Re: [Masque] MASQUE detection through tracking trackers

[Ted Hardie <[e-mail]>]

Hi Töma,

Replies in-line.
On Tue, Nov 5, 2019 at 9:31 AM Töma Gavrichenkov <[e-mail]> wrote:

> Peace,
>
> On Tue, Nov 5, 2019, 8:15 PM Ted Hardie <[e-mail]> wrote:
>
>> You included HTTP(S) in the "redirect to a web page" here, but it's not
>> clear why the client connection would continue far enough to display a web
>> page
>>
>
> No, obviously, this is a captive portal story.  Every page would just
> display a TLS error, so the user would have to click through it at some
> point to regain access.
>
> Okay, so any system not configured to allow that just hard fails.
Understood.


>
>
>>> Any idea if this is being sold/deployed in Europe?  Because it looks
>> like it amounts to "you must disclose your data to 3rd party trackers" to
>> access unrelated resources.
>>
>
> I can't say I'm following your point.
>
> Anyhow, the customer base is mostly out of the EU I believe.  Why?
>
>
>  I'm hardly a GDPR expert
>>
>
> Me too, but I don't see any issues with GDPR.  The vendor does not own a
> Web tracker, they only track existing ones.
>
> Again, I am not expert here, so my presumption may well be wrong.  But if
I understand the system correctly, a client which does not consent to using
the trackers (like the NoScript user) is prevented from accessing
anything.  The network deploying the device thus seems to be requiring
disclosure of information to use its service, even though what it is
collecting is signal from the data rather than the data itself.

The regulations require that when "data is collected, data subjects must be
clearly informed <https://en.wikipedia.org/wiki/Privacy_policy> about the
extent of data collection, the legal basis for processing of personal data,
how long data is retained, if data is being transferred to a third-party
and/or outside the EU, and any automated decision-making that is made on a
solely algorithmic <https://en.wikipedia.org/wiki/Algorithm> basis." (from
Wikipedia's summary)  This would seem to run into those requirements (data
collection, 3rd party, algorithmic basis), hence the question about whether
it was sold in Europe.

Interesting that it is mostly EU customers.

>
>
>> From section 7.1:
>>
>
> Yup, have read it.  PADDING frames won't help here.  A tracker may even
> not be running over QUIC.  I, for one, have no idea when e.g. NewRelic is
> going to adopt it.
>

Agreed; I cited it only to point out that it is currently out of scope.
Traffic analysis that includes non-QUIC traffic would be particularly hard
to address in the document anyway.

Thanks again for sending the information,

Ted