Re: [Masque] MASQUE detection through tracking trackers

[Töma Gavrichenkov <[e-mail]>]

Peace,

On Tue, Nov 5, 2019, 9:13 PM Ted Hardie <[e-mail]> wrote:

> Okay, so any system not configured to allow that just hard fails.
> Understood.
>

Yup.  A typical phone or a laptop isn't.  IDK how the IoT is being
processed, but I assume that's a pretty simple heuristics.



> The regulations require that when "data is collected, data subjects must
> be clearly informed <https://en.wikipedia.org/wiki/Privacy_policy> about
> the extent of data collection, the legal basis for processing of personal
> data, how long data is retained, if data is being transferred to a
> third-party and/or outside the EU, and any automated decision-making that
> is made on a solely algorithmic <https://en.wikipedia.org/wiki/Algorithm>
> basis." (from Wikipedia's summary)
>

IANAL, but the entity doesn't collect the data itself, so might be outta
scope of GDPR.

BTW, GDPR doesn't only work in EU, it works in every place on Earth where
an EU citizen could land.



> Interesting that it is mostly EU customers.
>

Argh!  My bad, that was an occasional ambiguity due to phone keyboard
suggestions.  No, the customers are outSIDE of EU.  Most of them, I assume.



>> Agreed; I cited it only to point out that it is currently out of scope.
> Traffic analysis that includes non-QUIC traffic would be particularly hard
> to address in the document anyway.
>

Too bad.  A dumb traffic analysis might be out of scope, but a complex
traffic analysis might render VPN research senseless.  Who needs a
perfectly secure communication protocol which could be easily detected and
blocked.

--
Töma

>