Subject: [rrg] Tussle: anonymity vs reachability

From: RJ Atkinson <[email-masked]>
Date: Mon, 26 Jul 2010 09:24:38 -0400

I agree with Tony Li and others who believe that there is a
fundamental tussle between anonymity and reachability.

Since this is a fundamental tussle, rather than being specific
to any particular technology, a human example using ordinary
mail (not email) suffices.

(TOTALLY ANONYMOUS/PRIVATE/HIDDEN)

If one wants to be totally anonymous, then no one knows who one
is or where one really is located.  If a family member wanted
to send an anonymous person a parcel or letter, it would be
impossible because they would not know where to send the 
parcel or letter -- and would not know which name that person
was using at that moment in time.

(PARTLY ANONYMOUS)

If one wants to be partially reachable, then at least the
sender of the parcel/letter needs to know what the destination
address should be for the envelope or shipping label.  Also,
the delivery firm (or the government post office if one is
using the post) needs to know how to forward the letter or
parcel to that written destination address, including the
precise last-hop delivery route.  If one uses the now largely
disused "poste restante"/"general delivery" scheme, then the 
post office needs to know which post office to deliver the 
letter/parcel to, and the human trying to retrieve the letter
or parcel will need to provide a name for the post office
to look for within the "general delivery" mail bin, and the
post office might ask for some form of identification that
the person asking for the mail is in fact that name.  In this
case, one has partial anonymity (or perhaps partial location hiding),
but it is very far from being totally anonymous and hidden.

(GENERALLY REACHABLE)

If one wants to be more generally reachable, one is often
listed publicly somewhere, perhaps in a telephone directory
with a house number, street/road, and city.  In this case,
people wanting to send letters/parcels can look up the address
and send the letter or parcel via some delivery method.  
However, in this case one does not have significant amount
of privacy.

Various other intermediate degrees of anonymity vs reachability
exist.  I'm just using 3 examples to illustrate the tradeoff here.

[NB: I don't list "totally reachable", because for many people
that just isn't possible.  For example, some countries do not
exchange postal mail or parcels.  Also, in some countries
there aren't any reasonably reliable delivery methods to certain 
places [especially very rural places like a wilderness].  Also,
tragically, there is fighting from time to time in various
places and that often prevents letters or parcels from being
delivered.]

There really is a fundamental tussle here.  Different people
fall in different places on the above continuum -- trading off
varying degrees of privacy/anonymity/hiding with varying
degrees of reachability.

Yours,

Ran

PS:  I suspect the Internet equivalent for "generally reachable"
might be:
	- has a unique fully-qualified domain-name
	- that domain-name is published publicly
	- that domain-name has one or more reachability
	  data associated with it (e.g. DNS A records)
	- the reachability data is reasonably accurate and
	  reasonably stable
	- an actual usable path exists between sender and
	  the delivery location indicated by the reachability data

EOF

---

From: William Herrin <[email-masked]>
Date: Mon, 26 Jul 2010 06:33:24 -1000

> fundamental tussle between anonymity and reachability.

Then the smart move is to represent the tussel in the protocol so that
it can be decided at run time by the user rather than by us in the
protocol design.

Regards,
Bill Herrin

-- 
William D. Herrin ................ [email-masked]  [email-masked]
3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004

---

From: Scott Brim <[email-masked]>
Date: Mon, 26 Jul 2010 18:58:43 +0200

On 07/26/2010 18:33 GMT+02:00, William Herrin wrote:
> On Mon, Jul 26, 2010 at 3:24 AM, RJ Atkinson<[email-masked]>  wrote:

I missed Ran's message, but found it in the archives ...

Yes, the end user must be empowered.  IMHO this isn't a tussle at all in 
the real world.  Government policy and laws, if nothing else, will 
require that people not be required to reveal even their general 
location in order to communicate at all, particularly if others can find 
out their location and track them without their knowledge.  If nothing 
else, knowing someone was at a medical facility, or knowing someone is 
on vacation so you can rob them.  Or: "I know where you were last night, 
and unless you pay me I'm going to tell your wife/husband", where the 
victim can't even determine if the claim is true!  Regardless of what we 
might think technically, not being able to cloak your location at all 
will not work in the real world.  Using a data plane rendezvous point 
(HIP proxy, MIP HA, etc.) allows the ultimate user or representative to 
decide how much to reveal and how much not to.  This has to be the 
engineered default.

This could be used with ILNP.  ILNP doesn't require the optimizations 
that have been proposed.

BTW this isn't really about IP routing and forwarding, which are to get 
IP packets between endpoints specified at the IP layer.  This is about 
how those IP endpoints are determined, and one of the endpoints might 
not be an endpoint for the higher layer, just for IP.  As an example see 
the SMTP server mesh.

And looking at Ran's mail ... I get packages delivered to me all the 
time without revealing even the domain I'm in.  They get sent to my 
department, where they are "encapsulated" (new label stuck on the 
outside) and shipped to me.  We "pay for shipping" twice, but for 
correspondents that I rarely interact with, and only for short times, 
this is less effort than going through the overhead of optimizing the path.

Scott

---

From: RJ Atkinson <[email-masked]>
Date: Mon, 26 Jul 2010 17:24:07 -0400

> it can be decided at run time by the user rather than by us in the

ILNP does this.

ILNP *allows* the use of either global-scope or local-scope IDs, 
*allows* the use of arbitrary numbers of local-scope IDs at the
same time, and allows existing mechanisms (e.g. IPv6 privacy 
auto-configuration extensions) to be use if desired.

Ran

---

From: RJ Atkinson <[email-masked]>
Date: Mon, 26 Jul 2010 17:30:27 -0400

On 26  Jul 2010, at 12:58 , Scott Brim wrote:
> Yes, the end user must be empowered.  IMHO this isn't a tussle at all in the real world.  Government policy and laws, if nothing else, will require that people not be required to reveal even their general location in order to communicate at all, particularly if others can find out their location and track them without their knowledge.

There is also a personal tussle whether one chooses to reveal
more (or less) about oneself on some particular occasion.

Good architecture enables users to make those tradeoffs.

> And looking at Ran's mail ... I get packages delivered to me all the time without revealing even the domain I'm in.  They get sent to my department, where they are "encapsulated" (new label stuck on the outside) and shipped to me.  We "pay for shipping" twice, but for correspondents that I rarely interact with, and only for short times, this is less effort than going through the overhead of optimizing the path.

In your (IMHO: good) example, you reveal information to your 
"department" that you don't reveal to other folks.  Various kinds 
of existing Internet-related proxies do similar functions.

Again, there is a tradeoff here with costs (e.g. shipping costs 
increase, routing is sub-optimal and a bit delayed) and 
perceived benefits (e.g. reduction in effort, some degree of 
privacy/hiding).  

Good architecture enables users to make choices about those
tradeoffs.

I think it likely that different users will make different
choices at different times.

Cheers,

Ran

---

From: Scott W Brim <[email-masked]>
Date: Mon, 26 Jul 2010 23:40:31 +0200

On Mon, Jul 26, 2010 at 11:30 PM, RJ Atkinson <[email-masked]> wrote:

> the real world.  Government policy and laws, if nothing else, will require
> that people not be required to reveal even their general location in order
> to communicate at all, particularly if others can find out their location
> and track them without their knowledge.
>

Yes, and which is the common case?  If all initial contact goes through a
rendezvous point in the data plane, then you can reveal a location at any
time, based on information you gather (you don't have to guess what their
intent is, like you do with caller ID on your phone).  Also you can reveal
different locations to different callers using higher layer protocols, for
example SIP redirect once you complete setup, but redirecting different
people in different directions -- revealing what you wish.

> of existing Internet-related proxies do similar functions.

Right, you need an agent, and you have to trust the agent.

> perceived benefits (e.g. reduction in effort, some degree of

Yup :)

> choices at different times.

Yes.  My point is that "cloaking" should not be engineered as a rare,
inefficient attachment to the Internet protocol system.  It's going to end
up being the majority case.  There will always be a way for people to
advertise everything about themselves by short-cutting that.

> Ran
We're in the Netherlands, make sure you pronounce that right :-)

Scott