Re: [v6ops] Google Alert - IPv6

[Tom Herbert <[e-mail]>]

On Tue, Oct 31, 2017 at 6:42 PM, Mark Smith <[e-mail]> wrote:
>
>
> On 31 Oct. 2017 01:48, "Tom Herbert" <[e-mail]> wrote:
>
> On Mon, Oct 30, 2017 at 2:03 AM, Ole Troan <[e-mail]> wrote:
>> Hi Dave,
>>
>>>> Major comment:
>>>> 3) The document talks about identifying an individual, and in places a
>>>> subscriber endpoint. What it does identify, is the _originating network_.
>>>> What you get is the public interface address of the customer CPE. Which
>>>> looks like a network from the inside.
>>>> Make it very clear that this does not identify individual hosts. And it
>>>> might be worth noting that traffic my enter the originating network from
>>>> outside. E.g. through VPNs, TOR exits, shared WIFI and whatnot.
>>>>
>>>
>>> Yes, I completely agree.
>>>
>>> I do address this point in the -01 revision scope section:
>>>
>>> "Clearly no single solution will address the problem of crime attribution
>>> on the Internet.  Load balancers, proxies and other network infrastructure
>>> may also, intentionally or as a side-effect, obfuscate the true source of
>>> Internet traffic and these problems will continue to exist with or without
>>> the presence of large-scale address sharing technologies (like Carrier-Grade
>>> NAT and A+P).”
>>>
>>> I wanted to mention the point without getting dragged into details of all
>>> of the possible scenarios where an IP address does not represent an
>>> individual or subscriber endpoint (apart from CGNAT). I was of the opinion
>>> that there is a risk of trying to “boil the ocean” with a  document like
>>> this so I was trying to keep the focus as tightly as possible on the issues
>>> raised by CGNAT.
>>>
>>> In light of this, do you think this needs to be more explicitly discussed
>>> or clarified?
>>
>> I think that's fine.
>> As long as you make it clear that:
>>  - the IP address _never_ identifies an individual.
>
> Ole,
>
> I don't think this is something that can be part of the definition of
> an IP address, it's more of a desirable property of how IP addresses
> are assigned and used. For instance, a smartphone is given an IP
> address and technically identifies the host. But given that there is a
> likely one to one correspondence between personal device (and its
> address) to an individual user, the IP address of the device
> effectively identifies the individual or at least can be used with a
> little more information to do so. In this case, the IP address seems
> to be Personally Identifiable Information.
>
>
>
> The trouble is, unless we hand-cuff devices to people, the binding between a
> device and an individual isn't very strong. It is quite easy for a device to
> be shared, intentionally or not, with more portable (and therefore
> stealable,) devices making the coupling even weaker.
>
> I think attribution of an action is an authentication problem. Machine
> identifiers aren't very good analogues for individuals' identify and
> authenticity. In the "what you have, what you are, and what you know" group
> of authentication factors, I think the "what you have" is the weakest.
>
Mark,

I think the point is that for privacy we _don't_ want IP addresses to
identify individuals, but it is work to ensure that they don't. The
fact that a device can be shared makes the coupling weaker, but
probably not weak enough to be considered good privacy unless the
population sharing the device is large enough to avoid statistical
inference.

> There really needs to be something else that supports or proves use of a
> device other than an assumption that an IP address is tightly coupled to a
> device's owner, and therefore all actions associated with an IP address are
> thoe se of the device's owner.

I believe there is. It is common for apps, like email, social
networking, etc. to login to a service with username and password.
When login is done, the service now has a mapping of an individual to
an IP address. That mapping could then be exploited to identify the
same individual in completely unrelated communications, hence breaking
privacy. This could be done external to the device and the network
provider and across different jurisdictions. The problem is
exacerbated if the app is always connected so that whenever the
devices gets a new IP address to user mapping maintained by some third
party is kept up to date. Also, in this case, randomizing addresses at
some frequency may no provide much benefit to privacy unless every
connection gets a different source address (which is effectively is
what CGNAT gives).

Tom