IETF Logo Mail Archive

Re: A question about user tracking with QUIC

Mirja Kuehlewind <mirja.kuehlewind@ericsson.com> Wed, 14 July 2021 17:01 UTC

Return-Path: <mirja.kuehlewind@ericsson.com>
X-Original-To: quic@ietfa.amsl.com
Delivered-To: quic@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2456E3A2523 for <quic@ietfa.amsl.com>; Wed, 14 Jul 2021 10:01:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.101
X-Spam-Level:
X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mro59g9zL-2D for <quic@ietfa.amsl.com>; Wed, 14 Jul 2021 10:00:56 -0700 (PDT)
Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60053.outbound.protection.outlook.com [40.107.6.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 34C713A251D for <quic@ietf.org>; Wed, 14 Jul 2021 10:00:56 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cQkR6t2VoemK5VLU6Mw0P5kO6j4b0Zs9LoaMSlUVVlxrylyopDdahsTOtAhd4WDPfihFlmb9sRyAB4KHMlc3DXyNTitwNWu2wxAWR0AC3NLW2FfG3T+b3W3aOT1P6c5UOC1MiqVYgAxiAulQAR2oz1FbX9GutdE/5q35LODOZTk/K9DeTfdduO9Mr/o4dtZ2DJRWM6MzYnbWKzIZn8m/FMZk0I5aXMmyPMXEPFUWOz618QrR3XTTwaWvAKnuZlOgW46N7Rt+t1vQINm9N9PTWN8soOAxSmaM9ghcY1fHRyBqoRX/dfGSbEsVnaPfUQkXqZsWllE0IfAj5WU6JAu9/Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OOsiUcsGkFdTtRyJPJXI6x4mtM68NBUwZmno97/Pvps=; b=MGQOW/8OBzt1OAkvR5dXd6VTI4N6jnYZfPuw1YLL7zPLvQPMwViS78KWl8FoEf8chrTg96/tWtvZSHkOZgNsdw7cU7lqyo9cq7QzoCom49U+QpviC4oYa1yRJ+CktjNl3P/s5x8NbvjWDWiuEj/VJMacLKbo7nGFXnc1Rg/utCURt3r8j31OsxlC+bb3B/EXHXdaPJed06pAqGpgDfKs0A7+rJvAnedKYbnz53V/Mp952q3ZAVO42dfNSNhOr8CWcO3RKQkSZqxDcAGh6ccRc/m8YVUIu+jtlYCedeSTMG6l9sV3wS6iybu152yd6Z2jVIfu8UkP3lO29SIXRStD2g==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OOsiUcsGkFdTtRyJPJXI6x4mtM68NBUwZmno97/Pvps=; b=QtF8jTfSUDnNNMHh+8EEjXP5vqCss+2DgqyOZl5J9bNUflXvlwbBkknUHIRsuoP6X5AvdKWDhADL81Rk3Ab0nTI5aGQ1d98xOlefiWmtD+YrgaAA29uE0bYtQaabsmW1RjGacBivnm6qDTejCE1H+qRnw+/2UU1cs8WJAqSstVQ=
Received: from DB9PR07MB7804.eurprd07.prod.outlook.com (2603:10a6:10:26d::21) by DB7PR07MB5736.eurprd07.prod.outlook.com (2603:10a6:10:2a::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4331.14; Wed, 14 Jul 2021 17:00:49 +0000
Received: from DB9PR07MB7804.eurprd07.prod.outlook.com ([fe80::869:6009:74d6:b3ea]) by DB9PR07MB7804.eurprd07.prod.outlook.com ([fe80::869:6009:74d6:b3ea%4]) with mapi id 15.20.4352.008; Wed, 14 Jul 2021 17:00:49 +0000
From: Mirja Kuehlewind <mirja.kuehlewind@ericsson.com>
To: Stephane Bortzmeyer <bortzmeyer@nic.fr>, IETF QUIC WG <quic@ietf.org>
Subject: Re: A question about user tracking with QUIC
Thread-Topic: A question about user tracking with QUIC
Thread-Index: AQHXW5onDSMH9yANmE60L/JCGqHLOqtDDemA
Date: Wed, 14 Jul 2021 17:00:49 +0000
Message-ID: <C0EFE417-EB96-4760-B416-A35C1114138A@ericsson.com>
References: <20210607123854.GA16312@nic.fr>
In-Reply-To: <20210607123854.GA16312@nic.fr>
Accept-Language: en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/16.48.21041102
authentication-results: nic.fr; dkim=none (message not signed) header.d=none;nic.fr; dmarc=none action=none header.from=ericsson.com;
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 1f0d0323-fc19-46aa-a967-08d946e8ee49
x-ms-traffictypediagnostic: DB7PR07MB5736:
x-microsoft-antispam-prvs: <DB7PR07MB5736DED67E38D86AD304CDE4F4139@DB7PR07MB5736.eurprd07.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:9508;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: QimbjinEduNg7Zn5Z53kdkIZsmNv4TD9V6RTKt6pP2RbKvgAu9o1otSwqJwqVo3FYEsbyJ2lQsEcsWBwzJ3GYf8GIgzj7UlRDBrdrgbJwCXy4do/UP6m6iNVnkU3e+AiUhzu/5wZkCo9F8Pu+3zDPXV1t+wJ1HshJDa9H2sK6SDRkIg+wG34oF9+XsUrErsc5IJzbi6JMeUcU5OeF6bPMO6duwWGKladvb5mK6K2e3nMWJucG0Yh7Z8LbH6WFZzGpfAL1S0DGrFfHkvEKe1GcZHfp/fG5s4h5+fzxgsB+yvK5k147j2aOWJOvODYhSGaIAMDmvzCEkpychjE7hu+M/e52m4c9IB6tSUDwtar/nI0PEt9Mt5Wk0EjLvOzynhqX67BRYMY0TGcr2BdCW+5rf3z08U3CG9mQQpqSqXsdzjD0zqydYJmUrCTtbisQ3UczICOEGVLAnTr2weWY5RHGs56olCvbv6zdYEe78UYh2MkLG02Ojt1UCvAcYMXL9tux9C+U5tLfxNX53XLV4ZPhsFvWWU5ev6GComTPwZ+tCbrvL0JCoqLZfx5MDV1XpyixoUncprXTjqC+Y4tLu6C07i68o+EyR1g/if++oSwIl4ZyoM1EXX1/sRiMJqShtV8mokQvsiFKqEtA2sK6AJpD+5d53zvLmRSXiMY1yhw1M1M5sAVRLWdXSi4P+3Hw8HntDo5v40Y6IkiWOJvAiJZDMo83U/l8cuRmZKiIeOj4bE34QPLI/pvhY92Ejo9Ccbl5uL9km7E+RqZLLO9x0WHLRiLH0yf5n7YoZrstiJ7KAJImTTCcrd25lP0YMP9TO9X
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB9PR07MB7804.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(376002)(136003)(396003)(39860400002)(346002)(366004)(71200400001)(66476007)(2616005)(966005)(110136005)(6486002)(66556008)(478600001)(8936002)(33656002)(64756008)(44832011)(122000001)(5660300002)(316002)(36756003)(2906002)(66446008)(6512007)(6506007)(8676002)(83380400001)(66574015)(66946007)(38100700002)(76116006)(91956017)(186003)(86362001)(38070700004)(45980500001); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: Zz8WoJRGSBCUrGcgVWcdqTQ2nfm6uH30rjmBByJNWJIMT/6MmlYwWJzGYLeprO4qWxDKAvxtKQx9YFGgB7mVrbfTzwNMLr7UuCVW87eRkUEU29S1OR0EBtmP8o82C6tSsuMRFvpsZEDELf44uY8OB77VUTmQnmsU03v9QBiXFTPAnJfSmDPRTrcJ2aj3OCuUiCr6lGy2rOLODagO0G6a6W+mMvK+W5MdFH/qm9DW5X3SCU8rxS9iNDhgR+KnFjuBmifaYWZ6qWAHw91bUAsNBtUzVnL8qmhxBM2BTyUhLPxcoUvGbkfJIdQf+yMkAyDzB1z05pa1E5EoIlFkcYqdkdylmYuHGvx/J/TDNg9SBCnmI9EqxiWuyt6x9Srv0Z09Tw8bthjXZwLb9MqLimxOlOTaq4I9OmtHUmJtkfPk4oJfN8BBTvDBAi0uZzMgwCTnwbndYTKLTQVBvzQY2pzQJMbf/QnhVIhGHgFREpx6UHazQe7atbqM63u9sX1GQqwvm4kOslolA9a8nb0yNhPmIC1AR3HYr34Z5+SR0pq9WAJ07SLckt2ZtIo4mr+umaQrCsToe2TqRSlXaYr4f+ktECzqEKcBzRJfyNYhIbvMVgxdbRYVofdCHoABUdxv83Bxsei/g+bOcMChRRFYWF8JRfO0CWVP5V2VmRmJwJwFEDBeEcqqcXqKNv7HnNWnX/mijpZExGO+p/ksjHKT2fJo7Iz4eseQDsXKogfyTT2OKPRF4gnlEdUs6J8NwEkWGQQ1+HFj+4mUNCRxcGD/UGdHrrWcDf8ySU13zTU+WFZoAcKKBq3qVokjfGRcNhDwhiB83wVgUM9Pn7gmWq/sAHUvMHmUbiRxEGANh3BLOoqiVaUUSAWE4zq32ESyaClIb0FJCAoqQGVxhuisbtLiNrRnxzfsAGAjgb/P1l7aTViMzOS8ka602v5uKBHh4H25PdEN8KC1vxYK1JMGOx8yY+ghpk+4AuS/A0DTgtzjH1E0kSS3sAOGcfmSPu/x6/MIkRrOOuXALFJ0BIJKEADAYdUiqdHzoEzafK954mQAzQWTnSucWd3ZvW8b3DeoP+Ita7wVxYmqfVLSYfKxM0oIvK3nVC+Nas34rkjBFec3TBo9G9ExjHusCLmDP6JCn6zJsYPyKee6RcUkgAGIIn17Q3aOOX67C+cmTn5F5CZUtxuNDXRYT2Gs2rnVW9JsMT0Sbl5qAEDW2ookMiDkE4botUAk5WDiNwrVyp+RJYUMYrJ6whUgNKiO3PiAoOc6UiCYHrTSwVG1pjAE3QnyE5G8swl08NyhXxUrq8xUYbuvHfJ/Az6TqgKpWCM6zTK/X+NM1kDl8nQkLU/0Hf/WXPMrHyjCUy3Vd1ePSOzJq+AnzHiDVQEaAUc9ZRXKyFUv5StMkXjk
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="utf-8"
Content-ID: <6E9804A8432FF74DBB918AFD445C3283@eurprd07.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: ericsson.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DB9PR07MB7804.eurprd07.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 1f0d0323-fc19-46aa-a967-08d946e8ee49
X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jul 2021 17:00:49.3220 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: u0UUrD50hglAzMXWfqfjPjv3WnX1LuC9c/GduEoiTJ2/NMpArQsSqpbhDLxzNZtYthQO8bvHm2TZNEvH8QxHhMqcGJDhP2sKTVWOGA9JYEw=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB7PR07MB5736
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic/ZIfUJGP2Whx40u3aUJYt05ZhWf0>
X-BeenThere: quic@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Main mailing list of the IETF QUIC working group <quic.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/quic>, <mailto:quic-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/quic/>
List-Post: <mailto:quic@ietf.org>
List-Help: <mailto:quic-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/quic>, <mailto:quic-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 14 Jul 2021 17:01:02 -0000

Hi Stephane,

I just found this older mail and didn't really see a reply, so here a quick note:

You are right that it's really hard to avoid tracking completely, just because if one flow stops sending to server but that the same time another flow starts sending with the same "speed" it likely that it is actually the same flow.

Maybe a few notes on this are in the manageability document here:

https://datatracker.ietf.org/doc/html/draft-ietf-quic-manageability-11#section-3.5

Not sure what else to say...

Mirja



On 07.06.21, 14:39, "QUIC on behalf of Stephane Bortzmeyer" <quic-bounces@ietf.org on behalf of bortzmeyer@nic.fr> wrote:

    I was thinking about the privacy risks of QUIC and there is one where
    I'm not sure what to think of it, and for which I cannot find any
    discussion in the archives of the WG.

    Long-term QUIC connections may enable some user tracking, even when
    the user changes its IP address, without even needing HTTP cookies or
    things like that.

    I am not sure it is a real problem in practice because it's not new
    (HTTP/2 offered similar possibilities), there are many other ways to
    track users (HTTP cookies, browser fingerprinting, Google Analytics),
    and they even work cross-servers. But it can be a problem for
    privacy-oriented technologies (QUIC cannot currently work over Tor but
    may be in the future?)

    I do not find discussions about that. Was it considered? (If so, you
    are welcome to reply "Search with mailarchive yourself" but I prefer
    if it comes with URLs and/or approximate datetimes.) Is it, for
    instance, a good idea to advise privacy-oriented clients to always
    shut down QUIC connections when IP address changes?

v2.36.0 | Report a Bug | By Email | System Status