Re: [perpass] Getting started...

Hi SM,

On 08/17/2013 01:40 AM, SM wrote:
> Hi Stephen,
> At 09:42 16-08-2013, Stephen Farrell wrote:
>> IETF list, normal rules (IPR and netiquette) apply, if you're not
>> sure if something is appropriate for this list, feel free to ask Sean
>> or I offlist, but our hope is to try make progress on some or all of
>> the following:
>>
>> - experiences with IETF protocols and how they allow for
>>   fingerprinting and monitoring, esp. in unexpected ways
>> - things we might practically do about that in the IETF, ideally in
>>   terms of concrete ideas for protocol or operational changes, and even
>>   more ideally with protocols that have active working groups who're
>>   interested in taking on such work
>> - ideas for new work that'd make our protocols more robust in the
>>   face of such pervasive monitoring
>> - descriptions of new threat models that might help people doing
>>   protocol work in the IETF
>> - how to get to a "privacy by default" situation as Randy called
>>   it
>> - whatever else fits the scope:-)
>>
>> The only thing to add to that for now is that since the kinds of
>> monitoring we're considering can be done at many layers, we should
>> not only be considering the web, or application layer or just
>> security protocols, but the full suite of protocols and areas in
>> which the IETF works.
> 
> "Privacy by default" has, up to now, been a failure in the IETF.  

Not sure that I agree. We don't do that, sure. But it'll only be
a failure when we've actually tried, and we've not. And partly
that's because not enough of us know what can be done.

> As you
> pointed out things do not happen unless someone volunteers to do the
> work.  There has been a lack of volunteers.  I don't know why.  I don't
> know who is trying to fix that.

"We" are trying to fix that, where we == this list.

> Discussions about monitoring is a sensitive subject.  

Yes. However, even those who want to be able to monitor at point X,
probably don't want their sensitive stuff monitored at points Y,Z,...
So you don't actually have to have inhaled all the fumes to think
its a good plan for Internet protocols to be more robust against
pervasive monitoring.

> I am curious to
> see whether the 50 people are willing to discuss about that on this
> mailing list. :-)

I hope so. We had some good discussions in Berlin at any rate and
my hope is that at least the people involved in that will chime in.
But I guess we'll see when we see.

S.

> 
> Regards,
> -sm
> _______________________________________________
> perpass mailing list
> perpass@ietf.org
> https://www.ietf.org/mailman/listinfo/perpass
> 