Subject: RE: More misinformation on IPv6

From: Brian Zill <[email-masked]>
Date: Thu, 14 Oct 1999 03:59:28 -0700

Hi Jeff,

> From: Jeff Williams [mailto:[email-masked]]
>
> Over all I agree with your sentiment at least.

Glad to hear my message was received in the spirit it was intended.

> Looking for more positive solutions and insuring
> that there is absolutely NO privacy or security
> holes in IPv6 would be the best and most
> productive direction everyone can take.

As Ignatios Souvatzis has already pointed out, absolutes are often
impossible to achieve outside of an ideal world.  IETF working groups are
definitely not an ideal world :-).  Since they are open to all comers, they
are often necessarily creatures of compromise.  Sometimes the goals
inherently conflict.  By posting here you are contributing, and positive
suggestions that may lead to real solutions are appreciated.

> > What you're all arguing about is a "may" clause,
> > one way out of many possible ways to form an
> > interface identifier.  How interface identifiers
> > end up getting created in common practice is the
> > real issue, I believe. (And even there the concern
> > is primarily with end user machines, and not
> > with the addresses of servers or routers.)  There
> > may or may not be a realistic privacy concern
> > associated with this, opinions tend to vary with
> > one's predictions of future common practices.
> > So I'll refrain from commenting on that issue
> > at this time.
> 
>   May not be a realistic privacy concern???
> There definitely is a privacy concern and you
> pointed it out in your paragraph just before this
> one above.  And "May not be" is not good enough.

I believe you misunderstand me.  The "may or may not" in my statement above
depends upon the individual's prediction of future common practices.  To
pick an extreme example, if one predicts that no one will ever form their
interface identifiers from MAC addresses, than it is clearly impossible in
that future scenario for such things to be a privacy concern.  If you have a
different opinion, than presumably you have a different prediction of future
common practices.  I'm not trying to claim any particular prediction of the
future is correct (if I was good at predicting the future, I'd be a stock
trader, not a programmer :-).

> > The concern I have that prompted this post
> > is that some people are misrepresenting this
> > issue as an IPv6 protocol flaw.  It is not.
> > It is an issue regarding how the protocol
> > might be used in practice.
> 
>   Well that is a flaw by definition.  Not a feature.  >;)

No, it IS a feature.  Denying a capability to the entire set of possible
users, simply because a particular subset doesn't wish to utilize that
capability, is often viewed by those not in that particular subset as an
unreasonable restriction.

For example.  There are many companies in the world today which don't
provide (or whose policies don't allow) external access to the public
Internet for their employees' personal use.  Such a company may legitimately
desire, for convenience or asset management reasons, to allocate all of its
internal IPv6 addresses using embedded MAC addresses.  The privacy concern
that Richard Smith outlined doesn't appear to exist is this situation.  This
is a company that just wants to use its own private property in a way that
is convenient for it to do so.  Why should the IETF forbid such a thing?

> > The same issue is relevant (or not) with regards
> > to how IPv4 addresses are used in practice today.
> 
>   No this is not really the case at all.  At the
> client level this problem can be dealt with by the
> user themselves.  Not true with the current 
> spec on IPV6.

I don't follow you, and I'm very familiar with the specifications of both
IPv4 and IPv6.  The IPv6 specifications allow for, and every IPv6 stack
implementation that I've seen provides the capability for, the end user to
manually set their address to whatever they want.

--Brian

The opinions I've expressed in this message are my own and should not be
taken as representative of Microsoft, the IPv6 Forum Tech Directorate, the
ipv6.org web site, or any other company, group, person or inanimate object.

> --
> Jeffrey A. Williams
> Spokesman INEGroup (Over 95k members strong!)
> CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng.
> Information Network Eng. Group. INEG. INC.
> E-Mail [email-masked]
> Contact Number:  972-447-1894
> Address: 5 East Kirkwood Blvd. Grapevine Texas 75208
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Jeff Williams <[email-masked]>
Date: Thu, 14 Oct 1999 07:21:36 +0100

Brian and all,

Brian Zill wrote:

> definitely not an ideal world :-).

  How true the IETF is not and ideal world, I have been involved with the
IETF and been on working groups of various types for many years now.
I for one don't expect perfection, but always strive for it.  >;)

> Since they are open to all comers, they
> depends upon the individual's prediction of future common practices.

  In some respects yes this is true, but where such concerns can be technically
addressed they should be.  ANd that is not the case here with this
specific problem with IPv6 presently.  The resistance to addressing
this piracy concern seems to be motivated from other sectors
it seems to me.  Yet we all know that privacy concerns are paramount
in the user community, in fact they are more an more demanding
better privacy protections designed into the products they use as
recent court cases can attest to.

> To
> common practices.

Well as you know or should know, there is really no such a thing
as "Common Practice" that is sufficient enough to stand up in court
when it comes to some issues such a privacy issues.  In addition
I would venture to say that "Common Practice" does not dictate
necessarily, "Good Practice".

> I'm not trying to claim any particular prediction of the

  LOL!  Well I do both.  I am hitting the 85% on my stock trading.  >;)

> unreasonable restriction.

  I am not saying that this needs to be the case.  I am saying that it
should be in the hands of the user at the client level, not at the
ISP or service level, hence the problem.

> Internet for their employees' personal use.

  Yes but this is shrinking rapidly.

> Such a company may legitimately
> internal IPv6 addresses using embedded MAC addresses.

  And here is the crux of the problem.  Those companies are even outside
or the "Common Practice" to which you subscribe to.  To aid and abed
this practice is not only against "Common Practice" but also is a violation
of that employees privacy rights and in violation of "Good Practice".

> The privacy concern

The IETF should not.  The IETF should however provide for user
determined options in the spec.

> ipv6.org web site, or any other company, group, person or inanimate object.

Regards,