Re: [Ohttp] Is the use of this work likely to help miscreants more than those in need of privacy?

[Martin Thomson <[e-mail]>]

On Wed, Jun 16, 2021, at 06:21, Eliot Lear wrote:
> Harumph.  I think who the proxy is supposed to be working for is pretty 
> fundamental.

OK, let's talk about that some more.  The draft goes into a bit of detail on this point, but it is probably worth rehashing.

The proxy is mutually chosen by client and server.  Both trust the proxy a tiny bit.  The client trusts that the proxy won't reveal links between its requests.  The server trusts that that proxy will not overload it.  That's just about it.  There's a little more to the client trust in that the proxy might need to do something more about traffic analysis, but that's somewhat less concrete as that remains an open-ended problem.

Relying on trust is a point of difference from systems like Tor, which assume very little mutual trust.

Take a concrete deployment example.  Mozilla has identified several classes of telemetry that we would like to collect.  We split that into stuff that is safe to attribute to users, stuff that might be a privacy risk but only if it is aggregated, and more sensitive stuff (and of course there might be stuff we decide is too dangerous to gather under any circumstances).  We use direct submission for the first, ohttp for the second, and MPC-based designs like Prio for the last category.  To deploy ohttp for this, we contract with an independent third party who we hope our users find trustworthy.  For the server, they agree not to allow spamming; for the client, they agree not to pass on IP addresses and the like.  Yes, in this, the proxy would formally be deriving support from Mozilla, but as vendor of both client and server, that's the only option.  As far as it goes, that is what our Prio deployments look like as well, to my knowledge.