Re: [urn] Stephen Farrell's Abstain on draft-ietf-urnbis-rfc2141bis-urn-21: (with COMMENT)

[Peter Saint-Andre <[e-mail]>]

On 2/28/17 5:37 PM, Stephen Farrell wrote:

> - Section 8 should I think recognise the dangers inherent
> in long-term stable identifiers helping with
> (re-)identification of people and/or network entities.

Perhaps you could clarify what some of your concerns are here, above and
beyond the use of URIs in general (after all, a URN is a URI). Reading
between the lines, I imagine you might be worried that URNs within a
particular URN namespace (e.g., for U.S. Social Security Numbers or the
like) - once suitably resolved into one or more URLs - might enable an
attacker to determine a person's physical location (e.g., via IP
address) or actual identity (e.g., a pseudonym could "resolve" to a real
name). Are these guesses on the mark?

> While that is not the "fault" of URNs, I'd say it is worth
> warning folks who may just possibly think twice before
> creating new URNs with those failings. (Though I recognise
> that that may call for a reference to RFC6919;-)

I'm sure you meant RFC 6920. :-)

Peter