Re: Address privacy

[Tom Herbert <[e-mail]>]

On Tue, Jan 28, 2020 at 3:45 PM Fernando Gont <[e-mail]> wrote:
>
> On 28/1/20 19:45, Tom Herbert wrote:
> [...]
> >> I don't think you can quantify privacy. What would be the units for that?
> >>
> >> There's secrecy and not-secrecy. But with these things, you simply
> >> mitigate (to some extent) the ability to correlate network activity.
> >>
> > Fernando,
> >
> > In the case of single use addresses, that is each flow gets its own
> > addresses, the privacy effects are quantifiable. Since each flow has a
> > different source address, no two flows or communications can be
> > correlated to being sourced from the same user. In this case, the
> > identifiers are not reused is used in multiple contexts, so it isn't
> > possible to correlate seemingly unrelated activity using an
> > identifier. When an identifier is reused for the same node, even once,
> > then the possibility of correlations exists.
>
> You are not quantifying privacy: that's still qualitative description.
>
It is quantified. If a flow uses a unique address then the risk of
using the address of packets in the flow to correlate to other flows
is zero.

>
>
>
> >>> One might compare this to the policy of some sys admins that users need
> >>> to change passwords regularly. The rationale is similar, but that
> >>> practice has been most debunked as not improving security and in fact is
> >>> more of a burden to users that providing any real value.
> >>
> >> I don't think it has been debunked. Certainly, if you change your
> >> password, you limit the ability of the attacker that had obtained your
> >> password from re-using the same credentials. (assuming they are not used
> >> for a system where they can install backdoors, etc.). Most things we
> >> emply for security have an associated lifetime...
> >>
> > It's a false sense of security. Here's a good analysis:
> > https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes
>
> Forcing password changes exacerbate some human aspects, and at times
> leads to trouble. That doesn't say it doesn't have a place.
>
> Folks also argue that firewalls are a false sense of security. Some
> argue the same about resistance to address-scan -- even when the #1 task
> to hack a system is normally to find it. IMO, whatever makes the
> attacker's life harder has a place and a use.

For things like address-scan and breaking a key, the risk of attack
can be quantified based on existing processing capabilities needed for
brute force attack. Deriving correlations between flows based on
addresses isn't quantifiable in the same way since it's not a brute
force attack.

Regardless, I still haven't seen a reasonable answer to user's obvious
question regarding temporary address: "What should my frequency of
address change be to ensure my privacy?"

Tom

>
> Thanks,
> --
> Fernando Gont
> SI6 Networks
> e-mail: [e-mail]
> PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
>
>
>
>