Re: [Spud] Thoughts on the privacy concerns expressed at the BoF

[Kyle Rose <[e-mail]>]

(Forgot to respond to all.)

On Mon, Jul 25, 2016 at 12:18 PM, Ted Hardie <[e-mail]> wrote:

> Again, as Brian pointed out, we are not talking about field lengths here
> that could serve this identifying function by themselves  we are talking
> about field lengths sufficient for expressing a small number of signals to
> the path.
>

I think part of my hesitation results from my inability to think of any way
to express this in a meaningful way in the charter. The draft charter says:

q( Endpoint verification of signaling integrity, careful design of minimal
data structures, and restrictive policies for registration of signals can
help to meet this goal. )

and refers to Mirja's use cases document, but provides no explicit guidance
around what "minimal" means in an absolute sense, not with respect to an
individual use case . And I'm not sure it can or should get any more
specific (it is a charter, after all, not a technical draft or protocol
proposal), which leads to a dilemma: by not being more explicitly limiting
about total information per packet, are we setting ourselves up for a
situation in which the WG subordinates privacy to other goals and produces
and successfully deploys something too expressive, some time after which
users and governments end up in a game of chicken (idiom: driving two cars
toward each other at high speed, with the first driver to veer off the
loser) when some government bets that access to content is worth more than
the end-to-end integrity protection mandated by PLUS, leading it to
hijacking a valid PLUS field without endpoint cooperation, essentially
telling users "If you want access, you need to turn off integrity
protection"? Seems far-fetched now, but it takes only a critical mass of
impairment before users are required to comply just to interoperate: it
doesn't even have to result from laws in one's own country.

Pretty sure this shouldn't be addressed in the charter as a specific number
of bits, but I think you'd resolve a lot of fears of abuse by somehow
constraining the field space and the number of fields per-packet. (The
amount of data implied by "In-Band Measurement" jumped out at me as
problematic, for example.) And yeah, I get that this directly implies
additional potential for ossification. There are a huge number of tradeoffs
here, and there's no way to know we've made the right ones until long after
the decision has been made, but can we look at the proposed use cases and
decide which need to coexist in a single packet, and which maybe expose too
much space?

The other side of this (what can PLUS do *for* privacy?) I'll address in my
response to Mirja.

Kyle