Subject: Re: [Tzdist-bis] draft-murchison-tzdist-geolocate-02.txt

From: Ken Murchison <[email-masked]>
Date: Fri, 9 Nov 2018 15:23:02 -0500

On 9/25/18 10:57 AM, Eliot Lear wrote:

> Just as a first order pass, I will say that I think the security and 
> privacy considerations are not sufficient, from my own personal point 
> of view.  It is one thing to ask for TZ information.  That is highly 
> fuzzed information and limits the damage an attacker can do.  However, 
> precise geo-location information is more of an issue.  An attacker can 
> precisely determine where someone is, and perhaps as importantly where 
> someone is not.  "Eliot's not at home... let's break in".
>
> I would therefore make two changes:
>
>  1. REQUIRE that TLS be used by clients in these circumstances.
>  2. RECOMMEND that clients that have a means to do so provide the
>     ability to turn off such retrieval.
>

I'm thinking that use of this extension falls under GEOPRIV (RFC 3693).  
I'm trying to digest that spec and see where TZDIST+geolocate fits.  If 
anyone has experience with the GEOPRIV requirements, I would gladly 
accept some suggested text.

> On 25.09.18 08:36, Eliot Lear wrote:
>> Hi everyone,
>>
>> Now that the tzif draft is well on its way to being finished, it's time
>> to pick up on draft-murchison-tzdist-geolocate-02.txt.  Can I ask people
>> to give a good scan of this?  It's been pointed out that the draft
>> should undergo a privacy review.  I will arrange for that in due
>> course.  I will also post my review of the draft in the next few weeks.
>>
>> Eliot
>>
>>
>>
>>
>> _______________________________________________
>> Tzdist-bis mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/tzdist-bis
>
>
> _______________________________________________
> Tzdist-bis mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tzdist-bis

-- 
Ken Murchison
Cyrus Development Team
FastMail US LLC