Re: [privacydir] Privacy Terminology: What are useful terms?

[Nick Mathewson <[e-mail]>]

Hello, Hannes!

On Tue, Jul 5, 2011 at 6:48 AM, Hannes Tschofenig
<[e-mail]> wrote:
 [...]
> From your experience, what other terminology is useful to have?

I'm going to answer from the perspective of my own work on anonymity
and privacy with Tor, recognizing that not everybody's needs are the
same as our own.

We use "Linkability" and subject "Anonymity" in approximately the same
ways that you do.  (We mostly use the "attacker cannot sufficiently
distinguish" formulation, not the "Attacker cannot distinguish"
formulation.  In practice, the attacker's inability to link X and Y
with certainty is mostly useless if the attacker can nevertheless link
X and Y with strong probability.  When we're being precise, we use
these terms to mean the degree of the attacker's uncertainty.)

We also use "Anonymity" to refer to unlinkability between an IOI and its origin.

We use a stronger definition of "pseudonym": we only consider X to be
a pseudonym when it is an identifier that is unlinkable to its subject
by an attacker of interest.  (Thus, by our lights, "Batman" is a
pseudonym since Batman's enemies do not know he is Bruce Wayne, but
"Ad-Rock" is not a pseudonym since Beastie Boys fans worldwide know
that he is really Adam Horovitz.)

We don't use "undetectability" or "unobservability".

Some additional terminology in common use that we use:

   * Instead of "sender" and "receiver" anonymity, we usually speak of
"initiator" and "responder" anonymity.  (In systems that provide
bidirectional communication, most everybody "sends" and "receives".)

   * We talk about one kind of or item being "distinguishable" from
another.  (For example, a protocol is "indistinguishable" from HTTPS
to the extent that an attacker can't tell instances of that protocol
from regular HTTPS connections.)

  * We use "profiling" to mean learning information about an anonymous
subject's activities without necessarily linking them to any specific
transaction.  For example, if an attacker concludes that I play WoW,
read reddit.com, and upload videos, then my activities have been
profiled, even if the attacker is unable to identity which connections
or accounts are mine.

Some additional terminology that I think might be idiosyncratic:

   * We use "linkable session" to refer to a set of actions by a
subject that the system makes no effort to render unlinkable from one
another.

   * We refer as a "linking identifier" to any parameter P that an
attacker can observe about an IOI and use to link it to similar IOIs
that have similar values for P.  For example, the window size header
transmitted in a typical HTTP request is a linking identifier.


Many thanks for all your work here!

yrs,
-- 
Nick