Subject: FYI...

From: Fred Baker <[email-masked]>
Date: Fri, 15 Oct 1999 16:49:06 +0100

I have been sending the following email to any number of reporters and
privacy advocates for the last couple of days. You may want to critique it.
-------------------------------------------------------------------------
Here are some comments on the AP article, which you no doubt saw.

>The IETF's top engineers acknowledge some implications for on-line privacy,
>but ``I think the privacy concerns are overrated,'' said Fred Baker, the
>task force's chairman.

For the record, I told the AP reporter that you gained little more
information from the MAC Address inside the IP6 address than you gain from
having a predictable IP address, and that therefore "the [incremental]
privacy concerns are overrated". From the IP Address, you learn that
someone is using the numbered machine, probably the person who usually does
or one of the people who usually does. For example, if you see a message
from 171.69.128.117, you know that my PC is at my home, that it obtained
one of a set of five addresses from a DHCP server at Cisco, and that one of
a small set of people (myself or my family) are using it. From the MAC
Address, you additionally learn either that the site uses locally
administered addresses, or that the person bought a particular vendor's
Ethernet card.

At Purdue, on Tuesday, I was told of a case where a person who stole an
Ethernet card from someone else's machine was tracked down because the DHCP
"IP4 address license" had not yet expired and they were able to sniff for
the assigned address.

During the interview, the reporter kept asking "what if there was a global
registry correlating people with addresses, wouldn't that be a problem?". I
asked him what his system's MAC Address was, and who knew that... He didn't
know and nobody else did; the global registry doesn't exist, and if it did
it would be very difficult to maintain. That doesn't sound, to me, like a
great increase in the privacy risk over what you learn from the IP Source
Address itself. 

If putting the MAC Address into the IP6 address is a problem, someone
should tell Novell and Xerox. The Xerox Internet Transport, which IPX
copied in the design of Novell Netware, has used the MAC Address as the
"host identifier" portion of the network layer address since the 1970s.
DECNET IV also has always had an algorithmic relationship between the MAC
Address and the network layer address, and IS-IS routable CLNS NSAPs
contain the MAC Address as well - CLNS Level 1 Routing routes to the MAC
Address, which it calls a Host Identifier. I haven't heard that this caused
privacy issues to arise in any of those protocols, and see no reason to
believe that it would do so in IP6.

I agree that privacy is important; I question what is compromised by the
proposal. Neither the IP Address nor the MAC address tell you who is using
the machine, and both kinds of address permit you to trace the traffic
originated by a machine. 
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Cyndi Jung <[email-masked]>
Date: Fri, 15 Oct 1999 12:45:24 -0700

Having an address that doesn't change so dynamically can be a
good thing - much easier to associate it with a name.  Also,
the potential "killer app" of choice identified right now is
IP Telephony, which really doesn't work too well if your addresses
are changing frequently, and nobody believes that dynamic updates
to DNS will make this a non-issue.

I find missing in all these responses any mention of the role of 
DNS in the transition story of IPv6.  DNS is central to the hope
of IPv6 succeeding as the next generation Internet Protocol.  The
fact that DNS has had AAAA records in BIND for enough time to make
it likely to have been installed in a non-trivial number of places
in the Internet, and that it works seemlessly in the same distributed
system with unmodified DNS servers that know nothing of AAAA record 
types is a very powerful fact.

Bad press is an excellent opportunity to expound on the whole picture.
The network address and autoconf is just a piece, and to confine your 
response to answering this one point is missing an opportunity.

Cyndi

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 18 Oct 1999 14:01:40 -0500

Fred,

I think it's very important that we all *start* each dealing with
press by pointing out that privacy is important, that the IETF
definitely cares about privacy (e.g. our stand on cryptography),
and that we certainly don't believe that IPv6 is a threat to 
privacy. Then get into the details.

  Brian