Subject: [dhcwg] Anonymity profile

From: "Christian Huitema" <[email-masked]>
Date: Sun, 22 Feb 2015 17:15:19 -0800

Friday, I submitted a draft describing an “anonymity profile” for DHCP and
DHCPv6:

http://datatracker.ietf.org/doc/draft-huitema-dhc-anonymity-profile/

Abstract:

   Some DHCP options carry unique identifiers.  These identifiers can
   enable device tracking even if the device administrator takes care of
   randomizing other potential identifications like link-layer addresses
   or IPv6 addresses.  The anonymity profile is designed for clients
   that wish to remain anonymous to the visited network.  The profile
   provides guidelines on the composition of DHCP or DHCPv6 requests,
   designed to minimize disclosure of identifying information.

This follows discussions that we had in Honolulu about the need to make sure
that devices that use MAC Address Randomization cannot be tracked through
unique identifiers leaked by DHCP. 

-- Christian Huitema

---

From: Michael Richardson <[email-masked]>
Date: Mon, 23 Feb 2015 16:16:04 -0500

> http://datatracker.ietf.org/doc/draft-huitema-dhc-anonymity-profile/

Re:
http://www.cbc.ca/news/politics/csec-used-airport-wi-fi-to-track-canadian-travellers-edward-snowden-documents-1.2517881

I followed some of this story, and my understanding is that CSEC didn't
actually have the ability to collect MAC addresses and DHCP data.  My
understanding is that they actually just watched http:// connections to
facebook.com, and collected the cookie info from there.

On my office network, one Android phone has MAC randomization turned on.
The result is that it gets a new address every few minutes, and our
monitoring tools that keep track of machines coming and going go bonkers.
They become unuseable to us, which means that our ability to keep our network
secure becomes difficult.

I'd really like to have hardware MAC "randomization" that is deterministic
based upon ESSID.  Then generate the DHCP DUID from that.
I think that it's really better for everyone if one uses the same MAC address
each time one visits the same place.  It's true that this lets the owner of
that network determine that they have the same person back again each time.

Doing this by MAC address is certainly a lot better than having them
intercept HTTP connections (or as Lenovo is doing, intercept HTTPS...).
Having the same MAC address also means that I might get to skip the silly
captive portal.

Of course, I could have an application which changes my "personality", so
that I'd use different inputs to the deterministic MAC permutation algorithm,
and assume a different persona.  Or, my ten friends and I could rotate among
a set of 4 addresses to mess up traffic analysis. (Like the way some people
have a loyalty card that a group uses at the grocery store, but only ever buy
apple juice with)

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Christian Huitema <[email-masked]>
Date: Mon, 23 Feb 2015 21:41:46 +0000

> They become unuseable to us, which means that our ability to keep our
> network secure becomes difficult.

A new address every few minutes I probably a lot too aggressive. There are lots of undesirable side effects. For example, if you are at a hot spot that uses the "captive portal" approach, changing MAC address brings you back to the captive portal, and that's really a pain for the user. Also, changing MAC address pretty much forces you to change IP address. If you are behind a NAT, that means having to renegotiate all the NAT traversal mappings.

> based upon ESSID.  Then generate the DHCP DUID from that.

Correct. You want at a minimum to keep the same MAC between the time you connect to the Wi-Fi network and the time you disconnect.

> each time one visits the same place.  It's true that this lets the owner of that
> network determine that they have the same person back again each time.

That's a tradeoff, between stability and privacy. The stable privacy addresses draft covers some of the same issues. 

I wonder how much of the MAC address randomization strategy should be included in the DHCP anonymity draft. Your feedback leads me to "more than we have now..."

-- Christian Huitema