' and 'employers' (you can extend
> this to the ISP if you like easily enough)
>   1) you can see port / mac / neighbor maps on
> switches/routers/brouters/swouters  (this gets you a
> person/desk/machine)
>   2) you can link DNS requests and firewall logs to the IP address(es)
>   3) you can be even simpler by just logging the IP src-address on any
> 'single sign-on' (or access to authenticated corporate resource) to
> ensure you mapped the things in 1 correctly
>   4) you can sort / sift / alert on that data to your heart's content.
>
> This isn't rocket science... Is there data for this? kinda? there are
> products which do this today, One even I think made by the Cisco /
> Talos folks for 'idp / ids / exfiltration detection' and similar uses.
> Heck, any SEIM today can/does do this work trivially.
>
Christopher,

The Internet equivalent for #3 would be login services (like FB,
gmail, etc.) as well as the use of cookies that include an identifying
cookie (like ads). It's likely that even just a few seconds after an
address is changed some third party has already logged the association
of IP address to user or device. Exploiting this information, step 4,
is a matter of applying the logs to make correlations and
identifications in completely uncorrelated traffic. Increasing the
frequency of address change problem does little more than increase the
number of log entries that an attacker needs to process (and that's
only a problem for them if everyone is changing addresses a high
frequency).

Tom
>
> Now, extend that to your ISP? sure, same problem, larger userbase and
> higher feeds/speeds.
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------