Re: Disabling temporary addresses by default?

[Christopher Morrow <[e-mail]>]

(I'm going to hate myself in the morning for this, but..)

On Wed, Jan 29, 2020 at 6:54 AM <[e-mail]> wrote:
>
> Lorenzo,
>
> > So, are you saying that using temporary addresses does not leak the habits of employees?
> >
> > I'm saying using temporary addresses makes a number of attacks, including cross-site tracking, more difficult, infeasible, or defeatable by the employee or IT admin. If you believe that to be false, you can always try to see if you can get consensus on a document that says that privacy addresses are not useful and declares RFC 4941 historic. :-)
>
> Anything you can cite here?
> Just because you state it does not make it fact.
> After almost 20 years of temporary addressing, it seems there is very little data available.

If we're talking about 'employees' and 'employers' (you can extend
this to the ISP if you like easily enough)
  1) you can see port / mac / neighbor maps on
switches/routers/brouters/swouters  (this gets you a
person/desk/machine)
  2) you can link DNS requests and firewall logs to the IP address(es)
  3) you can be even simpler by just logging the IP src-address on any
'single sign-on' (or access to authenticated corporate resource) to
ensure you mapped the things in 1 correctly
  4) you can sort / sift / alert on that data to your heart's content.

This isn't rocket science... Is there data for this? kinda? there are
products which do this today, One even I think made by the Cisco /
Talos folks for 'idp / ids / exfiltration detection' and similar uses.
Heck, any SEIM today can/does do this work trivially.


Now, extend that to your ISP? sure, same problem, larger userbase and
higher feeds/speeds.