Re: [Model-t] draft-thomson-tmi

[Christian Huitema <[e-mail]>]

On 7/14/2020 5:44 AM, Eric Rescorla wrote:
>
>
> On Mon, Jul 13, 2020 at 9:33 PM Christian Huitema <[e-mail]
> <mailto:[e-mail]>> wrote:
>
>     On 7/13/2020 5:25 PM, Martin Thomson wrote:
>
>>     On Mon, Jul 13, 2020, at 18:55, Vittorio Bertola wrote:
>>>     I think that this really depends on who you are and how you see the 
>>>     world. There are people who are more afraid of the endpoints, given how 
>>>     hard it has become to be able to know and choose who you (the 
>>>     applications and devices you use) communicate with - so these people 
>>>     would like to become intermediaries, or install intermediaries, to 
>>>     regain control of their communications. 
>>     I did not claim that this was addressing all of the problem.  I agree that not being able to trust endpoints that you bought and are responsible for maintaining is a real problem.  I disagree with the idea that more intermediation is any sort of solution.
>
>     Yes. There is a privacy argument that it is important to be able
>     to inspect what comes out of the device, in order to shine a big
>     light on possible privacy abuses. There are also two classes of
>     counter arguments: first, that weakening the data protection of
>     these devices plays in the hands of a variety of bad actors; and
>     second, that in the case of competent device makers, inspecting
>     the traffic won't reveal much.
>
>     Take the example of a cloud-backed security camera. Inspecting the
>     traffic will show that it is sending streams of video images to
>     the cloud service. That won't be a surprise, because that's
>     exactly what the device is sold for: send the images to a remote
>     service, so the users can check the security of their home from
>     their cell phone in the office. At the same time, just knowing
>     that will not tell you that the images are harvested to feed a
>     facial recognition database, or that they are made available to
>     the police. That kind of abuse happens in the back end. And yes,
>     there are real life examples of door-bell cameras doing exactly
>     that. And of course we could define the same scenarios for
>     thermostats, light bulbs and many more.
>
>     Asking the device makers for a way to inspect their traffic of
>     such devices won't give you much, and the back doors required for
>     enabling that are almost guaranteed to be abused by hackers. What
>     you really want is some form of control on what happens to your
>     data once they reach the cloud.
>
> I agree that that would be good. Another approach is to have the
> devices be open source so that one can determine what it is they do,
> rather than attempting to reverse engineer it from the traffic.


Open source the software is indeed a good idea but software these days
is only partly on the device. Take the example of the doorbell camera.
If you open source the software, you will verify that what it does is
sending video streams to the cloud. You will not see that the cloud
itself is forwarding the streams to the police, or doing face
recognition and extracting meta-data to document your social graph. If
the problem is in the cloud, the solution has to address the cloud.

-- Christian Huitema