Subject: More misinformation on IPv6

From: Guy Davies <[email-masked]>
Date: Wed, 13 Oct 1999 17:13:45 +0100 (BST)

Hi,

Now the misinformation about the privacy threat posed by IPv6 is even
being spread from the BBC web site.  This is serious because, justifiably
or not, people believe the BBC :-(

http://news.bbc.co.uk/hi/english/sci/tech/newsid_473000/473647.stm

Guy
-- 
Guy Davies			UUNET, An MCI WorldCom Company
Sr. Network Engineer		332 Science Park, Cambridge, CB4 4BZ, UK
email:  [email-masked]		tel: +44 (1223) 250457 
mobile: +44 (7771) 907481 	fax: +44 (1223) 250412 

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Jeff Williams <[email-masked]>
Date: Wed, 13 Oct 1999 16:29:47 +0100

Guy and all,

  Hummm?  I guess we disagree here.  I found this article that
you kindly provided the link to to be essentially accurate.  Pray
tell what part you find either disagreeable or inaccurate?

> http://news.bbc.co.uk/hi/english/sci/tech/newsid_473000/473647.stm

Regards,

--
Jeffrey A. Williams
Spokesman INEGroup (Over 95k members strong!)
CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng.
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number:  972-447-1894
Address: 5 East Kirkwood Blvd. Grapevine Texas 75208

---

From: Grenville Armitage <[email-masked]>
Date: Wed, 13 Oct 1999 16:41:44 -0700

Jeff,

A number of posters have recently commented on the essential
_in_accuracies. It would be more illuminating if you listed each
assertion of privacy concern you considered accurate, along
with supporting evidence. 

cheers,
gja

---

From: Jeff Williams <[email-masked]>
Date: Wed, 13 Oct 1999 17:28:05 +0100

Grenville and all,

  I can appreciate your interest here of course, but I believe
I listed my supporting evidence as part of my in turn support
for Bills comments as well as the article to which Guy
kindly posted.  I am in total agreement with the article in it's
entirety.  As such, that stands for my evidence in part as
have the other two articles that were posted, one of which
was the one I posted from AP.ORG.

Regards,

---

From: Grenville Armitage <[email-masked]>
Date: Wed, 13 Oct 1999 17:39:47 -0700

Jeff Williams wrote:
	[..]
> As such, that stands for my evidence in part as

Each article is a collection of assertions without much
explanation. I'm asking for your explanations to backup
the assertions you're buying into. This is a WG, not
an op-ed group.

cheers,
gja

---

From: Jeff Williams <[email-masked]>
Date: Wed, 13 Oct 1999 17:51:49 +0100

Grenville and all,

  I believe I outlined in some specific the concerns I had regarding
the privacy issues from a technical standpoint some 4 months ago
on this list.  You might want to review the archives for that time frame

as repeating the concerns I outlined yet again would be an exercise
that I feel is of little value at this juncture as those concerns as
potential correction fell od deaf ears than and are likely to do
so again should I repeat them here again.

Regards,

---

From: "Richard M. Smith" <[email-masked]>
Date: Wed, 13 Oct 1999 21:13:34 -0400

Hi Guy,

I looked over the BBC article and it seems fine to me.

My concern here is that Web sites will start building
databases that include people's MAC address.  
MAC addresses will then allow Web sites to correlate
personal data using a common MAC address key.

The most likely scenario is when a Web site
gets a hit, they can query other Web sites to find
out what they know about the MAC address that comes
in with the hit.  My guess is that very quickly, market
forces will produce some sort of central registry
which can give out a name, Email address, phone #,
etc. given a MAC address.

Microsoft, for example, even started building
just such a database with their Windows 98 Registration Wizard.  
For example, here is some of my registration information
that illustrates the problem:

=== Microsoft Registration Wizard ===
Default First Name = Richard M.
Default Last Name = Smith
Default Company = 
Mailing Address = 172 Mason Terr.
Additional Address = 
City = Brookline
State = MA
ZIP Code = 02446
Country = 0
Daytime Phone = 617 731-0682
...
HWID = 13b50d60ce4a11d2a67f002078900337

The HWID field is a GUID and so it contains
my MAC address which is 002078900337.  

(If someone is running Windows 98 and has done
electronic registration, this same information can
be found in the file c:\windows\reginfo.txt.)

Because of public pressure however, Microsoft has
stopped saving HWIDs at their servers and
in the second edition of Windows 98, no longer
generates the number.  Microsoft also plans
to eliminate the use of MAC addresses inside of GUIDs
in general in future versions of Windows.

RealNetworks also is building a similar registration 
database with GUIDs and MAC addresses.  However, they
haven't stopped recording MAC addresses because
no one has caught them yet. :-)

Richard

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Guy Davies
> Sent: Wednesday, October 13, 1999 12:14 PM
> To: [email-masked]
> Subject: More misinformation on IPv6
> 
> 
> Hi,
>

---

From: [email-masked] (Sam Manthorpe)
Date: Wed, 13 Oct 1999 18:31:50 -0700 (PDT)

> just such a database with their Windows 98 Registration Wizard.  

So the problem already exists with IPv4, then, and is not IPv6
specific as the BBC article claims.  Also, isn't it relatively
easy to construct such databases for any people using the
Web with Java enabled in their browser, irrespective of underlying
hardware?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sam Manthorpe, SGI.  tel: (650)933-2856 fax: (650)932-2856  [email-masked]
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: [email-masked] (Sam Manthorpe)
Date: Wed, 13 Oct 1999 18:44:28 -0700 (PDT)

> Web with Java enabled in their browser, irrespective of underlying

Sorry, for `hardware', read `network layer protocol'.

---

From: "Richard M. Smith" <[email-masked]>
Date: Wed, 13 Oct 1999 22:04:33 -0400

Sam,

IPv4 isn't considered a reliable tracking mechanism at 
Web sites because too many folks use dynamic IP addresses
particularily among home users.  That's why
cookies were invented.  Netscape at least designed
them so they can't be shared between Web Sites.

However with IPv6, when using the autoconfiguration
feature, even dynamic addresses will contain a
static MAC address and hence are trackable.

By the time IPv6 sees widespread use, I suspect
that most computers will have an Ethernet adapter
for a LAN connection, DSL modem, or cablemodem. 
Pretty much everyone will have a MAC address.

Hmm, maybe we should just start assigning them at
birth and make them permanent? :-)

Richard

> From: Sam Manthorpe [mailto:[email-masked]]
> Sent: Wednesday, October 13, 1999 9:32 PM
> To: Richard M. Smith
> Cc: [email-masked]; [email-masked]
> Subject: Re: More misinformation on IPv6
> 
> 
> 
> Richard M. Smith wrote:

---

From: Grenville Armitage <[email-masked]>
Date: Wed, 13 Oct 1999 19:09:53 -0700

"Richard M. Smith" wrote:
	[..]
> databases that include people's MAC address.

Which today they do using the entire IPv4 address.

> personal data using a common MAC address key.

As with IPv4 addresses.

And when a NAT box scrambles things, the fearful user's
IP address is mangled - whether using v4 or v6.

And when DHCP is used to assign addresses, the longterm
uniqueness of the IP addresses collected by websites depends
on DHCP Server policy - whether using v4 or v6.

And when users are dial-up connected, same deal. Address-to-user
associations are of a duration and obscurity dictated by
the ISP.

And when some other source of numbers is used for the bottom
64 bits, websites will still be able to correlate user
behavior with their IPv6 address for as long as the source
keeps the same lower 64 bits.

All in all, nothing much new under the sun compared to v4.
Except that a few reporters wanted a quick 'kill' over
the IETF geeks, tripped over their shoelaces, and fell into
the glassware cabinet in the process. Now we get to clean up
the broken glass.

cheers,
gja

---

From: "Richard M. Smith" <[email-masked]>
Date: Wed, 13 Oct 1999 22:30:26 -0400

Grenville,

> on DHCP Server policy - whether using v4 or v6.

It sounds like everyone is complete agreement
here.  Always use DHCP to get the MAC addresses out of IPv6
addresses, and many of the new privacy concerns in IPv6
go away.  At least then, the privacy problems don't
get worse when we shift from IPv4 to IPv6.

Richard

---

From: Jeff Williams <[email-masked]>
Date: Wed, 13 Oct 1999 20:31:39 +0100

Grenville and all,

  Nice piece of circular argument yourself here.  Lets break it
down a bit, shall we?  >;)

> Which today they do using the entire IPv4 address.

  True, but the individual user can control this presently
in v4. With MAC's in v6 they will than become dependent
on the service provider.  Not a comforting though when it
comes to privacy issues, is it?

> > personal data using a common MAC address key.

  Yes, but again this can be controlled by the user should they so
choose to do so.  Again you are oversimplifying the problem
so as to strengthen your perspective instead of representing
the plain cold facts in a tad bit more detail.  Nice try here, but
again no cigar!  But I must say I admire you sense of
deviousness!  >;)

> IP address is mangled - whether using v4 or v6.

  BUt this is not an assured occurrence in every instance, is it?
So hardly comforting ore really relevant except in an occasional
instance of two.  Again Nice try, but again no cigar!  >;)

> on DHCP Server policy - whether using v4 or v6.

  Again this would depend of if, 1.) DHCP is being used at all, and
2.) As you say, the "Server Policy" and what criterion that policy
is determined upon.  Again hardly comforting.  This should be a user
determined decision, not some remote "Server Policy" set by their
service provider.  Hence this is paramount to bad design or design by
political expediency.  Nice try again, but again, no cigar!  >;)

> associations are of a duration and obscurity dictated by

  ANd this is really the crux of the debate, isn't it?  The ISP/IAP
makes the decision rather than the user due to a design
flaw that doesn't allow for an opt out by the user.  Bad idea,
bad engineering.

> the glassware cabinet in the process. Now we get to clean up

  ROFLMAO!  As I have now pointed out yet again your conclusion
is based on premises that are flawed and a design that is
questionable, hence leaving this conclusion fallacious.

Regards,

---

From: Stig Venaas <[email-masked]>
Date: Thu, 14 Oct 1999 09:40:03 +0200

> get worse when we shift from IPv4 to IPv6.

I think it would be good to have fixed link-local address and perhaps
site-local addresses. That should make life easier for local system and
network administrators and also for DHCP I think. For the global address
it would be nice to have both a fixed one and an ever changing one. When
it initiates communication with other hosts it could then use the changing
one, while it also is reachable at the fixed address which is important
for many applications. Since not all have the same preferences as me, most
of this should be configurable. It might be important that implementations
choose the "right" defaults though.

Most of this is noted in the draft and is an implementation issue. As
with IPv4 it's perfectly possible to implement things in a bad way, and
some will.

Stig

-- 
Stig Venaas
UNINETT/NTNU

---

From: Grenville Armitage <[email-masked]>
Date: Thu, 14 Oct 1999 10:41:34 -0700

Jeff Williams wrote:
	[..]
> in v4.

We clearly connect to different Internets. In my Internet,
the service provider controls a large slab of the bits in
my IPv4 address. Indeed, I have pretty limited range of
choices as an average 'user'. Potentially none, in fact.

So like I, and others, said - IPv6 and IPv4 addresses have
very similar properties of (im)permanence and association to
particular users.

	[..]
> choose to do so.

Uh-huh. No, in practice, you cannot to any meaningful degree. See
above.

>  Again you are oversimplifying the problem

Our facts apparently live in different worlds too.

	[..re NAT, Jeff agrees it solves the problem if used..]

	[..re DHCP, Jeff agrees it can solve the problem if used..]

>   ANd this is really the crux of the debate, isn't it?

Nope. It is the crux of the debate's debunking.

>  The ISP/IAP
> makes the decision rather than the user

Same as in IPv4.

> due to a design
> flaw that doesn't allow for an opt out by the user.

Depends on your ISP. ISP policies are not the business of the IPng
mailing list. 

cheers,
gja-the-devious-one

---

From: Jeff Williams <[email-masked]>
Date: Thu, 14 Oct 1999 10:56:15 +0100

Grenville and all,

> choices as an average 'user'. Potentially none, in fact.

 That is a shame.  I guess I am luckier that you must be.

> Uh-huh. No, in practice, you cannot to any meaningful degree. See

  Well we shall have to agree to disagree here.  I KNOW that you can
you say that you can't.

> Our facts apparently live in different worlds too.

  Uh huh, well maybe you live on another planet.  I live
on the planet earth.  I am sure things look different from your
celestial perspective.  >;)

>         [..re DHCP, Jeff agrees it can solve the problem if used..]

  Right, and so?

> Nope. It is the crux of the debate's debunking.

  No it is just the crux.  You position seems to be more of the
debunking as you seem to wish to refuse the already documented in IETF
drafts, the facts.  Interesting perspective I must say.  >;)

> > makes the decision rather than the user

  In some cases yes this is true.  but it does not HAVE to be or
remain so.

> Depends on your ISP. ISP policies are not the business of the IPng

  And I was not and am not now referring to the ISP in this sense.
I see that you are though.  Nice attempt at a spin, but it still comes
full circle, so to speak.

Regards,

---

From: Grenville Armitage <[email-masked]>
Date: Thu, 14 Oct 1999 11:10:26 -0700

[..]
> drafts, the facts.  Interesting perspective I must say.  >;)

The 'debate' (as you so amusingly refer to it) began as debunking
of recent media misrepresentation of this group's work. As Jim
Bounds just pointed out, these particular media reports screwed
up. By leaping to their defense, you did too. I think the debunking
is now complete.

cheers,
gja

---

From: Jeff Williams <[email-masked]>
Date: Thu, 14 Oct 1999 11:14:50 +0100

Grenville and all,

  Well I am happy to see that you have decided (For us all perhaps?)
that you debunking of legitimate concerns by yourself is complete.
But somehow I doubt that.  >;)  None the less, the concern remains
and the debunking of some article does not fix the problem.  As
such it is just not going to just go away.

Regards,

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 14 Oct 1999 13:26:23 -0500

What we need is for someone to write a one or two page
text explaining in unemotional language why the security
and privacy issues are essentially bogus, and what the IETF
is doing for those who nevertheless remain concerned.

A good text along these lines can be the basis for an appropriate
PR response, and I would suggest that the IAB endorse it.

  Brian

---

From: Jeff Williams <[email-masked]>
Date: Fri, 15 Oct 1999 01:25:36 +0100

Brian and all,

 Denial of the existing documented privacy problems with
IPv6 is not going to buy you much and could bring on
some discredit to the IETF and IPv6 in specific.  The
best thing to do is fix the problems in the spec.
And having the IAB endorse anything along these lines
is just window dressing.

Regards,

---

From: Grenville Armitage <[email-masked]>
Date: Fri, 15 Oct 1999 09:19:22 -0700

Jeff Williams wrote:
	[..]
> some discredit to the IETF and IPv6 in specific.

Denial of the existing documented UFO sightings will also
not stop people from theorizing about Area 51.

Perhaps we need David Duchovny to come in and discover
that Brian Carpenter really is the Smoking Man, and that
the IESG have been in secret negotiations with off-world ISPs
to control 'The Net', and ultimately inject us all with a
viral serial number that robs us of our humanity.

gja

---

From: Lloyd Wood <[email-masked]>
Date: Fri, 15 Oct 1999 17:51:06 +0100 (BST)

> viral serial number that robs us of our humanity.

You know, I'm starting to understand why this list is archived on a
machine called 'playground'. Can we, like, cut it out, please? Or take
it to raven?

L.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: Jeff Williams <[email-masked]>
Date: Fri, 15 Oct 1999 14:49:47 +0100

Grenville and all,

  I was going to ignore this response here, but thought it might worth
a try anyway to at least, yet again straighten Grenville out just a
bit.  >;)

  UFO's and area 51 (Which I worked at once upon a time) has little
to do with my comment or is even remotely related to privacy concerns
and holes in IPv6 presently.

  The rest of your comment is so visceral that I think it is or should
be plainly obvious to most anyway as to it's actual intent.

Regards,