[Pearg] Numeric IDs (Fwd: [ietf-privacy] Privacy of CLIENTID for IMAP/SMTP)

Fernando Gont <fgont@si6networks.com> Mon, 19 August 2019 20:52 UTC

Return-Path: <fgont@si6networks.com>
X-Original-To: pearg@ietfa.amsl.com
Delivered-To: pearg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EBF29120045 for <pearg@ietfa.amsl.com>; Mon, 19 Aug 2019 13:52:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E8N9ZU0TB9lm for <pearg@ietfa.amsl.com>; Mon, 19 Aug 2019 13:52:47 -0700 (PDT)
Received: from fgont.go6lab.si (fgont.go6lab.si [91.239.96.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 829FA120048 for <pearg@irtf.org>; Mon, 19 Aug 2019 13:52:47 -0700 (PDT)
Received: from [192.168.1.17] (ppp-94-69-228-254.home.otenet.gr [94.69.228.254]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by fgont.go6lab.si (Postfix) with ESMTPSA id BAA42847BF; Mon, 19 Aug 2019 22:52:45 +0200 (CEST)
References: <ae89b75c-65c3-db47-8152-19ef3f96dcb1@kuix.de>
To: "pearg@irtf.org" <pearg@irtf.org>
From: Fernando Gont <fgont@si6networks.com>
Openpgp: preference=signencrypt
Autocrypt: addr=fgont@si6networks.com; prefer-encrypt=mutual; keydata= mQINBE5so2gBEACzBQBLUy8nzgAzSZn6ViXT6TmZBFNYNqTpPRvTVtUqF6+tkI+IEd9N2E8p pXUXCd0W4dkxz6o7pagnK63m4QSueggvp881RVVHOF8oTSHOdnGxLfLeLNJFKE1FOutU3vod GK/wG/Fwzkv9MebdXpMlLV8nnJuAt66XGl/lU1JrNfrKO4SoYQi4TsB/waUQcygh7OR/PEO0 EttiU8kZUbZNv58WH+PAj/rdZCrgUSiGXiWUQQKShqKnJxLuAcTcg5YRwL8se/V6ciW0QR9i /sr52gSmLLbW5N3hAoO+nv1V/9SjJAUvzXu43k8sua/XlCXkqU7uLj41CRR72JeUZ4DQsYfP LfNPC98ZGTVxbWbFtLXxpzzDDT8i3uo7w1LJ2Ij/d5ezcARqw01HGljWWxnidUrjbTpxkJ9X EllcsH94mer728j/HKzC9OcTuz6WUBP3Crgl6Q47gY5ZIiF0lsmd9/wxbaq5NiJ+lGuBRZrD v0dQx9KmyI0/pH2AF8cW897/6ypvcyD/1/11CJcN+uAGIrklwJlVpRSbKbFtGC6In592lhu7 wnK8cgyP5cTU+vva9+g6P1wehi4bylXdlKc6mMphbtSA+T3WBNP557+mh3L62l4pGaEGidcZ DLYT2Ud18eAJmxU3HnM8P3iZZgeoK7oqgb53/eg96vkONXNIOwARAQABtCVGZXJuYW5kbyBH b250IDxmZ29udEBzaTZuZXR3b3Jrcy5jb20+iQJBBBMBAgArAhsjBQkSzAMABgsJCAcDAgYV CAIJCgsEFgIDAQIeAQIXgAUCTmylpQIZAQAKCRCuJQ1VHU50kv7wD/9fuNtTfxSLk3B3Hs3p ixTy8YXVjdkVwWlnJjFd7BOWmg7sI+LDhpjGfT6+ddOiwkumnvUZpObodj4ysH0i8c7P4C5t F9yu7WjklSlrB5Rth2CGChg5bKt541z2WHkFFxys9qBLmCSYDeKQkzLqhCjIUJizY2kOJ2GI MnSFDzJjhSFEh//oW830Y8fel1xnf/NVF+lBVtRMtMOfoWUqDjvP3sJ1G4zgkDCnF0CfncLx +hq2Mv26Uq9OTzvLH9aSQQ/f067BOkKAJKsfHdborX4E96ISTz57/4xECRSMr5dVsKVm4Y// uVIsb+L5z+a32FaiBZIAKDgnJO7Z8j6CV5e5yfuBTtX52Yi9HjYYqnYJGSDxYd6igD4bWu+7 xmJPHjkdqZgGV6dQIgiUfqkU+s5Cv350vK48CMaT/ZLo2BdsMhWsmaHmb+waePUMyq6E4E9x 9Js+EJb9ZiCfxS9exgieZQpet1L36IvhiwByvkQM009ywfa30JeMOltUtfLi5V06WQWsTzPL 5C+4cpkguSuAJVDTctjCA0moIeVDOpJ8WH9voQ4IeWapQnX35OIoj1jGJqqYdx65gc1ygbyx b8vw+pJ9E5GLse5TQnYifOWpXzX9053dtbwp/2OVhU4KLlzfCPCEsoTyfu9nIZxdI2PMwiL5 M85BfjX4NmwBLmPGoLkCDQRObKNoARAAqqXCkr250BchRDmi+05F5UQFgylUh10XTAJxBeaQ UNtdxZiZRm6jgomSrqeYtricM9t9K0qb4X2ZXmAMW8o8AYW3RrQHTjcBwMnAKzUIEXXWaLfG cid/ygmvWzIHgMDQKP+MUq1AGQrnvt/MRLvZLyczAV1RTXS58qNaxtaSpc3K/yrDozh/a4pu WcUsVvIkzyx43sqcwamDSBb6U8JFoZizuLXiARLLASgyHrrCedNIZdWSx0z0iHEpZIelA2ih AGLiSMtmtikVEyrJICgO81DkKNCbBbPg+7fi23V6M24+3syHk3IdQibTtBMxinIPyLFF0byJ aGm0fmjefhnmVJyCIl/FDkCHprVhTme57G2/WdoGnUvnT7mcwDRb8XY5nNRkOJsqqLPemKjz kx8mXdQbunXtX9bKyVgd1gIl+LLsxbdzRCch773UBVoortPdK3kMyLtZ4uMeDX3comjx+6VL bztUdJ1Zc9/njwVG8fgmQ+0Kj5+bzQfUY+MmX0HTXIx3B4R1I1a8QoOwi1N+iZNdewV5Zfq+ 29NlQLnVPjCRCKbaz9k6RJ2oIti55YUI6zSsL3lmlOXsRbXN5bRswFczkNSCJxJMlDiyAUIC WOay7ymzvgzPa+BY/mYn94vRaurDQ4/ljOfj6oqgfjts+dJev4Jj89vp8MQI3KJpZPEAEQEA AYkCJQQYAQIADwUCTmyjaAIbDAUJEswDAAAKCRCuJQ1VHU50km4xEACho45PZrUjY4Zl2opR DFNo5a6roTOPpgwO9PcBb3I5F8yX2Dnew+9OhgWXbBhAFq4DCx+9Gjs43Bn60qbZTDbLGJ/m 8N4PwEiq0e5MKceYcbetEdEUWhm5L6psU9ZZ82GR3UGxPXYe+oifEoJjOXQ39avf9S8p3yKP Diil0E79rn7LbJjMcgMLyjFg9SDoJ6pHLtniJoDhEAaSSgeV7Y745+gyMIdtQmrFHfqrFdjq D6G0HE+Z68ywc5KN67YxhvhBmSycs1ZSKAXv1zLDlXdmjHDHkU3xMcB+RkuiTba8yRFYwb/n j62CC4NhFTuIKOc4ta3dJsyXTGh/hO9UjWUnmAGfd0fnzTBZF8Qlnw/8ftx5lt4/O+eqY1EN RITScnPzXE/wMOlTtdkddQ+QN6xt6jyR2XtAIi7aAFHypIqA3lLI9hF9x+lj4UQ2yA9LqpoX 6URpPOd13JhAyDe47cwsP1u9Y+OBvQTVLSvw7Liu2b4KjqL4lx++VdBi7dXsjJ6kjIRjI6Lb WVpxe8LumMCuVDepTafBZ49gr7Fgc4F9ZSCo6ChgQNLn6WDzIkqFX+42KuHz90AHWhuW+KZR 1aJylERWeTcMCGUSBptd48KniWmD6kPKpzwoMkJtEXTuO2lVuborxzwuqOTNuYg9lWDl7zKt wPI9brGzquUHy4qRrA==
X-Forwarded-Message-Id: <ae89b75c-65c3-db47-8152-19ef3f96dcb1@kuix.de>
Message-ID: <98781be1-d9c7-31d8-3755-79ef60c7f0ea@si6networks.com>
Date: Mon, 19 Aug 2019 23:52:42 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0
MIME-Version: 1.0
In-Reply-To: <ae89b75c-65c3-db47-8152-19ef3f96dcb1@kuix.de>
Content-Type: text/plain; charset=windows-1252
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/pearg/IWcsDxf95sEPf0jiK5swpJJxWLg>
Subject: [Pearg] Numeric IDs (Fwd: [ietf-privacy] Privacy of CLIENTID for IMAP/SMTP)
X-BeenThere: pearg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Privacy Enhancements and Assessment Proposed RG <pearg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/pearg>, <mailto:pearg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/pearg/>
List-Post: <mailto:pearg@irtf.org>
List-Help: <mailto:pearg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/pearg>, <mailto:pearg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Mon, 19 Aug 2019 20:52:50 -0000

Folks,

As you can see, the topic comes up over and over again (when it does!
Because in all other cases, the outcome is simply flawed numeric IDs).

This is the reason why we produced the set of documents on numeric ids
(https://mailarchive.ietf.org/arch/msg/pearg/YlTn3VlnwFbnJ0IgNLTtLwg6W0c)

Thanks,
Fernando




-------- Forwarded Message --------
Subject: [ietf-privacy] Privacy of CLIENTID for IMAP/SMTP
Date: Mon, 19 Aug 2019 18:07:48 +0200
From: Kai Engert <kaie@kuix.de>
To: ietf-privacy@ietf.org

Hello,

I would like to ask for feedback on potential privacy concerns related
to the following drafts, that describe a CLIENTID feature for the IMAP
and SMTP protocols:
* https://tools.ietf.org/html/draft-yu-imap-client-id
* https://tools.ietf.org/html/draft-storey-smtp-client-id

The Thunderbird project is currently evaluating a request to support the
CLIENTID feature and enable it by default.

We'd like to ensure that we appropriately consider all potential privacy
issues that could arise as a consequence, prior to making decisions
about inclusion or default behavior.

Here is my quick summary of the CLIENTID feature:
* an email client creates a random client side identifier for itself,
  and stores it locally.
* at the time a client starts a connection with an IMAP or SMTP server,
  which the user has configured for accessing or sending mail, the
  server may ask the client to send a client identifier. If the client
  supports it, and if the connection is encrypted, then the client
  sends its client side identifier.
* the client ID doesn't replace the regular login credentials,
  but shall be treated as additional information about the client
  accessing the server.
* servers want to compare the client ID that is received on a
  connection, and draw the conclusion that the current client is
  the same client that has connected to the server in the past.
* the intention of the authors of the drafts is to make it easier
  for the server side to detect fraudulent login attempts.

We have already identified that reusing a single identifier across
multiple email accounts could allow a server to learn that those email
accounts are controlled by the same entity, and we don't want to allow
that. Consequently, Thunderbird would use a different client side
identifier for each account.

What are additional privacy concerns?

If multiple client computers are used to access the same email account,
this feature allows the server to distinguish the different computers.

For example, a user might regularly use two different computers to
access an email account, one computer at location A, and the other at
location B.

If both locations use a dynamic Internet connection with changing IP
addresses, as of today, the server probably cannot distinguish which
location was used to send an email. However, with the CLIENTID feature,
the server potentially could.

The server could use the CLIENTID feature to learn about habits. For
example, if emails from location A are primarily sent during daytime,
and emails from location B are primarily sent outside regular office
hours, the server could learn that the computer at location A is at an
office, and the computer at location B is in a private apartment.

Consequently, the server operator could draw conclusions where the user
was located at the time an email was sent.

Can you think of additional negative consequences for the user's privacy
with CLIENTID enabled?

Thanks in advance
Kai

_______________________________________________
ietf-privacy mailing list
ietf-privacy@ietf.org
https://www.ietf.org/mailman/listinfo/ietf-privacy