Subject: draft-farrell-perpass-attack

From: Stephen Farrell <[email-masked]>
Date: Wed, 11 Dec 2013 21:38:35 +0000

Hi all,

Dave Crocker's note on this to the IETF list today made
me realise that there'd been no discussion of this
draft [1] on this list.

I'd be really interested in seeing more WG chair feedback
on this proposed BCP. If its approved it'll mean that some
of your WGs will sometimes have to do more work to determine
if and how pervasive monitoring is relevant for your WG
and if so what to do about that. Hopefully that'll result
in better outcomes and so will be worthwhile.

Personally I think its it'll be a really good thing for
our WGs to do that, but your feedback requested, and any
from your WGs if you can drag that out of them:-)

Since this is in IETF LC commenting on [email-masked] is
best.

Thanks,
S.

[1] http://tools.ietf.org/html/draft-farrell-perpass-attack

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 12 Dec 2013 11:16:47 +1100

As many have said, getting the tradeoffs right is going to be the hard part, but I don't see how any more detail in this document could realistically help.

Do you see impact on expectations for Security Considerations? If so, it might be good to come out and say so.

Cheers,

--
Mark Nottingham   http://www.mnot.net/

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 12 Dec 2013 00:36:55 +0000

On 12/12/2013 12:16 AM, Mark Nottingham wrote:
> As many have said, getting the tradeoffs right is going to be the
> hard part, but I don't see how any more detail in this document could
> realistically help.

Good to hear you think its at the right level.

> it might be good to come out and say so.

Well, funnily enough I was just looking at RFC 3552/BCP 72
(the one with guidance on security considerations, and yes
I should get a life;-) which has a whole bunch of MUSTs we
routinely to ubiquitously ignore. I'm not sure we should
add to those. (Scroll down a bit from [1] for examples.)

In practice, I'd hope authors, chairs, reviewers and
ADs will consider this threat, but probably with our
usual distribution of spottiness/thoroughness, so it'll
be reflected in folks' security considerations text
and comments they get I'd say.

I'd hope we might learn more as we go and produce some
guidance RFC (with no MUSTs:-) later on.

S.

[1] http://tools.ietf.org/html/rfc3552#section-5

>> Dave Crocker's note on this to the IETF list today made me realise
>> that there'd been no discussion of this draft [1] on this list.
>> 
>> I'd be really interested in seeing more WG chair feedback on this
>> proposed BCP. If its approved it'll mean that some of your WGs will
>> sometimes have to do more work to determine if and how pervasive
>> monitoring is relevant for your WG and if so what to do about that.
>> Hopefully that'll result in better outcomes and so will be
>> worthwhile.
>> 
>> Personally I think its it'll be a really good thing for our WGs to
>> do that, but your feedback requested, and any from your WGs if you
>> can drag that out of them:-)
>> 
>> Since this is in IETF LC commenting on [email-masked] is best.
>> 
>> Thanks, S.
>> 
> -- Mark Nottingham   http://www.mnot.net/
> 
> 
> 
> 
>

---

From: Alexandru Petrescu <[email-masked]>
Date: Thu, 12 Dec 2013 11:00:44 +0100

Hi,

I am here just visiting for a while, but I assisted at the last
presentation at the Chair lunch in Vancouver, about privacy and
addressing.  There was a comment at the microphone to which I agree.

It said something about the number of happy cases of identifying 
criminal activity by using IP address leads.

draft says:
> The motivation behind pervasive monitoring is not relevant for this
> document, but can range from non-targeted nation-state surveillance,
> to legal but privacy-unfriendly purposes by commercial enterprises,
> to illegal purposes by criminals

Add something like : "This excludes legal interception."

I am suggesting it because the word 'legal' _is_ used in the paragraph, 
although not clear to my reading.  I may be wrong though.

Alex

Le 11/12/2013 22:38, Stephen Farrell a écrit :
> Personally I think its it'll be a really good thing for our WGs to do
> that, but your feedback requested, and any from your WGs if you can
> drag that out of them:-)
>
> _______________________________________________ BOFChairs mailing
> list [email-masked]
> https://www.ietf.org/mailman/listinfo/bofchairs
>
>