Re: [perpass] privacy implications of UUIDs for IoT devices

[Fernando Gont <[e-mail]>]

On 10/05/2016 09:01 PM, George Michaelson wrote:
> As an example the IEEE MAC registry is really only to provide
> uniqueness, but its been demonstrated to act as a passive-capture
> mechanism to identify probable host architecture from on-the-wire
> sniffs. This then leads directly to: "If its a Dell, then I know the
> iDrac default password so I can attempt to see if this is a badly
> configured Dell which has iDrac IPMI on the host address" and like
> attacks.
> 
> Unique identifiers are being used by the cellular provider to offer
> price differentiated service to people on the same basic substrate.
> Which is a poshed-up way of saying you can get a SIM which is dataplan
> for an iPad but if you put it in your phone you are in breach of
> contract over the use of that SIM. I am not personally a fan of this
> legalism, but it is legal, and it is an ism.
> 
> I think there is a fundamental tension between baked in uniqueness,
> probabalistic uniqueness (think ULA) and non-unique state in Layer-2
> and Layer-3

Please see: draft-gont-numeric-ids-generation-01

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492