Subject: [Tzdist-bis] draft-murchison-tzdist-geolocate-02.txt

From: Eliot Lear <[email-masked]>
Date: Tue, 25 Sep 2018 08:36:19 +0200

Hi everyone,

Now that the tzif draft is well on its way to being finished, it's time
to pick up on draft-murchison-tzdist-geolocate-02.txt.  Can I ask people
to give a good scan of this?  It's been pointed out that the draft
should undergo a privacy review.  I will arrange for that in due
course.  I will also post my review of the draft in the next few weeks.

Eliot

---

From: Eliot Lear <[email-masked]>
Date: Tue, 25 Sep 2018 16:57:54 +0200

Just as a first order pass, I will say that I think the security and
privacy considerations are not sufficient, from my own personal point of
view.  It is one thing to ask for TZ information.  That is highly fuzzed
information and limits the damage an attacker can do.  However, precise
geo-location information is more of an issue.  An attacker can precisely
determine where someone is, and perhaps as importantly where someone is
not.  "Eliot's not at home... let's break in".

I would therefore make two changes:

 1. REQUIRE that TLS be used by clients in these circumstances.
 2. RECOMMEND that clients that have a means to do so provide the
    ability to turn off such retrieval.

Eliot

On 25.09.18 08:36, Eliot Lear wrote:
> _______________________________________________
> Tzdist-bis mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tzdist-bis