Subject: [Marnew] endpoint consent

From: Aaron Falk <[email-masked]>
Date: Wed, 23 Sep 2015 14:04:36 -0400

In the interest in warming up the discussion…

I’ve seen in a few papers that ‘endpoint consent’ is considered a critical element when discussing middlebox participation.  But I haven’t seen a clear articulation of whether both endpoints must consent or, if not, how to decide which one.  I would say that currently at most one endpoint is explicitly involved with middleboxes.  But perhaps that is only because our protocols don’t support such a three-way negotiation.   

—aaron

---

From: Natasha Rooney <[email-masked]>
Date: Wed, 23 Sep 2015 18:45:24 +0000

Hey Aaron!

Good point! I hope people will discuss this in "Session 2: Trust Models and User Choice (Privacy)", it sounds like a good fit to discuss in that session.

Natasha

Natasha Rooney | Technologist, Web and Internet, W3C & IETF | GSMA | [email-masked]<mailto:[email-masked]> | +44 (0) 7730 219 765 | @thisNatasha | Skype: [email-masked]<mailto:[email-masked]>
Tokyo, Japan

On Sep 23, 2015, at 2:04 PM, Aaron Falk <[email-masked]<mailto:[email-masked]>> wrote:

—aaron
_______________________________________________
Marnew mailing list
[email-masked]<mailto:[email-masked]>
https://www.iab.org/mailman/listinfo/marnew

This email and its attachments are intended for the above named only and may be confidential. If they have come to you in error you must take no action based on them, nor must you copy or show them to anyone; please reply to this email or call +44 207 356 0600 and highlight the error.

---

From: Jari Arkko <[email-masked]>
Date: Thu, 24 Sep 2015 00:58:18 -0400

One challenge is of course that it is already difficult for the users (or even us experts)
to understand all the exact things that are going on, so providing
a useful control for the users even on bandwidth may not be easy.
Let alone more complex settings.

The other issue is that we should be careful about setting the ambition level.
Fine-grained quality of service treatment has not been successful in the
Internet. What’s the right ambition level, being able to specify detailed
bandwidth consumption rules? Or the ability to differentiate interactive
from the non-interactive within one user? The more coarse grained
you make this, the more likely it is that it can be used by applications
and understood by users.

Jari

---

From: Salvatore Loreto <[email-masked]>
Date: Thu, 24 Sep 2015 10:36:18 +0000

To answer Aaron question if we go on this path then BOTH  endpoints MUST consent IMHO
more or less in line with the Telefonica and ALU proposals at the Sigcomm workshop on middleboxes

However having explored this topic in the past
 I agree with what Jari says below

And I am not so sure is the right way to go!
It would be much better if we can work on a collaborative solution between CP and/or CDN and the Mobile Network

BR
Salvatore

-----Original Message-----
From: Marnew [mailto:[email-masked]] On Behalf Of Jari Arkko
Sent: den 24 september 2015 00:58
To: Aaron Falk
Cc: [email-masked]
Subject: Re: [Marnew] endpoint consent

One challenge is of course that it is already difficult for the users (or even us experts) to understand all the exact things that are going on, so providing a useful control for the users even on bandwidth may not be easy.
Let alone more complex settings.

The other issue is that we should be careful about setting the ambition level.
Fine-grained quality of service treatment has not been successful in the Internet. What's the right ambition level, being able to specify detailed bandwidth consumption rules? Or the ability to differentiate interactive from the non-interactive within one user? The more coarse grained you make this, the more likely it is that it can be used by applications and understood by users.

Jari

---

From: Aaron Falk <[email-masked]>
Date: Thu, 24 Sep 2015 07:30:48 -0400

Thinking about this a bit more last night, let me suggest that in this case
trust is transitive as long as it is explicit.  Meaning, only one endpoint
needs to be aware of the third actor but he needs to know what he is giving
up in security through that trust.  For example, it is pretty clear that a
content provider know what they are doing when they allow a CDN to use a
cert in their name (and that is also likely backed up with legal agreements
on misuse) but an end user probably doesn't understand the security
implications of installing a root cert issued by their ISP.

On Thu, Sep 24, 2015 at 6:36 AM, Salvatore Loreto <
[email-masked]> wrote:

> One challenge is of course that it is already difficult for the users (or
> even us experts) to understand all the exact things that are going on, so
> providing a useful control for the users even on bandwidth may not be easy.
> Internet. What's the right ambition level, being able to specify detailed
> from the non-interactive within one user? The more coarse grained you make
> this, the more likely it is that it can be used by applications and
> understood by users.
>
> Jari
>
>

---

From: Salvatore Loreto <[email-masked]>
Date: Thu, 24 Sep 2015 11:38:33 +0000

Indeed I agree on the transitiveness of the trust

That is why I am suggesting that if a CP trust a CDN then it should be the CDN (or the CP if there is no CDN involved) to decide explicitly if trust or not the Operator Network
If a CP / CDN believes, as I can see it is the case reading the several position papers, that the Network is in a position to provide optimization then they should find a way
to trust each other… i.e. the CP/CDN ant the Network

if we can find a simple mechanism/solution to do it then it will be a win-win situation

BR
Sal

From: Aaron Falk [mailto:[email-masked]]
Sent: den 24 september 2015 07:31
To: Salvatore Loreto
Cc: Jari Arkko; [email-masked]
Subject: Re: [Marnew] endpoint consent

Thinking about this a bit more last night, let me suggest that in this case trust is transitive as long as it is explicit.  Meaning, only one endpoint needs to be aware of the third actor but he needs to know what he is giving up in security through that trust.  For example, it is pretty clear that a content provider know what they are doing when they allow a CDN to use a cert in their name (and that is also likely backed up with legal agreements on misuse) but an end user probably doesn't understand the security implications of installing a root cert issued by their ISP.

On Thu, Sep 24, 2015 at 6:36 AM, Salvatore Loreto <[email-masked]<mailto:[email-masked]>> wrote:
To answer Aaron question if we go on this path then BOTH  endpoints MUST consent IMHO
more or less in line with the Telefonica and ALU proposals at the Sigcomm workshop on middleboxes

BR
Salvatore

-----Original Message-----
From: Marnew [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Jari Arkko
Sent: den 24 september 2015 00:58
To: Aaron Falk
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [Marnew] endpoint consent

Jari

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 24 Sep 2015 12:41:40 +0100

Hi Aaron,

On 24/09/15 12:30, Aaron Falk wrote:
>  Meaning, only one endpoint
> up in security through that trust. 

I don't think that is correct tbh, or maybe I'm confused about what
you mean.

In the scenario where a user accesses their bank account from work in
the presence of a TLS MITM operated for the employer, I think both
endpoints have valid reasons to need to know about the MITM.

Cheers,
S.

---

From: Dirk Kutscher <[email-masked]>
Date: Thu, 24 Sep 2015 11:43:58 +0000

Fully agree.

Fine-grained control, being difficult to use correctly by endpoints, seems to boil down to in-network traffic classification.

IMO, a simpler model, with the right incentives for endpoint adaptability, is more likely to see successful deployment.

Regarding the trust discussion, I'd first like to see a list of necessary functions that need to be trusted. If it's just coarse-grained traffic management and perhaps caching, there is not that much explicit consent and trust needed.

Best regards,
DIrk

-----Original Message-----
From: Marnew [mailto:[email-masked]] On Behalf Of Jari Arkko
Sent: Donnerstag, 24. September 2015 06:58
To: Aaron Falk
Cc: [email-masked]
Subject: Re: [Marnew] endpoint consent

Jari

---

From: Roland Zink <[email-masked]>
Date: Thu, 24 Sep 2015 13:52:32 +0200

I'm not so sure that web site providers know what they give up in 
security when they allow ads to be displayed on their site. I think the 
security should be seen from the end users perspective. When you allow a 
content provider to use contractors to deliver the content why not allow 
end users to give her traffic to a security / service company checking 
the traffic before delivering it to the user. This can also be backed up 
with a legal agreement on misuse.

This is however not mobile network specific although some mobile network 
operators offer such services.

Regards,
Roland

P.S. There are numerous examples of even big companies misusing the 
trust in them. Latest example probably being VW.

Am 24.09.2015 um 13:30 schrieb Aaron Falk:
> Thinking about this a bit more last night, let me suggest that in this 
> case trust is transitive as long as it is explicit.  Meaning, only one 
> endpoint needs to be aware of the third actor but he needs to know 
> what he is giving up in security through that trust.  For example, it 
> is pretty clear that a content provider know what they are doing when 
> they allow a CDN to use a cert in their name (and that is also likely 
> backed up with legal agreements on misuse) but an end user probably 
> doesn't understand the security implications of installing a root cert 
> issued by their ISP.
>
> On Thu, Sep 24, 2015 at 6:36 AM, Salvatore Loreto 
> <[email-masked] <mailto:[email-masked]>> 
> wrote:
>
>     It would be much better if we can work on a collaborative solution
>     between CP and/or CDN and the Mobile Network
>
>     BR
>     Salvatore
>
>
>     From: Marnew [mailto:[email-masked]
>     <mailto:[email-masked]>] On Behalf Of Jari Arkko
>     Cc: [email-masked] <mailto:[email-masked]>
>     One challenge is of course that it is already difficult for the
>     users (or even us experts) to understand all the exact things that
>     are going on, so providing a useful control for the users even on
>     bandwidth may not be easy.
>     Fine-grained quality of service treatment has not been successful
>     in the Internet. What's the right ambition level, being able to
>     specify detailed bandwidth consumption rules? Or the ability to
>     differentiate interactive from the non-interactive within one
>     user? The more coarse grained you make this, the more likely it is
>     that it can be used by applications and understood by users.
>
>     Jari
>
>
>
>
> [email-masked]

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 24 Sep 2015 12:48:07 +0000

>That is why I am suggesting that if a CP trust a CDN then it should be the CDN (or the CP if there is no CDN involved) to decide explicitly if trust or not the Operator Network

Perhaps.  It depends on the business agreement between the CP and the CDN; sometimes yes, sometimes no.
--  
Senior Architect, Akamai Technologies
IM: [email-masked] Twitter: RichSalz

---

From: Ca By <[email-masked]>
Date: Thu, 24 Sep 2015 05:58:38 -0700

On Wednesday, September 23, 2015, Jari Arkko <[email-masked]> wrote:

> even us experts)

+1 for simplicity

In the last few years i have made my mobile network free of middle boxes
for the majority of traffic.

There is no proxy, there is no firewall, and there is no nat for most
packets. These things have been removed as we have scaled up and i hate to
see folks in an iab meeting codify having these things stay in place like
they cannot be removed.

CB

---

From: "Songhaibin (A)" <[email-masked]>
Date: Fri, 25 Sep 2015 06:13:36 +0000

Agree. It depends on the use case.

Best Regards!
-Haibin

> From: Marnew [mailto:[email-masked]] On Behalf Of Stephen Farrell
> Sent: Thursday, September 24, 2015 7:42 PM
> To: Aaron Falk; Salvatore Loreto
> > needs to be aware of the third actor but he needs to know what he is
> > giving up in security through that trust.
> 
> I don't think that is correct tbh, or maybe I'm confused about what you mean.
> 
> In the scenario where a user accesses their bank account from work in the
> presence of a TLS MITM operated for the employer, I think both endpoints have
> valid reasons to need to know about the MITM.
> 
> Cheers,
> S.
>