Re: 6man w.g. last call for <draft-ietf-6man-default-iids-11.txt>

[joel jaeggli <[e-mail]>]

On 5/16/16 1:30 PM, Brian E Carpenter wrote:
> On 17/05/2016 05:29, Alissa Cooper wrote:
>> Hi Lorenzo,
>>
>>> On May 13, 2016, at 8:29 PM, Lorenzo Colitti <[e-mail]> wrote:
> 
> ...
>>> any remote attacker anywhere on the Internet that ever exchanges a packet with that host can track it every time the host visits the same network, *forever*, with no recourse. Section 3 point 1.
>>>
>>> Either we fix that or we stop asserting that this draft is motivated by privacy considerations.
>>
>> I would frankly be thrilled if we could get away from stable addresses altogether. But I’m skeptical about the feasibility of achieving consensus around that at present. Defining the approach in this draft in the meantime is certainly motivated by consideration for privacy improvement for me, even if that improvement is incremental.
> 
> Exactly. There is a tussle between enterprise or campus network operators who
> have a strong desire for stable addresses (such that they can identify miscreants)
> and individuals who want to avoid tracking (such that they can avoid surveillance).
> That tussle is not going to go away any time soon, so stable client IIDs are not
> going away either.
> 
> I don't expect enterprise or campus operators to react well to pseudo-random MAC
> addresses, either.

So long as they're as long lived as your 802.1x or wpa2 enterprise
association, it's not really a big deal what your mac address is.
port-security methods already get tetchy when you abandon your previous
identity in favor of a new one without disconnecting or re-authentication.

>     Brian
> 
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>