Subject: Re: [sacm] [sacmwg/draft-ietf-sacm-information-model] remove the terms identification, identity, identifying (#21)

From: Danny Haynes <[email-masked]>
Date: Thu, 06 Apr 2017 06:40:59 -0700

The majority of the uses of "identification", "identity", and "identifying" are with respect to endpoint identifiers, component identifiers, labels unique to a SACM domain, a set of attributes used to identify endpoints, and identifiers for actual endpoint attributes all of which are expected to be defined by, or under the control of the organization that owns the network. Given that, I think I agree with others that have posted thoughts on this issue and that it is acceptable to use these terms since they best describe what we are talking about and because we cover the privacy concerns in the Privacy Considerations section.

As a result, I would like to propose that we close this issue. What do others think?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/21#issuecomment-292177837

---

From: Henk Birkholz <[email-masked]>
Date: Thu, 06 Apr 2017 08:14:39 -0700

Are there explicit pointers to the referenced thoughts posted?

Although the term identity allows for "Group identities", the SACM WG wants to refer to a specific target endpoint. If there is a NEA client or SACM component located on that target endpoint that is not a complicated task (assuming that that software component can provide guaranties about its authenticity). If a target endpoint is not "owned" by the domain, observation and profiling and resulting target endpoint characterization record might be the only way to refer to that target endpoint in the end.

I.e., keeping track of target endpoints that you "do not own" can be very privacy sensitive. In consequence, I would propose to refrain from using the terms identification and identity at least in that context ("not owned by you"). We should quickly create consensus in regard to this topic. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/21#issuecomment-292206358

---

From: Danny Haynes <[email-masked]>
Date: Thu, 06 Apr 2017 08:23:16 -0700

Yes the referenced thoughts are here https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/26. 

Yes, if they endpoints are not owned by the organization, they can be privacy sensitive. With that said, you typically need to agree to some terms of use, which may permit monitoring and tracking, in order to have access to the network. With this in mind, wouldn't it be ok as long as we provide the necessary mechanisms to support privacy that aligns with the organization's policies and network terms of use?  

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/21#issuecomment-292208990

---

From: Henk Birkholz <[email-masked]>
Date: Thu, 06 Apr 2017 08:38:03 -0700

Thank you for the pointer.

I will not be the show stopper here, but would like to add that every vendor that contributed to SACM at some point was in favor to avoid the terms identity and identification (as a result (identifying) attributes are aggregated in a TE characterization record that can be matched with classification profiles). I am okay with keeping text simple and conclusive and not to "make the process of thinking about the document harder".

We have to make sure that identification is not a gateway/step towards to track individuals.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/21#issuecomment-292213678

---

From: Danny Haynes <[email-masked]>
Date: Mon, 10 Apr 2017 06:27:38 -0700

Neither will I if people really want to change the terms :). I was just thinking that given our other work items, this one might not be that important at this point especially given the feedback I saw in the thread. With that said, we could also just defer this and leave it as an item to clean up at a later time when we get closer to publication.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/21#issuecomment-292948857