Subject: RE: [eap] comments on draft-groeting-eap-netselection-results-00. txt

From: Tschofenig Hannes <[email-masked]>
Date: Tue, 20 Jul 2004 17:30:28 +0200

hi jari, 

thanks for your quick response. 
a short response to your privacy related comment.

~snip~  

>  > 2.2.5  Privacy Policy
> 
> This is interesting, though maybe not so critical. The 
> location of the user will be roughly known by his IP address 
> in any case. And I suspect that there are legal interception 
> & goverment regulations that dictate that the networks have 
> to hand over any information in any case, if requested. So it 
> isn't clear to me what value an advertisement of a privacy policy has.

privacy is a complex subject, as you know. there are different places
(access network, intermediate networks, end hosts, home network, etc.) and
different layers (network layer, link layer, application layer) where
information is leaking, which can harm the user's privacy. hence, this
simple extension cannot solve all privacy problems. 

things start to be problematic if a users long term identifier (such as a
NAI) can be associated with his location. the visited network might have
access to such a long term identifier. 

to be more specific, i had the work done with radius and geopriv in mind
when i wrote this text. see
http://www.ietf.org/internet-drafts/draft-tschofenig-geopriv-radius-lo-00.tx
t

i don't agree with you when it comes to issues of 'if i know your ip address
then i know your location'. the work in the geopriv working group showed
that there are much more issues to think about. 

it is true that there are legal inception and govermental regulations that
need to be considered. today, if you use a wireless lan hotspot then users
typically experience a high degree of privacy. this might change in the near
future but we should try to preserve the users privacy as far as possible.
if a network has to perform legal interception then it could indicate this
fact. 

ciao
hannes
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: "Bari, Farooq" <[email-masked]>
Date: Wed, 21 Jul 2004 14:45:11 -0700

Hi Hannes, Wolfgang et al,

This is an interesting draft. I had a somewhat different use model than
what your draft seems to imply. Here is what my use case scenario looks
like

1)       User selects the serving network based on roaming agreements

2)       The serving network authenticating the user (i.e. its AAA
proxy/server), as part of AAA message flows informs the home network
(i.e. subscriber's home AAA server) about the serving network
capabilities (and maybe other information e.g. hotspot location).

3)       Based on the information provided by the serving network in AAA
messages to the home network, the home network authenticates the user
and then authorizes him for certain home services that can work on the
serving network (e.g. VoIP, streaming etc.) that the user has subscribed
to. The home network can do a bunch of other things (e.g. intelligent
billing) as well with this extra bit of information from the serving
network's AAA proxy/server.

In other words, the communication of this type of information is between
serving and home network AAA entities after the serving network has been
selected by the Wireless Client. We do have a couple of drafts in RADEXT
which deal with bandwidth and location attributes. I believe they will
be able to solve the use case scenario I described where the
communication is between RADIUS/DIAMETER entities and Wireless Client is
not involved in them (i.e. no EAP communication although it will be part
of AAA message flows). BTW thanks for the implementation of the draft.
We will have any errors identified corrected in the next version.

BR,

Farooq