[perpass] Getting started...

[Stephen Farrell <[e-mail]>]

Hi all,

We've enough folks subscribed now (50ish) to kick off.

For those who weren't in Berlin, here's a bit of context. We had a
(hastily arranged:-) meeting after the tech plenary with about 30 or
so folks including Jacob and Linus from the Tor project.  Topics
ranged from that day's announcements from the Guardian newspaper to
issues the Tor project have faced with fingerprinting, and that lead
to a good discussion about how the current threat models we use in the
IETF (whether more or less formally) don't usually take into account
the potential for very widespread passive (or active) monitoring of
nodes using IETF protocols.  That was followed up in the bar in
various ways (please chime in if you remember bits of that or the
earlier chat I've missed out on:-) and we figured that setting up
this list would be a good starting point for us to try see what work
related to this topic might make sense in the IETF.

You should have seen the scope Sean and I figured might work for this
list [1] so let's try to keep to that, but its not a strict charter
or anything so don't be too constrained by it for now.  As this is an
IETF list, normal rules (IPR and netiquette) apply, if you're not
sure if something is appropriate for this list, feel free to ask Sean
or I offlist, but our hope is to try make progress on some or all of
the following:

- experiences with IETF protocols and how they allow for
  fingerprinting and monitoring, esp. in unexpected ways
- things we might practically do about that in the IETF, ideally in
  terms of concrete ideas for protocol or operational changes, and even
  more ideally with protocols that have active working groups who're
  interested in taking on such work
- ideas for new work that'd make our protocols more robust in the
  face of such pervasive monitoring
- descriptions of new threat models that might help people doing
  protocol work in the IETF
- how to get to a "privacy by default" situation as Randy called
  it
- whatever else fits the scope:-)

The only thing to add to that for now is that since the kinds of
monitoring we're considering can be done at many layers, we should
not only be considering the web, or application layer or just
security protocols, but the full suite of protocols and areas in
which the IETF works.

And as usual, since its an IETF list, people need to grab a topic
and organise themselves to do the work or it probably won't happen.
But Sean and I are both supportive of this and willing to help
make sensible stuff happen if we can.

So over to you, what should we be doing?

Thanks,
Sean & Stephen.

[1] http://www.ietf.org/mail-archive/web/ietf-announce/current/msg11780.html