Subject: [Geopriv] Question on client identifier in HELD (re: HELD guidance for IP address ID)

From: [email-masked]
Date: Fri, 9 Nov 2007 16:00:41 -0500

Hi all,

All this chatter about IP address as device identifier made me go back and 
look again at how this identifier is described in HELD itself.  I was 
surprised to notice that HELD itself 
(draft-ietf-geopriv-http-location-delivery-02) does not appear to spec a 
device identifier internal to the encoding schema at all.  It appears to 
be the intent to use the source address of the message as it arrives at 
the LIS to derive source IP address of the sender (or their out-most 
external facing NAT really).  I also see that a format for encoding device 
identifier is described as an extension 
(draft-winterbottom-geopriv-held-identity-extensions-03).  Did I miss 
something??

This seems a bit odd to me, and that's probably why I never noticed -- 
just assumed it had to be there somewhere.  I am curious about the 
reasoning to not include device identifier in the base protocol.  Just 
weight reduction, given that not all applications would use it?  I'm 
probably fine either way, just interested to know. 

BTW, Since the device may have little-to-no idea about its IP address as 
visible to the outside world (it is generally behind one or more NATs), I 
don't think this question plays into that other debate at all. 

-- Peter
_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: "Mary Barnes" <[email-masked]>
Date: Fri, 16 Nov 2007 10:12:29 -0600

Hi Peter,
 
This wasn't something that was simplified out of the original HELD
proposal - i.e, using the source IP address as the device ID was the
premise of the original proposal.   Feedback I got from James (he and
others will jump in if I've gotten this wrong) is that the source IP
address is sufficient for many applications. 
 
Mary. 

________________________________

From: [email-masked] [mailto:[email-masked]] 
Sent: Friday, November 09, 2007 3:01 PM
To: Geopriv
Subject: [Geopriv] Question on client identifier in HELD (re: HELD
guidance for IP address ID)

Hi all, 

All this chatter about IP address as device identifier made me go back
and look again at how this identifier is described in HELD itself.  I
was surprised to notice that HELD itself
(draft-ietf-geopriv-http-location-delivery-02) does not appear to spec a
device identifier internal to the encoding schema at all.  It appears to
be the intent to use the source address of the message as it arrives at
the LIS to derive source IP address of the sender (or their out-most
external facing NAT really).  I also see that a format for encoding
device identifier is described as an extension
(draft-winterbottom-geopriv-held-identity-extensions-03).  Did I miss
something?? 

BTW, Since the device may have little-to-no idea about its IP address as
visible to the outside world (it is generally behind one or more NATs),
I don't think this question plays into that other debate at all. 

-- Peter

---

From: "Brian Rosen" <[email-masked]>
Date: Fri, 16 Nov 2007 11:22:16 -0500

I had the same reaction, but the only thing I think we should change is to
add some text that makes it more clear that the protocol is intended to be
extended for other identifiers, and while IP address is a suitable
identifier for many networks, it may not work well in others.  Perhaps this
could be tied to the text we are discussing that describes the issues with
using IP address as the identifier.

I have no problem with other identifiers being covered in an extension
document, and do not want to hold up HELD to get other text in it that
covers other identifiers.

Brian

________________________________________
From: Mary Barnes [mailto:[email-masked]] 
Sent: Friday, November 16, 2007 11:12 AM
To: [email-masked]; Geopriv
Subject: RE: [Geopriv] Question on client identifier in HELD (re:
HELDguidance for IP address ID)

Hi Peter,
 
This wasn't something that was simplified out of the original HELD proposal
- i.e, using the source IP address as the device ID was the premise of the
original proposal.   Feedback I got from James (he and others will jump in
if I've gotten this wrong) is that the source IP address is sufficient for
many applications. 
 
Mary. 
________________________________________
From: [email-masked] [mailto:[email-masked]] 
Sent: Friday, November 09, 2007 3:01 PM
To: Geopriv
Subject: [Geopriv] Question on client identifier in HELD (re: HELD guidance
for IP address ID)

Hi all, 

All this chatter about IP address as device identifier made me go back and
look again at how this identifier is described in HELD itself.  I was
surprised to notice that HELD itself
(draft-ietf-geopriv-http-location-delivery-02) does not appear to spec a
device identifier internal to the encoding schema at all.  It appears to be
the intent to use the source address of the message as it arrives at the LIS
to derive source IP address of the sender (or their out-most external facing
NAT really).  I also see that a format for encoding device identifier is
described as an extension
(draft-winterbottom-geopriv-held-identity-extensions-03).  Did I miss
something?? 

This seems a bit odd to me, and that's probably why I never noticed -- just
assumed it had to be there somewhere.  I am curious about the reasoning to
not include device identifier in the base protocol.  Just weight reduction,
given that not all applications would use it?  I'm probably fine either way,
just interested to know.   

-- Peter

---

From: "Marc Linsner" <[email-masked]>
Date: Fri, 16 Nov 2007 11:32:58 -0500

Brian,

I would suggest to leave words around additional identifiers for future
documents due to the security aspects.  If you are going to mention it, then
you should cover the security aspects, which I envision will be a looooong
debate.

Remember the task at hand is LCP.

-Marc-

> 
> I had the same reaction, but the only thing I think we should 
> change is to add some text that makes it more clear that the 
> protocol is intended to be extended for other identifiers, 
> and while IP address is a suitable identifier for many 
> networks, it may not work well in others.  Perhaps this could 
> be tied to the text we are discussing that describes the 
> issues with using IP address as the identifier.
> 
> I have no problem with other identifiers being covered in an 
> extension document, and do not want to hold up HELD to get 
> other text in it that covers other identifiers.
> 
> Brian
> 
> - i.e, using the source IP address as the device ID was the 
> premise of the original proposal.   Feedback I got from James 
> (he and others will jump in if I've gotten this wrong) is 
> that the source IP address is sufficient for many applications. 
>  
> Mary. 
> Subject: [Geopriv] Question on client identifier in HELD (re: 
> HELD guidance for IP address ID)
> 
> Hi all, 
> 
> All this chatter about IP address as device identifier made 
> me go back and look again at how this identifier is described 
> in HELD itself.  I was surprised to notice that HELD itself
> (draft-ietf-geopriv-http-location-delivery-02) does not 
> appear to spec a device identifier internal to the encoding 
> schema at all.  It appears to be the intent to use the source 
> address of the message as it arrives at the LIS to derive 
> source IP address of the sender (or their out-most external 
> facing NAT really).  I also see that a format for encoding 
> (draft-winterbottom-geopriv-held-identity-extensions-03).  
> Did I miss something?? 
> 
> This seems a bit odd to me, and that's probably why I never 
> noticed -- just assumed it had to be there somewhere.  I am 
> curious about the reasoning to not include device identifier 
> in the base protocol.  Just weight reduction, given that not 
> all applications would use it?  I'm probably fine either way, 
> just interested to know.   
> 
> BTW, Since the device may have little-to-no idea about its IP 
> address as visible to the outside world (it is generally 
> behind one or more NATs), I don't think this question plays 
> into that other debate at all. 
> 
> -- Peter 
> 
> 
>

---

From: "Mary Barnes" <[email-masked]>
Date: Fri, 16 Nov 2007 10:30:53 -0600

Yes, Martin T. has suggested that we add an informational reference to the identity extensions draft.  That will fit in nicely with the text we are adding to discuss the use of IP address as identifier. I'll shortly post an update to the overall text proposal that also addresses a couple of the points made recently by Martin D.

Mary.  

-----Original Message-----
From: Brian Rosen [mailto:[email-masked]] 
Sent: Friday, November 16, 2007 10:22 AM
To: Barnes, Mary (RICH2:AR00); [email-masked]; 'Geopriv'
Subject: RE: [Geopriv] Question on client identifier in HELD (re: HELDguidance for IP address ID)

I had the same reaction, but the only thing I think we should change is to add some text that makes it more clear that the protocol is intended to be extended for other identifiers, and while IP address is a suitable identifier for many networks, it may not work well in others.  Perhaps this could be tied to the text we are discussing that describes the issues with using IP address as the identifier.

I have no problem with other identifiers being covered in an extension document, and do not want to hold up HELD to get other text in it that covers other identifiers.

Brian

Hi Peter,
 
This wasn't something that was simplified out of the original HELD proposal
- i.e, using the source IP address as the device ID was the premise of the original proposal.   Feedback I got from James (he and others will jump in if I've gotten this wrong) is that the source IP address is sufficient for many applications. 
 
Mary. 
________________________________________
From: [email-masked] [mailto:[email-masked]]
Sent: Friday, November 09, 2007 3:01 PM
To: Geopriv
Subject: [Geopriv] Question on client identifier in HELD (re: HELD guidance for IP address ID)

Hi all, 

All this chatter about IP address as device identifier made me go back and look again at how this identifier is described in HELD itself.  I was surprised to notice that HELD itself
(draft-ietf-geopriv-http-location-delivery-02) does not appear to spec a device identifier internal to the encoding schema at all.  It appears to be the intent to use the source address of the message as it arrives at the LIS to derive source IP address of the sender (or their out-most external facing NAT really).  I also see that a format for encoding device identifier is described as an extension (draft-winterbottom-geopriv-held-identity-extensions-03).  Did I miss something?? 

This seems a bit odd to me, and that's probably why I never noticed -- just assumed it had to be there somewhere.  I am curious about the reasoning to not include device identifier in the base protocol.  Just weight reduction, given that not all applications would use it?  I'm probably fine either way, just interested to know.   

BTW, Since the device may have little-to-no idea about its IP address as visible to the outside world (it is generally behind one or more NATs), I don't think this question plays into that other debate at all. 

-- Peter

---

From: "Brian Rosen" <[email-masked]>
Date: Fri, 16 Nov 2007 12:03:25 -0500

I think Mary's latest is okay.

I'm not sure what the additional security issues are: were you referring to
the fact that the IP address comes automatically and another identifier
would have to be added by a client?  I think that such issues could be left
to the extension document.

LCP is "give me my location".  If "my" is determined by some ID other than
an IP address, it's still an LCP.

Brian

> From: Marc Linsner [mailto:[email-masked]]
> Sent: Friday, November 16, 2007 11:33 AM
> To: 'Brian Rosen'; 'Geopriv'
> Subject: RE: [Geopriv] Question on client identifier in HELD
> (re:HELDguidance for IP address ID)
> 
> Brian,
>

---

From: "Marc Linsner" <[email-masked]>
Date: Fri, 16 Nov 2007 12:10:39 -0500

Brian,

> I'm not sure what the additional security issues are: were 
> you referring to the fact that the IP address comes 
> automatically and another identifier would have to be added 
> by a client?  I think that such issues could be left to the 
> extension document.
> 
> LCP is "give me my location".  If "my" is determined by some 
> ID other than an IP address, it's still an LCP.

It's now an LCP that can be spoofed by someone other than "my".  Large
security/privacy issues.

The identity extensions draft Mary mentioned in not a wg item, you want to
reference it?

More discussion required.

-Marc-

> > I would suggest to leave words around additional identifiers for 
> > future documents due to the security aspects.  If you are going to 
> > mention it, then you should cover the security aspects, which I 
> > envision will be a looooong debate.
> > 
> > > I had the same reaction, but the only thing I think we 
> should change 
> > > is to add some text that makes it more clear that the protocol is 
> > > intended to be extended for other identifiers, and while 
> IP address 
> > > is a suitable identifier for many networks, it may not 
> work well in 
> > > others.  Perhaps this could be tied to the text we are discussing 
> > > that describes the issues with using IP address as the identifier.
> > >
> > > extension document, and do not want to hold up HELD to get other 
> > > text in it that covers other identifiers.
> > >
> > > Brian
> > >
> > > proposal
> > > - i.e, using the source IP address as the device ID was 
> the premise 
> > > of the original proposal.   Feedback I got from James (he 
> and others 
> > > will jump in if I've gotten this wrong) is that the source IP 
> > > All this chatter about IP address as device identifier made me go 
> > > back and look again at how this identifier is described in HELD 
> > > itself.  I was surprised to notice that HELD itself
> > > (draft-ietf-geopriv-http-location-delivery-02) does not appear to 
> > > spec a device identifier internal to the encoding schema 
> at all.  It 
> > > appears to be the intent to use the source address of the 
> message as 
> > > it arrives at the LIS to derive source IP address of the 
> sender (or 
> > > their out-most external facing NAT really).  I also see that a 
> > > format for encoding device identifier is described as an 
> extension 
> > > This seems a bit odd to me, and that's probably why I 
> never noticed 
> > > -- just assumed it had to be there somewhere.  I am curious about 
> > > the reasoning to not include device identifier in the 
> base protocol.  
> > > Just weight reduction, given that not all applications 
> would use it?  
> > > I'm probably fine either way, just interested to know.
> > >
> behind one 
> > > or more NATs), I don't think this question plays into that other 
> > > debate at all.
> > >
> > > -- Peter
> > >
> > >
> > >

---

From: "Mary Barnes" <[email-masked]>
Date: Fri, 16 Nov 2007 11:27:05 -0600

Hi Marc,

The intent is just to highlight that the use of other identifiers is out of scope for this document and is addressed elsewhere, with an INFORMATIONAL reference to the current individual draft. It's only intended to help answer the question that Peter asked originally, which is a natural question.  The proposal is to add text something like the following to the end of section 3:

"HELD uses the IP address of the Device as an identifier in determining the location of the device.  This identifier is revealed to the LIS through the source address in requests sent by the Device.  The use of additional identifiers for HELD is outside the scope of this document and is described in [reference to draft-winterbottom-geopriv-held-identity-extensions-03.txt] "

Mary.

-----Original Message-----
From: Marc Linsner [mailto:[email-masked]] 
Sent: Friday, November 16, 2007 11:11 AM
To: 'Brian Rosen'; 'Geopriv'
Subject: RE: [Geopriv] Question on client identifier in HELD (re:HELDguidance for IP address ID)

Brian,

> I'm not sure what the additional security issues are: were you 
> referring to the fact that the IP address comes automatically and 
> another identifier would have to be added by a client?  I think that 
> such issues could be left to the extension document.
> 
> LCP is "give me my location".  If "my" is determined by some ID other 
> than an IP address, it's still an LCP.

It's now an LCP that can be spoofed by someone other than "my".  Large security/privacy issues.

The identity extensions draft Mary mentioned in not a wg item, you want to reference it?

-Marc-

---

From: [email-masked]
Date: Fri, 16 Nov 2007 12:34:51 -0500

Thanks for the clarification.  I was not asking for changes, just a curio. 
 
I agree, some clarifying text would be helpful to avoid the same questions 
coming up again in future, and think it may work well along with the 
VPN-related issue discussion. 
-- Peter

"Mary Barnes" <[email-masked]>
16.11.07 11:30
 
        To:     "Brian Rosen" <[email-masked]>, 
<[email-masked]>, "Geopriv" <[email-masked]>
        cc: 
        Subject:        RE: [Geopriv] Question on client identifier in 
HELD (re: HELDguidance  for IP address ID)

Yes, Martin T. has suggested that we add an informational reference to the 
identity extensions draft.  That will fit in nicely with the text we are 
adding to discuss the use of IP address as identifier. I'll shortly post 
an update to the overall text proposal that also addresses a couple of the 
points made recently by Martin D.

Mary. 

-----Original Message-----
From: Brian Rosen [mailto:[email-masked]] 
Sent: Friday, November 16, 2007 10:22 AM
To: Barnes, Mary (RICH2:AR00); [email-masked]; 'Geopriv'
Subject: RE: [Geopriv] Question on client identifier in HELD (re: 

I had the same reaction, but the only thing I think we should change is to 
add some text that makes it more clear that the protocol is intended to be 
extended for other identifiers, and while IP address is a suitable 
identifier for many networks, it may not work well in others.  Perhaps 
this could be tied to the text we are discussing that describes the issues 
with using IP address as the identifier.

Brian

Hi Peter,

Mary. 

Hi all, 

-- Peter

---

From: [email-masked]
Date: Fri, 16 Nov 2007 12:44:09 -0500

Hi again, just a suggested wording tweak or two... 

"HELD, as described here, assumes the use of IP address of the Device as 
an identifier used by the server in determining the location of the 
Device.  This identifier is revealed to the LIS through the source address 
in requests sent by the Device.  The use of additional identifiers for 
HELD is allowed for, but outside the scope of this document.  Such 
extensions may be described in separate documents such as [reference to 
draft-winterbottom-geopriv-held-identity-extensions-03.txt] "

-- Peter

16.11.07 12:27
 
        To:     "Marc Linsner" <[email-masked]>, "Brian Rosen" 
<[email-masked]>, "Geopriv" <[email-masked]>
        cc: 
        Subject:        RE: [Geopriv] Question on client identifier in 
HELD    (re:HELDguidance        for IP address ID)

Hi Marc,

The intent is just to highlight that the use of other identifiers is out 
of scope for this document and is addressed elsewhere, with an 
INFORMATIONAL reference to the current individual draft. It's only 
intended to help answer the question that Peter asked originally, which is 
a natural question.  The proposal is to add text something like the 
following to the end of section 3:

"HELD uses the IP address of the Device as an identifier in determining 
the location of the device.  This identifier is revealed to the LIS 
through the source address in requests sent by the Device.  The use of 
additional identifiers for HELD is outside the scope of this document and 
is described in [reference to 
draft-winterbottom-geopriv-held-identity-extensions-03.txt] "

Mary.

-----Original Message-----
From: Marc Linsner [mailto:[email-masked]] 
Sent: Friday, November 16, 2007 11:11 AM
To: 'Brian Rosen'; 'Geopriv'
Subject: RE: [Geopriv] Question on client identifier in HELD 

Brian,

-Marc-

---

From: "Marc Linsner" <[email-masked]>
Date: Fri, 16 Nov 2007 12:51:08 -0500

Mary,

How about this:

"HELD uses the IP address of the Device as an identifier in determining the
location of the device.  This identifier is revealed to the LIS through the
source address in requests sent by the Device.  The use of additional
identifiers for HELD is outside the scope of this document."

-Marc-

> 
> The intent is just to highlight that the use of other 
> identifiers is out of scope for this document and is 
> addressed elsewhere, with an INFORMATIONAL reference to the 
> current individual draft. It's only intended to help answer 
> the question that Peter asked originally, which is a natural 
> question.  The proposal is to add text something like the 
> "HELD uses the IP address of the Device as an identifier in 
> determining the location of the device.  This identifier is 
> revealed to the LIS through the source address in requests 
> sent by the Device.  The use of additional identifiers for 
> HELD is outside the scope of this document and is described 
> in [reference to 
> appear to

---

From: "Marc Linsner" <[email-masked]>
Date: Fri, 16 Nov 2007 12:56:14 -0500

Peter,
 
"The use of additional identifiers for HELD is allowed for, but outside the
scope of this document."
 
This is not (yet) true and there is no wg document that is in progress
towards making it true.  This is an assumption that has yet to pass muster.
 
-Marc-

"HELD, as described here, assumes the use of IP address of the Device as an
identifier used by the server in determining the location of the Device.
This identifier is revealed to the LIS through the source address in
requests sent by the Device.  The use of additional identifiers for HELD is
allowed for, but outside the scope of this document.  Such extensions may be
described in separate documents such as [reference to
draft-winterbottom-geopriv-held-identity-extensions-03.txt] "

-- Peter

---

From: "Mary Barnes" <[email-masked]>
Date: Fri, 16 Nov 2007 11:58:46 -0600

Marc,

That's fine - it lends the possibility to other identifiers, which was the intent of the text.  It's not worth debating the informational reference if it causes you too much concern.

Mary. 

-----Original Message-----
From: Marc Linsner [mailto:[email-masked]] 
Sent: Friday, November 16, 2007 11:51 AM
To: Barnes, Mary (RICH2:AR00); 'Brian Rosen'; 'Geopriv'
Subject: RE: [Geopriv] Question on client identifier in HELD (re:HELDguidance for IP address ID)

Mary,

How about this:

"HELD uses the IP address of the Device as an identifier in determining the location of the device.  This identifier is revealed to the LIS through the source address in requests sent by the Device.  The use of additional identifiers for HELD is outside the scope of this document."

-Marc-

> 
> The intent is just to highlight that the use of other identifiers is 
> out of scope for this document and is addressed elsewhere, with an 
> intended to help answer the question that Peter asked originally, 
> which is a natural question.  The proposal is to add text something 
> like the following to the end of section 3:
> 
> determining the location of the device.  This identifier is revealed 
> to the LIS through the source address in requests sent by the Device.  
> The use of additional identifiers for HELD is outside the scope of 
> this document and is described in [reference to

---

From: "Winterbottom, James" <[email-masked]>
Date: Fri, 16 Nov 2007 13:09:30 -0600

Marc,

Then please start having the debate NOW!
The identity extensions draft has been out since this time last year is at rev-03 and is about to go rev-04, and so far I am not aware of ANY complaints about the security section.

I await your feedback.

Cheers
James

> Sent: Saturday, 17 November 2007 3:33 AM
> HELD(re:HELDguidance for IP address ID)
> 
> Brian,
> 

------------------------------------------------------------------------------------------------
This message is for the designated recipient only and may
contain privileged, proprietary, or otherwise private information.  
If you have received it in error, please notify the sender
immediately and delete the original.  Any unauthorized use of
this email is prohibited.
------------------------------------------------------------------------------------------------
[mf2]

---

From: "Marc Linsner" <[email-masked]>
Date: Fri, 16 Nov 2007 15:45:36 -0500

James,

What's the purpose? Are there use cases that
[draft-ietf-geopriv-http-location-delivery-02.txt] doesn't support?  Is
anyone hollering about needing an identifier different from IP address?

> The identity extensions draft has been out since this time 
> last year is at rev-03 and is about to go rev-04, and so far 
> I am not aware of ANY complaints about the security section.
> 

You can't simply say it's up to the LIS operator to make sure the requestor
of location can have it.  You have to provide mechanism/guidance on how to
secure/authorize the data and privacy.

-Marc-

---

From: "Stark, Barbara" <[email-masked]>
Date: Fri, 16 Nov 2007 16:01:09 -0500

Yes, there is demand. We need a LIS to LIS LCP. It's been suggested that
we can use HELD, with other IDs. In this case, the ISP LIS may need to
use ATM PVC or NAS (Network Access Server) ID and port or VLAN ID or
L2TP tunnel information or some combination of these, in order to query
the access provider LIS. The access provider doesn't always see the IP
address.
Barbara

-----Original Message-----
From: Marc Linsner [mailto:[email-masked]] 
Sent: Friday, November 16, 2007 3:46 PM
To: 'Winterbottom, James'; 'Geopriv'
Subject: RE: [Geopriv] Question on client
identifierinHELD(re:HELDguidance for IP address ID)

James,

> I am not aware of ANY complaints about the security section.

You can't simply say it's up to the LIS operator to make sure the
requestor
of location can have it.  You have to provide mechanism/guidance on how
to
secure/authorize the data and privacy.

-Marc-