Re: [Spud] Whats missing in SPUD (was: Re: Multipath/Mobility (was Questions based on draft-trammell-spud-req-00))

[Toerless Eckert <[e-mail]>]

Well, biostats/signature/photo  constitute elements to establish ownership
of the ID card. And there may be county/city police regulations to keep
track of full ID scans. And if not police then insurance or on advice
of the bars lawyer in case of lawsuits/challenges. Aka: IMHO much more likely
caused by third party directives then lets say the customer data collection
done by eg: web/social-networking sites.

But lets agree that the ID card in its current form is not ideal to
exemplify "know what attributes you need to show for the desired benefits
and then only show those attributes".

So the right example would have been some form of ID card with keypad,
i type in what attributes i want to send, it creates a new short lived cert
and NFC's those attributes to the gatekeeper. Whether its Photo + (Age > 17) or anything else.

On Mon, Aug 10, 2015 at 04:32:37PM -0400, Daniel Kahn Gillmor wrote:
> On Mon 2015-08-10 14:44:44 -0400, Toerless Eckert wrote:
> > "Here is your new ID card".
> > "Why would i want to have an ID card, everybody who checks ID cards is evil"
> > "You do not have to show your ID card if you don't want to"
> > "Lets go to the bar"
> > "ID card please"
> > "Booze or anonymity... that's the question"
> > "Lets choose booze"
> 
> Have you ever tried to go to a bar where they require you to scan your
> full ID into their targeted advertising database in order to step inside
> for a pint with a friend? [0] They say they're asking this information
> for the purpose of avoiding alcohol service to underage people.
> 
> The full ID scan (at least where i live) contains legal name, home
> address, biostats (height, weight, hair, eye color), date of birth,
> license number, physical impairments, etc.  The bar says "we need to
> know whether you can legally drink" (a boolean value) and instead
> collects a timestamped, identity-mapped, rich-characteristic profile of
> every individual who enters the establishment.
> 
> You're right, of course, that most people in such a situation will
> choose booze over their own privacy.  i won't go into the number of
> reasons that people feel compelled to make this choice unless i get a
> signal from the chairs that this kind of behavioral analysis is on-topic
> for the list.
> 
> But the fact that many people are willing to make this tradeoff is not a
> legitimate excuse to design a system that encourages the tradeoff to be
> made this way.
> 
> That exchange is fundamentally a bad deal for the user, even if we
> accept as a given that a bar needs an automated mechanism that allows it
> to distinguish legal drinkers from underage drinkers. Users shouldn't be
> forced into trading off privacy for network access any more than they
> should be forced into trading off privacy for security [1], and we
> shouldn't design mechanisms to encourage this false trade.
> 
> > So, whats missing in SPUD (or any prior endpoint<->network) signaling
> > is the signaling element "If you do not show ID card, you will not get
> > booze" or "if you do not use a cross-subflow Tube-ID, your
> > load-sharing, mobility or multipath performance will suck or not
> > work".
> 
> This is *exactly* what i'm concerned about with SPUD.  Full user
> identification is overkill for detection of who is allowed to drink (or
> who is allowed to use the global network); it is a disaster for user
> privacy, and a total bonanza for a would-be pervasive monitor.
> 
> We're suposed to be pushing back on that kind of thing, right?
> 
>   https://tools.ietf.org/html/rfc7258
>   https://tools.ietf.org/html/rfc6973
> 
> Formalizing this practice would put any network operator in the position
> of the overzealous bar-operator/marketer: "give me your ID card via SPUD
> to be able to send or receive traffic", not to mention criminals looking
> for a home address to burgle based on who's out at the local cafe,
> nation-states looking to repress their own citizenry, or spy agencies
> fetishizing the need to "collect it all".
> 
> > Using the same Tube-ID is just one example. This interaction really
> > applies to any possible signaling element: The anonymity freak will
> > argue to his death that he doesn't want to provide information to the
> > network... unless the network can persuade him that the benefit of
> > showing outweights the loss of anonymity.
> 
> We should not be designing protocols that encourage users to give up any
> amount of anonymity to the network without compelling engineering
> argument (and evidence!) that the anonymity they give up is necessary to
> the effective operation of the network.
> 
> Otherwise, we're building a network that is designed to encourage its
> users to accept this fundamentally bad deal in a place that is today far
> more critical to civic interaction than a bar.
> 
> I will accept the label of "anonymity freak" if it means i am concerned
> about the social impact of a thoroughly-surveilled society.
> 
> Thanks for the good example.
> 
> Regards,
> 
>     --dkg
> 
> [0] fwiw, i have been to a bar that has this requirement.  I have not
>     returned to that bar.
> 
> [1] https://www.schneier.com/blog/archives/2008/01/security_vs_pri.html