Re: [Spud] [Privsec-program] Detecting and Defeating TCP/IP Hypercookie Attacks

[Stephen Farrell <[e-mail]>]

Hiya,

On 31/07/16 17:04, Eliot Lear wrote:
> Hi,
> 
> 
> On 7/31/16 4:05 PM, Stephen Farrell wrote:
> 
>> - I am unconvinced that "giving up" some privacy in the manner
>>   envisaged will lead to an overall privacy benefit. I very much
>>   fear that opposite - that any extensible mechanism will give up
>>   so much privacy so as to render much higher layer confidentiality
>>   moot.
> 
> This is the problem with this discussion.  You fear giving up privacy. 
> There is no protocol to assuage your fears.  Mirja has said that they
> didn't want to propose a protocol, presumably out of appearing to
> present a fait accomplit, and round and round we go.  I propose the
> following:
> 
> Someone show bits, and then let's see if your concerns are borne out or
> assuaged.  This argument is too abstract.

Well yes and no. Yes, I can't see how to assuage the fears of
those with privacy concerns without at least a straw-man. So
the proponent's choice to not provide even that does make the
discussion more abstract and less likely to conclude.

But no, the proponents of the PLUS BoF suggested a charter
that explicitly stated that the solution needed an IANA registry
for extensibility and even specified an update rule for that
putative registry.

I am wholly convinced such a registry with any set of 5226
rules is an error and bad to very bad for privacy. See all the
times I've said "over 18" and similar. I don't think I need to
know more about the on the wire framing of those codepoints
(official or squatted-upon) to reach my conclusion.

Whether a protocol without any extensibility or with some other
extensibility mechanism would be ok or not is not something
about which I've expressed an opinion so far. (Well, at least
I've tried to be neutral, but I fully admit that sometimes what
I try write as neutral, folks read as opinionated;-)

Cheers,
S.


> 
> Eliot
> 
> 
> 
> 
> _______________________________________________
> Privsec-program mailing list
> [e-mail]
> https://www.iab.org/mailman/listinfo/privsec-program
>