Re: Address privacy

[Alexandre Petrescu <[e-mail]>]

Le 25/01/2020 à 20:57, Ca By a écrit :
> 
> 
> On Sat, Jan 25, 2020 at 11:48 AM Tom Herbert <[e-mail] 
> <mailto:[e-mail]>> wrote:
> 
>     On Sat, Jan 25, 2020 at 11:21 AM Michael Richardson
>     <[e-mail] <mailto:[e-mail]>> wrote:
>      >
>      >
>      > Ted Lemon <[e-mail] <mailto:[e-mail]>> wrote:
>      >     > Another solution that could be useful is to do connections
>     through an
>      >     > anonymity concentrator that tunnels your flow to the
>     selected server.
>      >     > The idea here is that your ISP (but it doesn’t have to be
>     your ISP!)
>      >     > has a bunch of anonymity boxes sitting in their data
>     centers, and when
>      >     > you want to connect to foo.com <http://foo.com>
>     <http://foo.com/>, you establish a
>      >     > connection to the anonymity server.   The anonymity server
>     constructs a
>      >     > new 5-tuple using its own fixed IP address.   This is
>     effectively a NAT
>      >     > translation, and of course it can maintain a set of IP
>     addresses large
>      >
>      > Except that instead of doing it at layer 4, you do it with IPsec,
>     and extrude
>      > that /128 to your machine.  This is already a thing :-)
>      >
>      >     > Another solution I’ve considered is to have a giant
>     anonymity mesh,
>      >     > with every ISP’s user participating, and forward flows
>     through this
>      >     > mesh, treating each customer as an anonymity server.   I
>     think this is
>      >
>      > This is also a thing called Tor.
>      >
> 
> 
> +1, dont re-invent Tor

Re-invent a Tor that's well accepted by society.

Alex

> 
> 
>     Michael,
> 
>     Doesn't that require that the users must explicitly configure when
>     they want privacy? I think a general solution should be transparent to
>     the user and "just works" to ensure their privacy. That in fact is one
>     of the arguments for NAT. If there is a significantly large enough
>     pool of users behind a NAT device, then the obfuscation is transparent
>     to the use and seems to be pretty good privacy (good enough that law
>     enforcement is concerned about NAT). I suppose a similar effect could
>     be achieved with a transparent proxy.
> 
> 
> CGN/NAT logs all your sources and destinations.
> 
> The network operators will say they must do it for LEA compliance.
> 
> But once it is logged and stored it is available for nefarious hackers 
> and big data marketing folks.
> 
> That said, most of you in north america have ipv6 on your phones. Do you 
> feel that behavior of cycling addresses is not sufficient (barring ATT 
> which proxies all HTTP afaik) ?
> 
> 
> 
> 
>     You might want to take a look at
>     draft-herbert-ipv6-prefix-address-privacy-00.
> 
>     Tom
> 
>      > --
>      > Michael Richardson <[e-mail]
>     <mailto:[e-mail]>>, Sandelman Software Works
>      >  -= IPv6 IoT consulting =-
>      > --------------------------------------------------------------------
>      > IETF IPv6 working group mailing list
>      > [e-mail] <mailto:[e-mail]>
>      > Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
>      > --------------------------------------------------------------------
> 
>     --------------------------------------------------------------------
>     IETF IPv6 working group mailing list
>     [e-mail] <mailto:[e-mail]>
>     Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
>     --------------------------------------------------------------------
> 
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>