Subject: My InternetWeek op-ed column on IPv6 privacy issues

From: Ville Nummela <[email-masked]>
Date: Mon, 18 Oct 1999 17:10:36 +0300

Jeff Williams wrote:

>   Excuse me Brian, but why must those devices have permanent
> IP addresses?  As you know to do so creates a privacy problem
> that is also as you know, addressable, pardon the pun.  >;)

Your telephone has a permanent telephone number, does that create a privacy problem
for you?

--
 |   [email-masked] work: +358-5-4125389 home: +358-40-5075560     |
 |     IRC naturae alienum est! Periculosum est! Delendum est!      |

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Michael H. Warfield" <[email-masked]>
Date: Mon, 18 Oct 1999 10:52:54 -0400

> Your telephone has a permanent telephone number, does that create a privacy problem

	For some people it really does, once you grant the existance of
CLID (Calling Line ID).  Once the originating number becomes known to the
destination number, you have an analogous situation.  Yes.  Then there
are a number of people who have a serious privacy problem over their
telephone numbers and there has been, in the past, a great deal of
controversy over CLID.  It seriously delayed widespread introduction
of CLID in spite of the tremendous demand for it and in spite of the
demonstrated reduction in crank, obscene, and threatening phone calls.
California even had a law on the books banning CLID resulting in the
amusing situation that people in other states could get the numbers
of Californian callers but other Californians could not.  That ended only
when the FCC mandated CLID availability nation wide.

	Some of the solutions have been "use various pay phones" (Dynamic
address for your source phone number?) or use "calling number block" (but
then we have "block the blocker" services).  I've never heard of anyone
suggesting real "dynamic numbers" for outbound calls to address this, but
it is similar to what you get with PBXs and DID trunks where the number
that shows up on the CLID box is the outgoing PBX trunk and not your
inward dialing DID number.

	For most of us (myself included) fixed static IP addresses (IPv4 or
IPv6) present no privacy concerns.  For many of us, the advantages of fixed
addresses far outweight the disadvantages, especially for our servers, but
even for our workstations.  For others, this presents just as serious a
privacy convern as the Battered Woman's Shelter that does not want its
phone number to show up on an abuser's CLID box.

	For others still, the fact that WE have fixed static address and THEY
have dynamic addresses singles them out (the block the blocker stuff).  They
end up catagorized because they make this choice that they don't want static
addresses and then things get denied them or they get treated differently
than the rest of us (or so they fear).  Our exercize of our right to not
give a damn about the issue for ourselves becomes a personal threat, in
their eyes, to their ability to exercize their rights to consider this
to be a paramount serious issue.  

	I have mail filters on my mail server that checks with DULS and
DSSL to see if the peer contacting me is from a "dial-in" dynamic block
of addresses.  If it is, I refuse all mail (drop it in a SPAM CAN) from
them (they should be going through their ISP server) since most of that
is nothing but SPAM (>99%).  This doesn't affect DHCP allocated addresses
(unless the maintainers are foolish enough to use names which trip DSSL).
Still, for at least one service, I do discriminate against dynamically
allocated addresses.  There may be other reasons now or in the future.

	I don't think there are very good solutions to the "block the
blocker" situation.  By solving their concerns, it opens up a can of
worms for the rest of us when people start abusing their ability to
hide while acting irresponsibly.  It's the same thing as the anonymity
vs accountablity debate.  How do you preserve someone's privacy without
giving them the ability to violate the rights (and privacy) of others
around them without fear of accountablity.

	Mike
-- 
 Michael H. Warfield    |  (770) 985-6132   |  [email-masked]
  (The Mad Wizard)      |  (770) 331-2437   |  http://www.wittsend.com/mhw/
  NIC whois:  MHW9      |  An optimist believes we live in the best of all
 PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!

---

From: Peter Tattam <[email-masked]>
Date: Tue, 19 Oct 1999 15:42:02 +1100 (EST)

One could then ask following question...

If there is a true need and sufficient demand for anonymizer services, then
would it be a flourishing business model?  An anonymizer at to the connection
level would imply to me some kind of NAT or firewall.

In keeping with the charter of this mailing list, I would have to say that Ipv6
can only be a step forward in this whole debate in that it offers more
solutions for user control over anonymity of IPv6 addresses (well the lower 64
bits at least) in the absence of anonymizer services.

I could say much more on the issue, but it is getting too far out of the
charter of this list.

Peter

--
Peter R. Tattam                            [email-masked]
Managing Director,    Trumpet Software International Pty Ltd
Hobart, Australia,  Ph. +61-3-6245-0220,  Fax +61-3-62450210

---

From: Ville Nummela <[email-masked]>
Date: Tue, 19 Oct 1999 15:18:27 +0300

> bits at least) in the absence of anonymizer services.

I think this discussion is moving towards the right direction;

The original problem as described in the column mentioned on the subject line is
about using Ethernet MAC addresses as a part of IPv6 addresses. Since this is
optional (although the "default") behaviour this isn't really a problem. But then
we get to a more generic kind of privacy problem:

A static IP -address can always be (easily) traced to a certain human being (or at
least to a certain group).

Now lot's of people wrote some kind of response to my telephone -analogy.  Some of
them wrote about tapped wires. "Yikes, people can listen to my conversations" - is
that really so bad? I mean, how many of you really thinks there is someone
listening your personal calls? None, except criminals and terrorists I think.
"Ordinary" people don't have any chance of listening to anyones phone conversation
any way, and the same goes to encrypted data transfers over Internet.

Another kind of an response was this Caller ID -thing; Almost everyone thought it
was generally a bad thing. Well, at least I like to know who's calling me before I
answer the phone. An the phone system at least here in Finland has a way of
disabling Caller ID on per call basis. Then again, I have the choice of not
answering a call if I can't see the number.

Ok, let me now try to take this issue back to IPv6 and to explain my point..

I think that the way IPv6 is getting on now is quite good. Too much privacy only
makes things worse. Consider a site (a website or something else, a bank perhaps).
Now let's assume for a second that in IPv6 every address would be totally random,
totally private and no-one knew no-one elses address.. In comes Mad Cracker, who
tries to break in to the banks computers. As he proceeds trying different hacks
and perhaps finally if he can't get in he decides to DoS the site by flooding it
with packets. Using 1000 different random addresses which he changes every other
second. And the operator of the site can't do a thing. On the IPv4 world he could
have traced the first attacks when he tried to get in to some computer etc.. but
this "wrong kind of" IP architecture renders it impossible.

Now let's think another second. If this "random way" isn't the only possibility of
obtaining addresses (in the IPv6 world there should be enough addresses so that
everyone can get a static address also), the site maintainer can require the hosts
connecting to the site to use a certain IP address. e.g. use a firewall which only
lets through packets from certain addresses.  This is quite much the way IPv6 is
now.

So, my point is that IPv6 is getting along quite fine and there isn't really any
reason for this big fuzz about this so-called "privacy issue".

---

From: Jeff Williams <[email-masked]>
Date: Tue, 19 Oct 1999 08:41:45 +0100

Ville and all,

> we get to a more generic kind of privacy problem:

  The real problem is that this is the DEFAULT.  That's backwards.

> least to a certain group).

  Exactly right.  Though with IPSEC, this can be somewhat protected.

> that really so bad?

  Yes this is "Really so bad"!

> I mean, how many of you really thinks there is someone

  Likely none, this is true.  But without some sort of protections, which
I employ on my phone line, you never know.  Take Monica Lewinski for
instance.  Look at the trouble that has caused, and mostly unnecessarily
I might add as well.

> any way, and the same goes to encrypted data transfers over Internet.

Yes the same goes for "Encrypted Data Transfers".  But that is no what
we are talking about, is it?  We are talking about the DEFAULT autoconfig
for IPv6, and NO Encryption as well.  Hence this argument is not valid
on those two basses.

> answering a call if I can't see the number.

  Right, and this is a good thing.

> makes things worse.

  You can never have "Too Much Privacy".  That is an absolute, IMHO.  And
many people are going to see IPv6 as not allowing for enough Privacy
should the spec remain "As is".

> Consider a site (a website or something else, a bank perhaps).
> second. And the operator of the site can't do a thing.

  The problem with this scenario is that the operator can stop a DoS
attack with several other methods, besides the bank using a static address.
This scenario doesn't even make allot of sense from the banks point of view.

> On the IPv4 world he could

  How???

> lets through packets from certain addresses.  This is quite much the way IPv6 is

  Having this as a "Option" as part of the IPv6 spec for autoconfig would
be expectable, but not as the Default.

> reason for this big fuzz about this so-called "privacy issue".

  Well given your arguments, I am sure you DO fell this way.  However
your premise are not valid, so your argument is therefore not logical and
therefore not proving you point.

Regards,

--
Jeffrey A. Williams
Spokesman INEGroup (Over 95k members strong!)
CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng.
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number:  972-447-1894
Address: 5 East Kirkwood Blvd. Grapevine Texas 75208

---

From: Ville Nummela <[email-masked]>
Date: Tue, 19 Oct 1999 19:50:27 +0300

> for IPv6, and NO Encryption as well.  Hence this argument is not valid

Why? You admit that it's possible for everyone to acquire the privacy if they want it.
Does the IPv6 really have to PUSH privacy to people? I don't think that's the main
function of IPv6. Even though these privacy issues are things that have to be looked
into, and they already have.

> This scenario doesn't even make allot of sense from the banks point of view.

Well, the reason this scenario doesn't make sence to you is probably that it is not the
case with current IP architectures (IPv4 or IPv6).  As stated by other people in this
mailing list, IPv6 doesn't allow totally random addresses.. (now there's another issue
of IP spoofing but that's another story.. :-)

>   How???

Ok, I'll try to explain it "the hard way". If we had totally random IP addressses
(note: This is NOT the case with IPv6 and would be even rather impossible to implement
since every address would have to be on every routing table of every router.. and they
would have to be changed when the address would change) there would be no way for the
target system to separate the legitimate connections from those generated by the
attacker. The attacker could easily hog the resources of the server to the point the
server becomes not usable for it's legitimate users.
Now with IPv6 we can still filter the attackers packets on the firewall; they all share
the same network address. Therefore this whole example is totally nonsense, as you said
;-) I was just trying to exaggarate a little so that I could make my point more clear..

> therefore not proving you point.

I think bigger problem is that my English language isn't that good.. It's rather hard
trying to explain something when you have to use a dictionary.. :-P

---

From: Jeff Williams <[email-masked]>
Date: Tue, 19 Oct 1999 10:21:34 +0100

Ville and all,

Ville Nummela wrote:

> Does the IPv6 really have to PUSH privacy to people?

  I am not suggesting that the IPv6 spec push anything.  I am suggesting,
however that the spec need some significant revision with respect
to autoconfig for the purposes of privacy.  That's all.

> I don't think that's the main

  "Looked into" is not good enough.  The MUST be addressed in a satisfactory
manner.

> of IP spoofing but that's another story.. :-)

  I am not suggesting totally random addressing, but I am suggesting that
some random addressing become the default.  That can be achieved, and
should be as part of the default autoconfig.

> ;-) I was just trying to exaggarate a little so that I could make my point more clear..

  LOL!  Well you did a good job of exaggerating in your example.  >;)

> trying to explain something when you have to use a dictionary.. :-P

  Well my french is not all that good either.  But I thought you did ok on your
english.  It is just that your arguments don't hold or are not valid.

Regards,