Re: Address privacy

[Tom Herbert <[e-mail]>]

On Tue, Jan 28, 2020 at 2:09 PM Fernando Gont <[e-mail]> wrote:
>
> On 28/1/20 16:50, Tom Herbert wrote:
> >
> >
> > On Mon, Jan 27, 2020, 7:57 PM Fernando Gont <[e-mail]
> > <mailto:[e-mail]>> wrote:
> >
> >     On 28/1/20 00:10, Tom Herbert wrote:
> >      > On Mon, Jan 27, 2020 at 5:36 PM Fernando Gont
> >     <[e-mail] <mailto:[e-mail]>> wrote:
> >      >>
> >      >> On 26/1/20 18:37, Nick Hilliard wrote:
> >      >>> Tom Herbert wrote on 26/01/2020 20:16:
> >      >>>> It's intuitive
> >      >>>> that a higher frequency of address rotation yields more privacy
> >      >>>
> >      >>> intuitive, but probably inaccurate because of the a priori
> >     assumption
> >      >>> that privacy is strongly associated with the endpoint identifier.
> >      >>
> >      >> In many cases, it is: you log in to fb with a given address, and
> >     reuse
> >      >> that address to do other stuf
> >      >>
> >      > Yes, that's the "always on" network application that would allow
> >      > address tracking and identification at even high frequency of address
> >      > change. An exploit based on that is described in section 4.4 of
> >      > draft-herbert-ipv6-prefix-address-privacy-00. I believe the only way
> >      > to defeat this exploit would be single use (per flow), uncorrelated
> >      > address.
> >
> >     Agreed. That said, temporary addresses, for obvious reasons mitigates
> >     activity correlation over time -- certainly not to the same extent that
> >     the paranoid "one address per flow" would.
> >
> >
> > Fernando,
> >
> > The rationale for temporary addresses may be obvious, but I don't
> > believe anyone has yet quantified the effects. For instance, RFC4941 is
> > thirteen years old, is there any evidence that it has materially
> > improved anyone's privacy? (I'm not being cynical, but I think it's a
> > fair question).
>
> I don't think you can quantify privacy. What would be the units for that?
>
> There's secrecy and not-secrecy. But with these things, you simply
> mitigate (to some extent) the ability to correlate network activity.
>
Fernando,

In the case of single use addresses, that is each flow gets its own
addresses, the privacy effects are quantifiable. Since each flow has a
different source address, no two flows or communications can be
correlated to being sourced from the same user. In this case, the
identifiers are not reused is used in multiple contexts, so it isn't
possible to correlate seemingly unrelated activity using an
identifier. When an identifier is reused for the same node, even once,
then the possibility of correlations exists.

>
>
> > One might compare this to the policy of some sys admins that users need
> > to change passwords regularly. The rationale is similar, but that
> > practice has been most debunked as not improving security and in fact is
> > more of a burden to users that providing any real value.
>
> I don't think it has been debunked. Certainly, if you change your
> password, you limit the ability of the attacker that had obtained your
> password from re-using the same credentials. (assuming they are not used
> for a system where they can install backdoors, etc.). Most things we
> emply for security have an associated lifetime...
>
It's a false sense of security. Here's a good analysis:
https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes

Tom

> --
> Fernando Gont
> SI6 Networks
> e-mail: [e-mail]
> PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
>
>
>
>