Re: Address privacy

[Fernando Gont <[e-mail]>]

On 28/1/20 16:50, Tom Herbert wrote:
> 
> 
> On Mon, Jan 27, 2020, 7:57 PM Fernando Gont <[e-mail] 
> <mailto:[e-mail]>> wrote:
> 
>     On 28/1/20 00:10, Tom Herbert wrote:
>      > On Mon, Jan 27, 2020 at 5:36 PM Fernando Gont
>     <[e-mail] <mailto:[e-mail]>> wrote:
>      >>
>      >> On 26/1/20 18:37, Nick Hilliard wrote:
>      >>> Tom Herbert wrote on 26/01/2020 20:16:
>      >>>> It's intuitive
>      >>>> that a higher frequency of address rotation yields more privacy
>      >>>
>      >>> intuitive, but probably inaccurate because of the a priori
>     assumption
>      >>> that privacy is strongly associated with the endpoint identifier.
>      >>
>      >> In many cases, it is: you log in to fb with a given address, and
>     reuse
>      >> that address to do other stuf
>      >>
>      > Yes, that's the "always on" network application that would allow
>      > address tracking and identification at even high frequency of address
>      > change. An exploit based on that is described in section 4.4 of
>      > draft-herbert-ipv6-prefix-address-privacy-00. I believe the only way
>      > to defeat this exploit would be single use (per flow), uncorrelated
>      > address.
> 
>     Agreed. That said, temporary addresses, for obvious reasons mitigates
>     activity correlation over time -- certainly not to the same extent that
>     the paranoid "one address per flow" would.
> 
> 
> Fernando,
> 
> The rationale for temporary addresses may be obvious, but I don't 
> believe anyone has yet quantified the effects. For instance, RFC4941 is 
> thirteen years old, is there any evidence that it has materially 
> improved anyone's privacy? (I'm not being cynical, but I think it's a 
> fair question).

I don't think you can quantify privacy. What would be the units for that?

There's secrecy and not-secrecy. But with these things, you simply 
mitigate (to some extent) the ability to correlate network activity.



> One might compare this to the policy of some sys admins that users need 
> to change passwords regularly. The rationale is similar, but that 
> practice has been most debunked as not improving security and in fact is 
> more of a burden to users that providing any real value.

I don't think it has been debunked. Certainly, if you change your 
password, you limit the ability of the attacker that had obtained your 
password from re-using the same credentials. (assuming they are not used 
for a system where they can install backdoors, etc.). Most things we 
emply for security have an associated lifetime...

-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492