Subject: [hrpc] discuss draft-tenoever-hrpc-anonymity-02

From: Niels ten Oever <[email-masked]>
Date: Fri, 16 Feb 2018 12:11:34 +0100

Thanks a lot for the progress on draft-tenoever-hrpc-anonymity-02
Stephane. I think the links to the GDPR are also quite apt!

One question:

 Pseudonymity  Derived from pseudonym, a persistent identity which is
      not the same as the entity's given (or official) name.  For all
      IETF protocols, pseudonimity is a given: protocols don't care
      whether the identity is an official one or not.  Even if the
      protocol allows to use ifficial identities (for instance in the
      From: header of an Internet email), it dos not require it.  But it
      should be noted that, if the user cannot create new pseudonyms
      easily, pseudonyms suffer from linkability.  Unlikability depends
      on this ability to create new pseudonyms gratis and at will (good
      examples are SSH keys or Bitcoin addresses).

Even when a user can create new pseudonyms easily, persistent pseudonyms
still suffer from linkability, right?

And some suggestions for some more use cases:

4.3 Selective use

A user might want to retain their anonymity to certain actors /
protocols, but identified to others

4.4 Dynamic use

A user might want to keep the persistence of their anonymous or
pseudonymous to an absolute minimum timespan

4.5 User analysis

A user might want to understood which other actors might (potentially)
have which level of information about them.

Nits:
- ifficial identities = probably official identities. But not sure what
these are, do you mean names as registered on a passport?

- dos = does ?

- Unlikability = unlinkability ?

- causes = cases ?

Happy to discuss!

Niels

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 16 Feb 2018 16:22:54 +0100

On Fri, Feb 16, 2018 at 12:11:34PM +0100,
 Niels ten Oever <[email-masked]> wrote 

> still suffer from linkability, right?

Yes but the idea is that, if you have easily-creatable pseudonyms, you
can use a fresh one for each operation, thus defeating linkability
(for instance, this is the recommended procedure for Bitcoin, see the
EFF donation site for instance).

> 4.3 Selective use

OK

> pseudonymous to an absolute minimum timespan

Not clear to me. Explanations?

> have which level of information about them.

Hmmm, it seems an use case for identification, not for anonymity?
("OK, Google, I want to know everything you know about me")

> these are, do you mean names as registered on a passport?

Added in the terminology section.

> - dos = does ?

Fixed

> - Unlikability = unlinkability ?

No, it means I don't like it :-)

> - causes = cases ?

The sentence could be clearer, but it was supposed to be causes.

Commit at:

https://github.com/nllz/IRTF-HRPC/commit/80eaa68a1ba5fac9f89ef46af2f4a0016ef0cd30

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 19 Feb 2018 18:24:23 +0100

> EFF donation site for instance).

Yes, but there are maybe other ways to isolate pseudonyms, rights?

This seems to involve user-choice, which in general is good, but maybe
should not be the default in this case?

> Not clear to me. Explanations?

The longer an anonymous identity is kept, the higher the risk it is
linked to an identity, right?

> ("OK, Google, I want to know everything you know about me")

Or an opportunity for inventarization, threat modeling and informed
decision making by the data subject.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 23 Feb 2018 10:20:33 +0100

On Mon, Feb 19, 2018 at 06:24:23PM +0100,
 Niels ten Oever <[email-masked]> wrote 
 a message of 71 lines which said:

> > the idea is that, if you have easily-creatable pseudonyms, you can
> > use a fresh one for each operation, thus defeating linkability
> > (for instance, this is the recommended procedure for Bitcoin, see
> > the EFF donation site for instance).
> 

What is "to isolate"? 

> This seems to involve user-choice, which in general is good, but
> maybe should not be the default in this case?

You mean the default should be unique-use pseudonyms (thus making
linkability more difficult) but with the ability for the user to keep
the same pseudonym for a long time, for instance to build a
reputation on it? Did I understand correctly?

> linked to an identity, right?

Well, if there is a repeated use of an identity, it is certainly not
anonymous, just pseudonymous. And for the timespan, yes, breaking the
pseudonymity is not binary: some pseudonyms are trivially linkable to
an "official" identity, some are not. And the longer you use them, the
more clues you give to someone who wants to unveil your
identity. Added in commit a9d56eebe132b3321c783685c83bf90377a0b04b
<https://github.com/nllz/IRTF-HRPC/commit/a9d56eebe132b3321c783685c83bf90377a0b04b>

> > > A user might want to understood which other actors might
> > > (potentially) have which level of information about them.
> > 

Not sure I get it but I tried to give an example in commit
a9d56eebe132b3321c783685c83bf90377a0b04b: "Example: if a domain name
registry does not publish the name of a registrant, the registrant
cannot check if the person who did the registration indicated the name
of their client, or their own name."