Subject: [ietf-privacy] Privacy implications of reputation systems

From: Pete McCann <[email-masked]>
Date: Wed, 16 Nov 2011 04:39:12 -0500

There was discussion this afternoon during the intarea meeting
of draft-boucadair-intarea-nat-reveal-analysis-04, which examines
issues around adding host identifiers in address-sharing middleboxes.
Part of the discussion focused on privacy considerations.

It occurs to me that reputation systems (of which I think the use of
IP address blacklists is an instance) present a natural tension between
privacy and accountability.  To block abuse, we want an identifier that
can be tied to a responsible entity.  This seems to conflict with any
requirement that the user's interaction with a service not be traceable
to him/her.

Is it possible to create a reputation system that can protect the network
and services from abuse, yet provides a good amount of user privacy, even
against powerful adversaries?

-Pete

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Wed, 16 Nov 2011 15:46:16 +0100

>against powerful adversaries?

One solution in the middleware case would be to enable social control of
it; the middleware could store some meta data about the outgoing traffic
for a short while that allows it to identify endpoints upon request. If
example.com needs to know "who is this tcp connection with", the middle-
ware might reveal that, but it can also report the inquiry to the user. 

If there is a consensus that the feature can be used to identify malware
infected hosts but not for behavioral profiling, and you do the latter,
it shouldn't be long until you are found out and stopped. Note that some
use cases do not actually require identification, e.g., "block whoever
initiated this tcp connection from talking to me" can be done by the
middleware without further disclosure, but with the option to report it.

More technical solutions are a bit problematic. You might see Bitcoins
as a form of reputation, but it turns out that Bitcoins need entropy in
order to work and that entropy, the "wallet", can be stolen. So, if you
build a reputation system based on secrets, people would go after these
secrets. (Same for your e-mail account passwords, really).

Bitcoins also don't really allow others to take away your reputation,
vote you down, if you behave poorly. How many wallets for Dr Jekyll and
Mr Hyde? What if you buy your reputation using some other currency? Like
you can swap dollars for "followers" and "likes", or whitewashers. If
incoming links are reputation, you get link farms and link exchanges. If
deciphering captchas makes reputation, expect some sweatshop doing it en
masse.

I note that proving your reputation, without revealing your identity to
the entity you want to prove your reputation to, can be facilitated in a
number of ways, like mutually trusted intermediaries or zero-knowledge
protocols; but a global reputation system for abuse prevention, or some
such purpose, doesn't seem to fit too well with that. A simple solution
would be the german model: prohibit storing all bits of IPv4 addresses
without something resembling agreement to a contract, and then shrug off
the cyberattacks that cannot be prevented because of that.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Claudia Diaz <[email-masked]>
Date: Fri, 18 Nov 2011 17:50:53 +0100

For the specific problem of blacklisting you can use "blacklistable anonymous credentials", such as Nimble, Jack, Perea, Blac ... 

Some links to these papers: 
http://dl.acm.org/citation.cfm?id=1315256
http://dl.acm.org/citation.cfm?id=1866927
http://dl.acm.org/citation.cfm?id=1455813
http://www.springerlink.com/content/205x1k3l8230q082/

Also, a survey on anonymous blacklisting systems is available here:
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.186.3530&rep=rep1&type=pdf

On 16 Nov 2011, at 10:39:12, Pete McCann wrote:

> _______________________________________________
> ietf-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-privacy

--------------------------------------------------------------------------
Prof. Dr. Ir. Claudia Diaz

Katholieke Universiteit Leuven                       
Dept. Electrical Engineering-ESAT / COSIC
Kasteelpark Arenberg 10, B-3001 Leuven, BELGIUM
tel: +32 16 32 18 14	fax: +32 16 32 19 69

email: claudia.diaz (at) esat.kuleuven.be
web: http://homes.esat.kuleuven.be/~cdiaz/
--------------------------------------------------------------------------