Subject: Re: [ietf-privacy] Accurate history

From: S Moonesamy <[email-masked]>
Date: Sat, 06 Nov 2021 00:40:45 -0700

Hi Vasilenko,

I moved the thread to another mailing list.

At 12:55 AM 05-11-2021, Vasilenko Eduard wrote:
>Privacy is a myth.
>
>OTTs deliver 70% of traffic. They could correlate users by 100 
>parameters (including your browser window size).
>Just changing IID would not impact their correlation. Not at all.
>
>Your carrier has to know all your sessions for Lawful Intercept.
>
>Whom you are trying to mislead by IID changes?
>
>It just creates a heavy load on logs collection for troubleshooting, 
>forensic, and legal intercept.

The point which you made correlation is correct.

Session-level information is sometimes collected for network 
management purposes.  An external party can request access to it for 
investigating, for example, a crime [1].  I doubt that the external 
party would use information generated through correlation (using, for 
example, browser information) in their investigation.

IIDs, as designed, did not address privacy concerns.  It could be 
because the assumptions were incorrect.

As a response to your comment about privacy, I noticed that some 
participants changed their identification information over the last 
few years.  It may have been influenced about concerns about privacy.

Are you trying to say that the IETF participants' expectation of 
privacy does not match reality?

Regards,
S. Moonesamy

1. It depends on the jurisdiction.

---

From: Vasilenko Eduard <[email-masked]>
Date: Sun, 7 Nov 2021 10:22:09 +0000

Hi S. Moonesamy,
The context was about IPv6 addressing only, not the privacy on the general scope.
The second half of IPv6 address bits (64 from 128) are used only for privacy now. RFC 8981.
IPv6 is 64-bit addressing architecture because of this, not 128 as many believe.
The host generates different pseudo-random IIDs (64-bits) and uses them to create many temporary addresses for different sessions.
Keith Moore mentioned that it is privacy. Hence, the good wastage of (2^64-1)/2^64 of IPv6 address space.
I was arguing that it is fake privacy. Hence, not a justification to waste so huge address space.
Eduard
-----Original Message-----
From: S Moonesamy [mailto:[email-masked]] 
Sent: Saturday, November 6, 2021 10:41 AM
To: Vasilenko Eduard <[email-masked]>; [email-masked]
Subject: RE: Accurate history

Hi Vasilenko,

Session-level information is sometimes collected for network management purposes.  An external party can request access to it for investigating, for example, a crime [1].  I doubt that the external party would use information generated through correlation (using, for example, browser information) in their investigation.

IIDs, as designed, did not address privacy concerns.  It could be because the assumptions were incorrect.

As a response to your comment about privacy, I noticed that some participants changed their identification information over the last few years.  It may have been influenced about concerns about privacy.

Are you trying to say that the IETF participants' expectation of privacy does not match reality?

Regards,
S. Moonesamy

---

From: S Moonesamy <[email-masked]>
Date: Sun, 07 Nov 2021 22:19:47 -0800

Hi Vasilenko,
At 02:22 AM 07-11-2021, Vasilenko Eduard wrote:
>The host generates different pseudo-random IIDs (64-bits) and uses 
>them to create many temporary addresses for different sessions.

Thanks for the clarification about the privacy comment.

The address size of IPv6 is described as 128 bits in RFC 2460.  I 
suggest looking at "wastage" [1] from an address allocation 
perspective [2] instead of an address space perspective.  That might 
make discussion of other issues, e.g. privacy, less difficult.

Regards,
S. Moonesamy

1. There were probably some assumptions which made sense when the 
protocol was designed.
2. The allocation of addresses has an impact on privacy.

---

From: Vasilenko Eduard <[email-masked]>
Date: Mon, 8 Nov 2021 08:08:34 +0000

> The address size of IPv6 is described as 128 bits in RFC 2460. 

If somebody would call "white" as "black" (or opposite) - the color would not change in reality.
IPv6 addressing is a little bit more than 64bits.
The rest is used now only for privacy.

Ed/
-----Original Message-----
From: S Moonesamy [mailto:[email-masked]] 
Sent: Monday, November 8, 2021 9:20 AM
To: Vasilenko Eduard <[email-masked]>; [email-masked]
Subject: RE: Accurate history

Hi Vasilenko,
At 02:22 AM 07-11-2021, Vasilenko Eduard wrote:
>The host generates different pseudo-random IIDs (64-bits) and uses them 
>to create many temporary addresses for different sessions.

The address size of IPv6 is described as 128 bits in RFC 2460.  I suggest looking at "wastage" [1] from an address allocation perspective [2] instead of an address space perspective.  That might make discussion of other issues, e.g. privacy, less difficult.

Regards,
S. Moonesamy

1. There were probably some assumptions which made sense when the protocol was designed.
2. The allocation of addresses has an impact on privacy.