Subject: RE: Notes about identifier - locator separator

From: "Tony Li" <[email-masked]>
Date: Fri, 8 Nov 2002 13:55:33 -0800

I know less about security than Ran, but wouldn't having
a number of pseudonyms help avoid the privacy issue?

I'd have no problems with a host that migrated its identifier
along a (one time pad) list of identifiers.  I would also
have no problem with a site border router that played mapping
games with the identifier.  But I know that some people will
then scream "NAT" and run away...

I don't see how you can not keep the locator visible to
the network elements, however.  ;-)

Tony

|   On Friday, Nov 8, 2002, at 12:37 America/Montreal, 
|   Christian Huitema 
|   wrote:
|   > There are a couple of issues with any proposal of that 
|   nature, and the
|   > main one is privacy. Having a unique identifier exposed 
|   to the network
|   > means that anybody on the path can track the presence and 
|   location of
|   > users, with consequence ranging from annoying (e.g. variations of
|   > telemarketing) to downright dramatic (e.g. missile 
|   auto-aining to a 
|   > cell
|   > phone).
|   
|   They can be tracked *anyway* using traffic analysis.  And the silly
|   Privacy stateless autoconfig thing currently specified does NOT
|   prevent user tracking either -- that spec does solve the marketing
|   problem about privacy, but only for people who don't understand how
|   real commercial user tracking happens at many web sites 
|   (particularly
|   sites that don't use cookies and rely on existing commercial traffic
|   analysis tools) today.
|   
|   Ran
|   
|   
|

---

From: Michael Richardson <[email-masked]>
Date: Fri, 08 Nov 2002 17:35:41 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Tony" == Tony Li <[email-masked]> writes:
    Tony> I know less about security than Ran, but wouldn't having a number
    Tony> of pseudonyms help avoid the privacy issue?

  Ran's point is that nobody is depending upon the IP addresses 
(whether they are locators or end-point identifiers) to do tracking.

  Hiding the IP address, or even changing it for every transaction doesn't
help.

  First, many sites do use cookies, and many web browsers are complicit
in this.
  Second, HTTP provides the Referrer:, which is very useful.

  Finally, as Ran says, there are lots of tools that just figure it out
anyway, probably based upon timing, and looking at probably content.

  However - I think that in most cases, this requires the help of one
end point.  There is still some value in keeping the locator unknown
to intermediate network elements. I don't make this a very high concern.

  Those who want privacy have multiple ways of getting it. All come at
a cost, but for many it is worth it.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [