From nobody Tue Oct 28 21:07:33 2014 Return-Path: X-Original-To: hiaps@ietfa.amsl.com Delivered-To: hiaps@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B9C581A6FB5 for ; Tue, 28 Oct 2014 21:07:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3znp6ryKzN77 for ; Tue, 28 Oct 2014 21:07:27 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 566F81A6FB9 for ; Tue, 28 Oct 2014 21:06:21 -0700 (PDT) Received: from mb-aye.local (c-67-188-0-113.hsd1.ca.comcast.net [67.188.0.113]) (authenticated bits=0) by nagasaki.bogus.com (8.14.9/8.14.9) with ESMTP id s9T46KsN089351 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT) for ; Wed, 29 Oct 2014 04:06:21 GMT (envelope-from joelja@bogus.com) Message-ID: <545067B6.4020704@bogus.com> Date: Tue, 28 Oct 2014 21:06:14 -0700 From: joel jaeggli User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:33.0) Gecko/20100101 Thunderbird/33.0 MIME-Version: 1.0 To: "hiaps@ietf.org" Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="Q3QTChSFXpkQt4Ial8GsNsBXELhac5TKx" Archived-At: http://mailarchive.ietf.org/arch/msg/hiaps/tns99dqgaby4c0gDkL2MRMWhoQY Subject: [hiaps] some discussion in the press... X-BeenThere: hiaps@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Host Identification, Address and Prefix Sharing in Wi-Fi Access \(hiaps\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Oct 2014 04:07:30 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Q3QTChSFXpkQt4Ial8GsNsBXELhac5TKx Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable this is pretty much exactly what I would have expected from injection on the wire of an identity token... http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works/ http://www.wired.com/2014/10/verizons-perma-cookie/ http://www.forbes.com/sites/kashmirhill/2014/10/28/att-says-its-testing-u= nkillable-tracker-on-customers-smartphones/ --Q3QTChSFXpkQt4Ial8GsNsBXELhac5TKx Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAlRQZ7cACgkQ8AA1q7Z/VrLBuACgiGMTT2cJJL5ehLd/ONvx7b9K UBEAn0hRoYXZK8/b06chWL90LIaUmAeP =+awB -----END PGP SIGNATURE----- --Q3QTChSFXpkQt4Ial8GsNsBXELhac5TKx-- From nobody Wed Oct 29 06:20:29 2014 Return-Path: X-Original-To: hiaps@ietfa.amsl.com Delivered-To: hiaps@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B7C071A00C5 for ; Wed, 29 Oct 2014 06:20:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CHZV4hj6T0YR for ; Wed, 29 Oct 2014 06:20:16 -0700 (PDT) Received: from relais-inet.francetelecom.com (relais-ias243.francetelecom.com [80.12.204.243]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D9F731A0095 for ; Wed, 29 Oct 2014 06:20:15 -0700 (PDT) Received: from omfeda05.si.francetelecom.fr (unknown [xx.xx.xx.198]) by omfeda09.si.francetelecom.fr (ESMTP service) with ESMTP id AD130C05FC; Wed, 29 Oct 2014 14:20:11 +0100 (CET) Received: from Exchangemail-eme2.itn.ftgroup (unknown [10.114.31.5]) by omfeda05.si.francetelecom.fr (ESMTP service) with ESMTP id 199F11800DA; Wed, 29 Oct 2014 14:19:57 +0100 (CET) Received: from OPEXCLILM23.corporate.adroot.infra.ftgroup ([169.254.2.110]) by OPEXCLILH01.corporate.adroot.infra.ftgroup ([::1]) with mapi id 14.03.0195.001; Wed, 29 Oct 2014 14:19:56 +0100 From: To: joel jaeggli Thread-Topic: [hiaps] some discussion in the press... Thread-Index: AQHP8y3gUuvbzcRrbkCsQ6vy9UkoCJxHDA7w Date: Wed, 29 Oct 2014 13:19:56 +0000 Message-ID: <787AE7BB302AE849A7480A190F8B93301C0943@OPEXCLILM23.corporate.adroot.infra.ftgroup> References: <545067B6.4020704@bogus.com> In-Reply-To: <545067B6.4020704@bogus.com> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.168.234.5] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-PMX-Version: 6.0.3.2322014, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2014.10.23.30920 Archived-At: http://mailarchive.ietf.org/arch/msg/hiaps/cigcU9_S7rEkCQFAcguBzE8nuNY Cc: "hiaps@ietf.org" Subject: Re: [hiaps] some discussion in the press... X-BeenThere: hiaps@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Host Identification, Address and Prefix Sharing in Wi-Fi Access \(hiaps\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Oct 2014 13:20:23 -0000 SGkgSm9lbCwNCg0KVGhhbmsgeW91IGZvciBzaGFyaW5nIHRoaXMgaW5mb3JtYXRpb24uIA0KDQpU aGUgaG9zdF9pZCBlZmZvcnQgZG9lcyBub3QgYWltIHRvIGluamVjdCBnbG9iYWxseSB1bmlxdWUv c3RhYmxlIGlkZW50aWZpZXIgYnV0IHRvIHByb3ZpZGUgdGhlIHNhbWUgaW5mb3JtYXRpb24gdGhh dCB3b3VsZCBiZSBjb252ZXllZCBpbiB0aGUgc291cmNlIElQIGFkZHJlc3MuDQoNClRoZXJlIGFy ZSBhbHJlYWR5IHNvbWUgYXBwbGljYXRpb25zIHRoYXQgaW5qZWN0IHRoZSBNU0lTRE4gdXNpbmcg c29tZSBub24tc3RhbmRhcmQgSFRUUCBoZWFkZXJzIChlLmcuLCBIVFRQX1hfVVBfQ0FMTElOR19M SU5FX0lEKSB0byByZXZlYWwgdGhlIHBob25lIG51bWJlci4gVXNlciBjYW4gdXNlIHNlcnZpY2Vz IChlLmcuLCBodHRwOi8vd3d3Lm11bGxpbmVyLm9yZy9wYy5jZ2kpIHRvIGNoZWNrIHdoZXRoZXIg dGhlaXIgcGhvbmUgbnVtYmVyIGlzIHJldmVhbGVkIG9yIG5vdC4NCg0KSSBmdWxseSBhZ3JlZSB0 aGF0IGxlYWtpbmcgZ2xvYmFsbHkgdW5pcXVlIGluZm9ybWF0aW9uIGluIGFwcGxpY2F0aW9uIG1l c3NhZ2UgcGF5bG9hZHMgbXVzdCBiZSBjb250cm9sbGVkOyBvdGhlcndpc2UgdGhpcyBjYW4gYmUg dXNlZCBmb3IgdXNlciB0cmFja2luZzogQW4gSVAgYWRkcmVzcyBtYXkgY2hhbmdlIHdoZW4gcmVj b25uZWN0aW5nIHdoaWxlIHRoZSBNU0lTRE4gaXMgYSBzdGFibGUgaWRlbnRpZmllci4gDQoNCkRv Y3VtZW50aW5nIG1pcy11c2VzIG9mIGluamVjdGluZyB1bmlxdWUgYW5kIHN0YWJsZSBpZGVudGlm aWVycyBpcyBzdGlsbCBuZWVkZWQgdG8gc29jaWFsaXplIHN1Y2ggcHJhY3RpY2VzIGFuZCBhbHNv IHRvIGJlIGF3YXJlIG9mIHRoZWlyIHNpZGUgZWZmZWN0cy4NCg0KQ2hlZXJzLA0KTWVkDQoNCi0t LS0tTWVzc2FnZSBkJ29yaWdpbmUtLS0tLQ0KRGXCoDogaGlhcHMgW21haWx0bzpoaWFwcy1ib3Vu Y2VzQGlldGYub3JnXSBEZSBsYSBwYXJ0IGRlIGpvZWwgamFlZ2dsaQ0KRW52b3nDqcKgOiBtZXJj cmVkaSAyOSBvY3RvYnJlIDIwMTQgMDU6MDYNCsOAwqA6IGhpYXBzQGlldGYub3JnDQpPYmpldMKg OiBbaGlhcHNdIHNvbWUgZGlzY3Vzc2lvbiBpbiB0aGUgcHJlc3MuLi4NCg0KdGhpcyBpcyBwcmV0 dHkgbXVjaCBleGFjdGx5IHdoYXQgSSB3b3VsZCBoYXZlIGV4cGVjdGVkIGZyb20gaW5qZWN0aW9u IG9uDQp0aGUgd2lyZSBvZiBhbiBpZGVudGl0eSB0b2tlbi4uLg0KDQpodHRwOi8vd2VicG9saWN5 Lm9yZy8yMDE0LzEwLzI0L2hvdy12ZXJpem9ucy1hZHZlcnRpc2luZy1oZWFkZXItd29ya3MvDQoN Cmh0dHA6Ly93d3cud2lyZWQuY29tLzIwMTQvMTAvdmVyaXpvbnMtcGVybWEtY29va2llLw0KDQpo dHRwOi8vd3d3LmZvcmJlcy5jb20vc2l0ZXMva2FzaG1pcmhpbGwvMjAxNC8xMC8yOC9hdHQtc2F5 cy1pdHMtdGVzdGluZy11bmtpbGxhYmxlLXRyYWNrZXItb24tY3VzdG9tZXJzLXNtYXJ0cGhvbmVz Lw0KDQo= From nobody Wed Oct 29 06:55:03 2014 Return-Path: X-Original-To: hiaps@ietfa.amsl.com Delivered-To: hiaps@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 867301A00F9 for ; Wed, 29 Oct 2014 06:55:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a-QIjMnbmK-H for ; Wed, 29 Oct 2014 06:54:59 -0700 (PDT) Received: from prod-mail-xrelay02.akamai.com (prod-mail-xrelay02.akamai.com [72.246.2.14]) by ietfa.amsl.com (Postfix) with ESMTP id 5E5A81A00C5 for ; Wed, 29 Oct 2014 06:54:59 -0700 (PDT) Received: from prod-mail-xrelay02.akamai.com (localhost [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id A8A0A2850E; Wed, 29 Oct 2014 13:54:58 +0000 (GMT) Received: from prod-mail-relay07.akamai.com (prod-mail-relay07.akamai.com [172.17.121.112]) by prod-mail-xrelay02.akamai.com (Postfix) with ESMTP id 95EE2284FD; Wed, 29 Oct 2014 13:54:58 +0000 (GMT) Received: from [172.28.115.172] (bowill.kendall.corp.akamai.com [172.28.115.172]) by prod-mail-relay07.akamai.com (Postfix) with ESMTP id 7E9F580044; Wed, 29 Oct 2014 13:54:58 +0000 (GMT) Message-ID: <5450F1B2.9070604@akamai.com> Date: Wed, 29 Oct 2014 09:54:58 -0400 From: Brandon Williams User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0 MIME-Version: 1.0 To: joel jaeggli , "hiaps@ietf.org" References: <545067B6.4020704@bogus.com> In-Reply-To: <545067B6.4020704@bogus.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/hiaps/_1F1mlUcLWNFptvEuyYDaJ3blD8 Subject: Re: [hiaps] some discussion in the press... X-BeenThere: hiaps@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Host Identification, Address and Prefix Sharing in Wi-Fi Access \(hiaps\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Oct 2014 13:55:01 -0000 Agreed. Inserting a publicly visible user identifier is a bad idea. That's why all the proposals that have come from people on the hiaps list (to the best of my knowledge) have focused on relaying _host_ identifiers that are already publicly visible (generally the public IP address) through to the other side of middleboxes that are hiding such publicly visible identifiers. If there are proposals out there that violate this principle, I agree entirely that they should be abandoned. --Brandon On 10/29/2014 12:06 AM, joel jaeggli wrote: > this is pretty much exactly what I would have expected from injection on > the wire of an identity token... > > http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works/ > > http://www.wired.com/2014/10/verizons-perma-cookie/ > > http://www.forbes.com/sites/kashmirhill/2014/10/28/att-says-its-testing-unkillable-tracker-on-customers-smartphones/ > -- Brandon Williams; Senior Principal Software Engineer Emerging Products Engineering; Akamai Technologies Inc. From nobody Wed Oct 29 07:10:58 2014 Return-Path: X-Original-To: hiaps@ietfa.amsl.com Delivered-To: hiaps@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD50E1A0113 for ; Wed, 29 Oct 2014 07:10:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 37vXrR8cE1Gz for ; Wed, 29 Oct 2014 07:10:45 -0700 (PDT) Received: from relais-inet.francetelecom.com (relais-ias91.francetelecom.com [193.251.215.91]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 986931A00EF for ; Wed, 29 Oct 2014 07:10:45 -0700 (PDT) Received: from omfedm08.si.francetelecom.fr (unknown [xx.xx.xx.4]) by omfedm14.si.francetelecom.fr (ESMTP service) with ESMTP id B9C8422C5A6; Wed, 29 Oct 2014 15:10:43 +0100 (CET) Received: from Exchangemail-eme2.itn.ftgroup (unknown [10.114.31.56]) by omfedm08.si.francetelecom.fr (ESMTP service) with ESMTP id 76DC42380DD; Wed, 29 Oct 2014 15:10:43 +0100 (CET) Received: from OPEXCLILM23.corporate.adroot.infra.ftgroup ([169.254.2.110]) by OPEXCLILH04.corporate.adroot.infra.ftgroup ([10.114.31.56]) with mapi id 14.03.0195.001; Wed, 29 Oct 2014 15:10:42 +0100 From: To: Brandon Williams , joel jaeggli , "hiaps@ietf.org" Thread-Topic: [hiaps] some discussion in the press... Thread-Index: AQHP83/y+TmvdiB4jEiuLHscxl0+cpxHG5vw Date: Wed, 29 Oct 2014 14:10:41 +0000 Message-ID: <787AE7BB302AE849A7480A190F8B93301C0A81@OPEXCLILM23.corporate.adroot.infra.ftgroup> References: <545067B6.4020704@bogus.com> <5450F1B2.9070604@akamai.com> In-Reply-To: <5450F1B2.9070604@akamai.com> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.168.234.5] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-PMX-Version: 6.0.3.2322014, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2014.10.23.100020 Archived-At: http://mailarchive.ietf.org/arch/msg/hiaps/oFJxbP2ype60nNNM_VXxTTYG9Dw Subject: Re: [hiaps] some discussion in the press... X-BeenThere: hiaps@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Host Identification, Address and Prefix Sharing in Wi-Fi Access \(hiaps\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Oct 2014 14:10:56 -0000 Hi Brian, I echo your comment.=20 None of the proposals inventoried in the HOST_ID effort is trying to do the= same thing as X-UIDH header. Moreover, none of these proposals is endorsin= g the following headers (but not limited to) nor aims at revealing a custom= er ID, account ID, profile ID, etc.:=20 HTTP_MSISDN, HTTP_X_MSISDN, HTTP_X_UP_CALLING_LINE_ID, HTTP_X_NOKIA_MSISDN, HTTP_X_HTS_CLID, HTTP_X_MSP_CLID, HTTP_X_NX_CLID, HTTP__RAPMIN, HTTP_X_WAP_MSISDN, HTTP_COOKIE, HTTP_X_UP_LSID, HTTP_X_H3G_MSISDN, HTTP_X_JINNY_CID, HTTP_X_NETWORK_INFO, ... Cheers, Med -----Message d'origine----- De=A0: hiaps [mailto:hiaps-bounces@ietf.org] De la part de Brandon Williams Envoy=E9=A0: mercredi 29 octobre 2014 14:55 =C0=A0: joel jaeggli; hiaps@ietf.org Objet=A0: Re: [hiaps] some discussion in the press... Agreed. Inserting a publicly visible user identifier is a bad idea.=20 That's why all the proposals that have come from people on the hiaps=20 list (to the best of my knowledge) have focused on relaying _host_=20 identifiers that are already publicly visible (generally the public IP=20 address) through to the other side of middleboxes that are hiding such=20 publicly visible identifiers. If there are proposals out there that=20 violate this principle, I agree entirely that they should be abandoned. --Brandon On 10/29/2014 12:06 AM, joel jaeggli wrote: > this is pretty much exactly what I would have expected from injection on > the wire of an identity token... > > http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works/ > > http://www.wired.com/2014/10/verizons-perma-cookie/ > > http://www.forbes.com/sites/kashmirhill/2014/10/28/att-says-its-testing-u= nkillable-tracker-on-customers-smartphones/ > --=20 Brandon Williams; Senior Principal Software Engineer Emerging Products Engineering; Akamai Technologies Inc. _______________________________________________ hiaps mailing list hiaps@ietf.org https://www.ietf.org/mailman/listinfo/hiaps From nobody Wed Oct 29 08:00:06 2014 Return-Path: X-Original-To: hiaps@ietfa.amsl.com Delivered-To: hiaps@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8273F1A00F9 for ; Wed, 29 Oct 2014 08:00:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KzyndsJ6xIho for ; Wed, 29 Oct 2014 07:59:56 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8FD951A0191 for ; Wed, 29 Oct 2014 07:59:56 -0700 (PDT) Received: from [192.168.43.134] ([172.56.39.54]) (authenticated bits=0) by nagasaki.bogus.com (8.14.9/8.14.9) with ESMTP id s9TExGXP092275 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Wed, 29 Oct 2014 14:59:37 GMT (envelope-from joelja@bogus.com) Message-ID: <545100BE.7090604@bogus.com> Date: Wed, 29 Oct 2014 07:59:10 -0700 From: joel jaeggli User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:33.0) Gecko/20100101 Thunderbird/33.0 MIME-Version: 1.0 To: mohamed.boucadair@orange.com, Brandon Williams , "hiaps@ietf.org" References: <545067B6.4020704@bogus.com> <5450F1B2.9070604@akamai.com> <787AE7BB302AE849A7480A190F8B93301C0A81@OPEXCLILM23.corporate.adroot.infra.ftgroup> In-Reply-To: <787AE7BB302AE849A7480A190F8B93301C0A81@OPEXCLILM23.corporate.adroot.infra.ftgroup> Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="eDvjrAInCaU37ws6ekpI4A1vD8bQLBIih" Archived-At: http://mailarchive.ietf.org/arch/msg/hiaps/JaHvxlEHsgrUkn8UMaDOihXR0jc Subject: Re: [hiaps] some discussion in the press... X-BeenThere: hiaps@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Host Identification, Address and Prefix Sharing in Wi-Fi Access \(hiaps\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Oct 2014 15:00:03 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --eDvjrAInCaU37ws6ekpI4A1vD8bQLBIih Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 10/29/14 7:10 AM, mohamed.boucadair@orange.com wrote: > Hi Brian, >=20 > I echo your comment.=20 >=20 > None of the proposals inventoried in the HOST_ID effort is trying to do= the same thing as X-UIDH header. Moreover, none of these proposals is en= dorsing the following headers (but not limited to) nor aims at revealing = a customer ID, account ID, profile ID, etc.:=20 >=20 > HTTP_MSISDN, HTTP_X_MSISDN, HTTP_X_UP_CALLING_LINE_ID, > HTTP_X_NOKIA_MSISDN, HTTP_X_HTS_CLID, HTTP_X_MSP_CLID, > HTTP_X_NX_CLID, HTTP__RAPMIN, HTTP_X_WAP_MSISDN, > HTTP_COOKIE, HTTP_X_UP_LSID, HTTP_X_H3G_MSISDN, > HTTP_X_JINNY_CID, HTTP_X_NETWORK_INFO, ... >=20 > Cheers, > Med >=20 > -----Message d'origine----- > De : hiaps [mailto:hiaps-bounces@ietf.org] De la part de Brandon Willia= ms > Envoy=E9 : mercredi 29 octobre 2014 14:55 > =C0 : joel jaeggli; hiaps@ietf.org > Objet : Re: [hiaps] some discussion in the press... >=20 > Agreed. Inserting a publicly visible user identifier is a bad idea.=20 > That's why all the proposals that have come from people on the hiaps=20 > list (to the best of my knowledge) have focused on relaying _host_=20 > identifiers that are already publicly visible (generally the public IP = > address) through to the other side of middleboxes that are hiding such = > publicly visible identifiers. If there are proposals out there that=20 > violate this principle, I agree entirely that they should be abandoned.= imho one of the assumptions I see in the work is that the host identifier being relayed was previosuly not publicly visible, hence the need for hostid injection. That applies to nat translation for example it also applies to differentating between prefix sharing UE's in IPV6 by something other than source address. http://tools.ietf.org/html/draft-boucadair-intarea-host-identifier-scenar= ios-07 http://tools.ietf.org/html/rfc6269 that's part of the reason for hiaps bof proposal to consider the problem of securing such an identifier from differentiation by surveillance. > --Brandon >=20 > On 10/29/2014 12:06 AM, joel jaeggli wrote: >> this is pretty much exactly what I would have expected from injection = on >> the wire of an identity token... >> >> http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works/= >> >> http://www.wired.com/2014/10/verizons-perma-cookie/ >> >> http://www.forbes.com/sites/kashmirhill/2014/10/28/att-says-its-testin= g-unkillable-tracker-on-customers-smartphones/ >> >=20 --eDvjrAInCaU37ws6ekpI4A1vD8bQLBIih Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAlRRAL4ACgkQ8AA1q7Z/VrI2nQCfdY/Ta3GRoR/jKAaXqPCO7D/5 XSoAn1W1ubPX8+RVBizWtsxHY3KqLwFt =nRfQ -----END PGP SIGNATURE----- --eDvjrAInCaU37ws6ekpI4A1vD8bQLBIih-- From nobody Wed Oct 29 09:51:22 2014 Return-Path: X-Original-To: hiaps@ietfa.amsl.com Delivered-To: hiaps@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DD4D1A1B4F for ; Wed, 29 Oct 2014 09:51:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4LWiHcGZOlQ4 for ; Wed, 29 Oct 2014 09:51:19 -0700 (PDT) Received: from mail-yk0-x22f.google.com (mail-yk0-x22f.google.com [IPv6:2607:f8b0:4002:c07::22f]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F4BE1A1B1A for ; Wed, 29 Oct 2014 09:51:18 -0700 (PDT) Received: by mail-yk0-f175.google.com with SMTP id q9so1467500ykb.6 for ; Wed, 29 Oct 2014 09:51:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type:content-transfer-encoding; bh=GwFD+c5cQe1uX6lY2Zp7ZkOndl+oCYneJ2unYBqGpBE=; b=jCHAGGxTl+rCWs5Dy9zayi+lcpuCeUDTBZqZgO1RGxnZIMobuFisTFvwDNTbylRAvZ GB6p+7qycGMBdx6wYssa/mwfgu/v/h/sPrrnMJ6VwUgMdhXqeA0hfvjO2BHsMrq0PZO5 Jej5Oew6f+pT0lYhjSmOqlLJo1wuHF9BS90fLygRJ3wsc6zeHNkAKFdvTdkYHNPi2mns 4LrfwzVpM/cQSjE4jSB2pZan8H1Lk1WzhZYvaXDjUht4g6d9bKSxld/0Xy3+5RVFRSqd pFfi5rx/3OA6tvVj962q/wVSNT70VbNAKDyU8SKOkN0dG3rPbC72WC7Ahe0ZiZcxZRzL uDFg== MIME-Version: 1.0 X-Received: by 10.236.203.130 with SMTP id f2mr2827878yho.91.1414601478341; Wed, 29 Oct 2014 09:51:18 -0700 (PDT) Received: by 10.170.71.198 with HTTP; Wed, 29 Oct 2014 09:51:18 -0700 (PDT) In-Reply-To: <545100BE.7090604@bogus.com> References: <545067B6.4020704@bogus.com> <5450F1B2.9070604@akamai.com> <787AE7BB302AE849A7480A190F8B93301C0A81@OPEXCLILM23.corporate.adroot.infra.ftgroup> <545100BE.7090604@bogus.com> Date: Wed, 29 Oct 2014 11:51:18 -0500 Message-ID: From: Behcet Sarikaya To: joel jaeggli Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: http://mailarchive.ietf.org/arch/msg/hiaps/_ZneeGO4lvO9B1uTuUV6pH7K6YY Cc: "hiaps@ietf.org" , Mohamed Boucadair , Brandon Williams Subject: Re: [hiaps] some discussion in the press... X-BeenThere: hiaps@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: sarikaya@ieee.org List-Id: "Host Identification, Address and Prefix Sharing in Wi-Fi Access \(hiaps\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Oct 2014 16:51:20 -0000 Hi Joel, On Wed, Oct 29, 2014 at 9:59 AM, joel jaeggli wrote: > On 10/29/14 7:10 AM, mohamed.boucadair@orange.com wrote: >> Hi Brian, >> >> I echo your comment. >> >> None of the proposals inventoried in the HOST_ID effort is trying to do = the same thing as X-UIDH header. Moreover, none of these proposals is endor= sing the following headers (but not limited to) nor aims at revealing a cus= tomer ID, account ID, profile ID, etc.: >> >> HTTP_MSISDN, HTTP_X_MSISDN, HTTP_X_UP_CALLING_LINE_ID, >> HTTP_X_NOKIA_MSISDN, HTTP_X_HTS_CLID, HTTP_X_MSP_CLID, >> HTTP_X_NX_CLID, HTTP__RAPMIN, HTTP_X_WAP_MSISDN, >> HTTP_COOKIE, HTTP_X_UP_LSID, HTTP_X_H3G_MSISDN, >> HTTP_X_JINNY_CID, HTTP_X_NETWORK_INFO, ... >> >> Cheers, >> Med >> >> -----Message d'origine----- >> De : hiaps [mailto:hiaps-bounces@ietf.org] De la part de Brandon William= s >> Envoy=C3=A9 : mercredi 29 octobre 2014 14:55 >> =C3=80 : joel jaeggli; hiaps@ietf.org >> Objet : Re: [hiaps] some discussion in the press... >> >> Agreed. Inserting a publicly visible user identifier is a bad idea. >> That's why all the proposals that have come from people on the hiaps >> list (to the best of my knowledge) have focused on relaying _host_ >> identifiers that are already publicly visible (generally the public IP >> address) through to the other side of middleboxes that are hiding such >> publicly visible identifiers. If there are proposals out there that >> violate this principle, I agree entirely that they should be abandoned. > > imho one of the assumptions I see in the work is that the host > identifier being relayed was previosuly not publicly visible, hence the > need for hostid injection. That applies to nat translation for example > it also applies to differentating between prefix sharing UE's in IPV6 > by something other than source address. > > http://tools.ietf.org/html/draft-boucadair-intarea-host-identifier-scenar= ios-07 > http://tools.ietf.org/html/rfc6269 > > that's part of the reason for hiaps bof proposal to consider the problem > of securing such an identifier from differentiation by surveillance. Absolutely. Should we revive the bof effort? I think that doing the standardization related to hosted in hiaps rather than intarea is the right way to go for IETF. Behcet > >> --Brandon >> >> On 10/29/2014 12:06 AM, joel jaeggli wrote: >>> this is pretty much exactly what I would have expected from injection o= n >>> the wire of an identity token... >>> >>> http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works/ >>> >>> http://www.wired.com/2014/10/verizons-perma-cookie/ >>> >>> http://www.forbes.com/sites/kashmirhill/2014/10/28/att-says-its-testing= -unkillable-tracker-on-customers-smartphones/ >>> >> > > > > _______________________________________________ > hiaps mailing list > hiaps@ietf.org > https://www.ietf.org/mailman/listinfo/hiaps > From nobody Wed Oct 29 14:36:35 2014 Return-Path: X-Original-To: hiaps@ietfa.amsl.com Delivered-To: hiaps@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD5541A9091 for ; Wed, 29 Oct 2014 14:36:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t3qfdlzjGFc7 for ; Wed, 29 Oct 2014 14:36:32 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE9ED1A038F for ; Wed, 29 Oct 2014 14:36:32 -0700 (PDT) Received: from mb-aye.local ([209.49.54.202]) (authenticated bits=0) by nagasaki.bogus.com (8.14.9/8.14.9) with ESMTP id s9TLaSlA095226 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Wed, 29 Oct 2014 21:36:28 GMT (envelope-from joelja@bogus.com) Message-ID: <54515DDA.3060500@bogus.com> Date: Wed, 29 Oct 2014 14:36:26 -0700 From: joel jaeggli User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:33.0) Gecko/20100101 Thunderbird/33.0 MIME-Version: 1.0 To: sarikaya@ieee.org References: <545067B6.4020704@bogus.com> <5450F1B2.9070604@akamai.com> <787AE7BB302AE849A7480A190F8B93301C0A81@OPEXCLILM23.corporate.adroot.infra.ftgroup> <545100BE.7090604@bogus.com> In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="4uxtEg1KbDOHWxfa4QLeNKdjnmBqau2U6" Archived-At: http://mailarchive.ietf.org/arch/msg/hiaps/g6gitC7pjFQFEOIGQe36x4w-IFg Cc: "hiaps@ietf.org" , Mohamed Boucadair , Brandon Williams Subject: Re: [hiaps] some discussion in the press... X-BeenThere: hiaps@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Host Identification, Address and Prefix Sharing in Wi-Fi Access \(hiaps\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Oct 2014 21:36:35 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --4uxtEg1KbDOHWxfa4QLeNKdjnmBqau2U6 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 10/29/14 9:51 AM, Behcet Sarikaya wrote: > Hi Joel, >=20 > On Wed, Oct 29, 2014 at 9:59 AM, joel jaeggli wrote:= >> On 10/29/14 7:10 AM, mohamed.boucadair@orange.com wrote: >>> Hi Brian, >>> >>> I echo your comment. >>> >>> None of the proposals inventoried in the HOST_ID effort is trying to = do the same thing as X-UIDH header. Moreover, none of these proposals is = endorsing the following headers (but not limited to) nor aims at revealin= g a customer ID, account ID, profile ID, etc.: >>> >>> HTTP_MSISDN, HTTP_X_MSISDN, HTTP_X_UP_CALLING_LINE_ID, >>> HTTP_X_NOKIA_MSISDN, HTTP_X_HTS_CLID, HTTP_X_MSP_CLID, >>> HTTP_X_NX_CLID, HTTP__RAPMIN, HTTP_X_WAP_MSISDN, >>> HTTP_COOKIE, HTTP_X_UP_LSID, HTTP_X_H3G_MSISDN, >>> HTTP_X_JINNY_CID, HTTP_X_NETWORK_INFO, ... >>> >>> Cheers, >>> Med >>> >>> -----Message d'origine----- >>> De : hiaps [mailto:hiaps-bounces@ietf.org] De la part de Brandon Will= iams >>> Envoy=C3=A9 : mercredi 29 octobre 2014 14:55 >>> =C3=80 : joel jaeggli; hiaps@ietf.org >>> Objet : Re: [hiaps] some discussion in the press... >>> >>> Agreed. Inserting a publicly visible user identifier is a bad idea. >>> That's why all the proposals that have come from people on the hiaps >>> list (to the best of my knowledge) have focused on relaying _host_ >>> identifiers that are already publicly visible (generally the public I= P >>> address) through to the other side of middleboxes that are hiding suc= h >>> publicly visible identifiers. If there are proposals out there that >>> violate this principle, I agree entirely that they should be abandone= d. >> >> imho one of the assumptions I see in the work is that the host >> identifier being relayed was previosuly not publicly visible, hence th= e >> need for hostid injection. That applies to nat translation for exampl= e >> it also applies to differentating between prefix sharing UE's in IPV6= >> by something other than source address. >> >> http://tools.ietf.org/html/draft-boucadair-intarea-host-identifier-sce= narios-07 >> http://tools.ietf.org/html/rfc6269 >> >> that's part of the reason for hiaps bof proposal to consider the probl= em >> of securing such an identifier from differentiation by surveillance. >=20 > Absolutely. >=20 > Should we revive the bof effort? you didn't hear me say that. I think you know where we left it. =46rom my vantage point a bof proposal that addresses the scope and privacy/pervasive monitoring concerns and which has a critical mass of effort behind it might certainly be worthy of consideration as bof. > I think that doing the standardization related to hosted in hiaps > rather than intarea is the right way to go for IETF. We created this mailing list to have a place to discuss host identification, we can use it for that or we can get rid of it. > Behcet >> >>> --Brandon >>> >>> On 10/29/2014 12:06 AM, joel jaeggli wrote: >>>> this is pretty much exactly what I would have expected from injectio= n on >>>> the wire of an identity token... >>>> >>>> http://webpolicy.org/2014/10/24/how-verizons-advertising-header-work= s/ >>>> >>>> http://www.wired.com/2014/10/verizons-perma-cookie/ >>>> >>>> http://www.forbes.com/sites/kashmirhill/2014/10/28/att-says-its-test= ing-unkillable-tracker-on-customers-smartphones/ >>>> >>> >> >> >> >> _______________________________________________ >> hiaps mailing list >> hiaps@ietf.org >> https://www.ietf.org/mailman/listinfo/hiaps >> >=20 > _______________________________________________ > hiaps mailing list > hiaps@ietf.org > https://www.ietf.org/mailman/listinfo/hiaps >=20 --4uxtEg1KbDOHWxfa4QLeNKdjnmBqau2U6 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAlRRXdsACgkQ8AA1q7Z/VrI0pwCfTT7uHy4hULm/kZ+hYCRg5/7R iUEAn0JxbdF3PaqmqTSA+27iw4ia6gyE =mDqq -----END PGP SIGNATURE----- --4uxtEg1KbDOHWxfa4QLeNKdjnmBqau2U6-- From nobody Thu Oct 30 12:04:22 2014 Return-Path: X-Original-To: hiaps@ietfa.amsl.com Delivered-To: hiaps@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5BD61A1AF1 for ; Thu, 30 Oct 2014 12:04:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jwTWBx8nUYOQ for ; Thu, 30 Oct 2014 12:04:15 -0700 (PDT) Received: from mail-yk0-x229.google.com (mail-yk0-x229.google.com [IPv6:2607:f8b0:4002:c07::229]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0EFA81A1A98 for ; Thu, 30 Oct 2014 12:04:14 -0700 (PDT) Received: by mail-yk0-f169.google.com with SMTP id 142so2600719ykq.14 for ; Thu, 30 Oct 2014 12:04:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type:content-transfer-encoding; bh=gLTPJ6Jv9Umn/GPE5o2KP6VRGHDVqaEq4jSNrciTuOk=; b=vUOjU+frV/ttNafU2qHYuB+hvCovYtHFnCQ6sAS+sAh6Ohoq5SraBwvz7Yi2UE3ZhP ENJMTzL0FwVgACoF4viV4SmLQ6J/X2zu0Mvs17+dROW4Rabic6rSz/6kvNnlYFDr36rI jv0kvWbATmLbtyApB32sc8ZDFykWZypmTFIdcApMZQW3cB/ahlhPGRsuJMpy0cfFZRd4 IwoRQYOmKnVLjtM6YXeudcKCpYA3sGbY6qLFoSc6WIzzQj5Lk8gF74+Wks9eCu00s+vL yGoF3OmC2KxOMcbYXMgCisjuxyojB4mY09vYHVbKad+6mm/gMI1pHIZArmEUCebxXZew foDQ== MIME-Version: 1.0 X-Received: by 10.170.151.137 with SMTP id s131mr10882935ykc.91.1414695853183; Thu, 30 Oct 2014 12:04:13 -0700 (PDT) Received: by 10.170.71.198 with HTTP; Thu, 30 Oct 2014 12:04:13 -0700 (PDT) In-Reply-To: <54515DDA.3060500@bogus.com> References: <545067B6.4020704@bogus.com> <5450F1B2.9070604@akamai.com> <787AE7BB302AE849A7480A190F8B93301C0A81@OPEXCLILM23.corporate.adroot.infra.ftgroup> <545100BE.7090604@bogus.com> <54515DDA.3060500@bogus.com> Date: Thu, 30 Oct 2014 14:04:13 -0500 Message-ID: From: Behcet Sarikaya To: joel jaeggli Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: http://mailarchive.ietf.org/arch/msg/hiaps/PjtxXshzlLM7-JdGnSeBruOGUsk Cc: "hiaps@ietf.org" , Mohamed Boucadair , Brandon Williams Subject: Re: [hiaps] some discussion in the press... X-BeenThere: hiaps@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: sarikaya@ieee.org List-Id: "Host Identification, Address and Prefix Sharing in Wi-Fi Access \(hiaps\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Oct 2014 19:04:18 -0000 Hi Med, Brandon, Last time Med was on paternity leave and he could help. Brandon found out about hiaps late. Now, it is time for you two to say something regarding > a bof proposal that addresses the scope and > privacy/pervasive monitoring concerns and which has a critical mass of > effort behind it might certainly be worthy of consideration as bof. Regards, Behcet On Wed, Oct 29, 2014 at 4:36 PM, joel jaeggli wrote: > On 10/29/14 9:51 AM, Behcet Sarikaya wrote: >> Hi Joel, >> >> On Wed, Oct 29, 2014 at 9:59 AM, joel jaeggli wrote: >>> On 10/29/14 7:10 AM, mohamed.boucadair@orange.com wrote: >>>> Hi Brian, >>>> >>>> I echo your comment. >>>> >>>> None of the proposals inventoried in the HOST_ID effort is trying to d= o the same thing as X-UIDH header. Moreover, none of these proposals is end= orsing the following headers (but not limited to) nor aims at revealing a c= ustomer ID, account ID, profile ID, etc.: >>>> >>>> HTTP_MSISDN, HTTP_X_MSISDN, HTTP_X_UP_CALLING_LINE_ID, >>>> HTTP_X_NOKIA_MSISDN, HTTP_X_HTS_CLID, HTTP_X_MSP_CLID, >>>> HTTP_X_NX_CLID, HTTP__RAPMIN, HTTP_X_WAP_MSISDN, >>>> HTTP_COOKIE, HTTP_X_UP_LSID, HTTP_X_H3G_MSISDN, >>>> HTTP_X_JINNY_CID, HTTP_X_NETWORK_INFO, ... >>>> >>>> Cheers, >>>> Med >>>> >>>> -----Message d'origine----- >>>> De : hiaps [mailto:hiaps-bounces@ietf.org] De la part de Brandon Willi= ams >>>> Envoy=C3=A9 : mercredi 29 octobre 2014 14:55 >>>> =C3=80 : joel jaeggli; hiaps@ietf.org >>>> Objet : Re: [hiaps] some discussion in the press... >>>> >>>> Agreed. Inserting a publicly visible user identifier is a bad idea. >>>> That's why all the proposals that have come from people on the hiaps >>>> list (to the best of my knowledge) have focused on relaying _host_ >>>> identifiers that are already publicly visible (generally the public IP >>>> address) through to the other side of middleboxes that are hiding such >>>> publicly visible identifiers. If there are proposals out there that >>>> violate this principle, I agree entirely that they should be abandoned= . >>> >>> imho one of the assumptions I see in the work is that the host >>> identifier being relayed was previosuly not publicly visible, hence the >>> need for hostid injection. That applies to nat translation for example >>> it also applies to differentating between prefix sharing UE's in IPV6 >>> by something other than source address. >>> >>> http://tools.ietf.org/html/draft-boucadair-intarea-host-identifier-scen= arios-07 >>> http://tools.ietf.org/html/rfc6269 >>> >>> that's part of the reason for hiaps bof proposal to consider the proble= m >>> of securing such an identifier from differentiation by surveillance. >> >> Absolutely. >> >> Should we revive the bof effort? > > you didn't hear me say that. I think you know where we left it. > > From my vantage point a bof proposal that addresses the scope and > privacy/pervasive monitoring concerns and which has a critical mass of > effort behind it might certainly be worthy of consideration as bof. > >> I think that doing the standardization related to hosted in hiaps >> rather than intarea is the right way to go for IETF. > > We created this mailing list to have a place to discuss host > identification, we can use it for that or we can get rid of it. > >> Behcet >>> >>>> --Brandon >>>> >>>> On 10/29/2014 12:06 AM, joel jaeggli wrote: >>>>> this is pretty much exactly what I would have expected from injection= on >>>>> the wire of an identity token... >>>>> >>>>> http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works= / >>>>> >>>>> http://www.wired.com/2014/10/verizons-perma-cookie/ >>>>> >>>>> http://www.forbes.com/sites/kashmirhill/2014/10/28/att-says-its-testi= ng-unkillable-tracker-on-customers-smartphones/ >>>>> >>>> >>> >>> >>> >>> _______________________________________________ >>> hiaps mailing list >>> hiaps@ietf.org >>> https://www.ietf.org/mailman/listinfo/hiaps >>> >> >> _______________________________________________ >> hiaps mailing list >> hiaps@ietf.org >> https://www.ietf.org/mailman/listinfo/hiaps >> > > From nobody Thu Oct 30 12:35:45 2014 Return-Path: X-Original-To: hiaps@ietfa.amsl.com Delivered-To: hiaps@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B357A1A1BEE for ; Thu, 30 Oct 2014 12:35:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tJdp8QueMYWs for ; Thu, 30 Oct 2014 12:35:40 -0700 (PDT) Received: from mail-yh0-x22e.google.com (mail-yh0-x22e.google.com [IPv6:2607:f8b0:4002:c01::22e]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8599F1A1B6C for ; Thu, 30 Oct 2014 12:35:40 -0700 (PDT) Received: by mail-yh0-f46.google.com with SMTP id a41so1966886yho.33 for ; Thu, 30 Oct 2014 12:35:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:reply-to:date:message-id:subject:from:to:cc :content-type; bh=fqaLeBxiFkTllbqR+/d/0Z5zlSsbOfmWI3QJOTkkK74=; b=YpOlr1JzaJ8NJ3MVXw9OqiBWpZSnekfR9OR+oqA7XxRslQsPUUrVFcqlY0E7CoeQQQ wyoUeoDr1F3Id9G/3m2QykQNKtDHQXT32HX8d2cVMNyk3wbiSJJIIDSx3ndefg/55I8Z lFCKx9LOI8s6oUhJo62fvUhpau0lO4mrPKccWTP4UN38iXeSLwrl3lok/+LU4P5g+YYT JqkPMjzy3QsdPYOmA5faFLNDd7m5C5zTFQY5m8V5fKo6rLVgzPGCV4aLZSK3UsToLspg ffKWnHSm+SD7gkGgknlc5LwT4XEom1pQexZfPFrETovwoeQL2C3gFN35PCGv5ZXwHCkq 8r0g== MIME-Version: 1.0 X-Received: by 10.236.24.161 with SMTP id x21mr9326352yhx.96.1414697739943; Thu, 30 Oct 2014 12:35:39 -0700 (PDT) Received: by 10.170.71.198 with HTTP; Thu, 30 Oct 2014 12:35:39 -0700 (PDT) Date: Thu, 30 Oct 2014 14:35:39 -0500 Message-ID: From: Behcet Sarikaya To: "hiaps@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: http://mailarchive.ietf.org/arch/msg/hiaps/VojcC0phXJwqAtu8igDVBeKxqXw Cc: Mohamed Boucadair , Brandon Williams , "Dirk.von-Hugo@telekom.de" Subject: [hiaps] work to do X-BeenThere: hiaps@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: sarikaya@ieee.org List-Id: "Host Identification, Address and Prefix Sharing in Wi-Fi Access \(hiaps\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Oct 2014 19:35:41 -0000 Hi all, I tried to dress up things to do in hostid below as follows: - requirements - updated solution analysis - solution(s) given the fact that we have diverse set of use cases, one size fits all type of a single solution may not be the way to go. Regards, Behcet From nobody Fri Oct 31 09:03:41 2014 Return-Path: X-Original-To: hiaps@ietfa.amsl.com Delivered-To: hiaps@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15EF21A9067 for ; Fri, 31 Oct 2014 09:03:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, J_CHICKENPOX_12=0.6, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qeUMPQBvLU3U for ; Fri, 31 Oct 2014 09:03:37 -0700 (PDT) Received: from relais-inet.francetelecom.com (relais-ias243.francetelecom.com [80.12.204.243]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BBA371A9064 for ; Fri, 31 Oct 2014 09:03:36 -0700 (PDT) Received: from omfeda08.si.francetelecom.fr (unknown [xx.xx.xx.201]) by omfeda12.si.francetelecom.fr (ESMTP service) with ESMTP id E5DC93B488B; Fri, 31 Oct 2014 17:03:34 +0100 (CET) Received: from Exchangemail-eme2.itn.ftgroup (unknown [10.114.31.56]) by omfeda08.si.francetelecom.fr (ESMTP service) with ESMTP id B90D83840A2; Fri, 31 Oct 2014 17:03:34 +0100 (CET) Received: from OPEXCLILM23.corporate.adroot.infra.ftgroup ([169.254.2.110]) by OPEXCLILH04.corporate.adroot.infra.ftgroup ([10.114.31.56]) with mapi id 14.03.0195.001; Fri, 31 Oct 2014 17:03:34 +0100 From: To: "sarikaya@ieee.org" , joel jaeggli Thread-Topic: [hiaps] some discussion in the press... Thread-Index: AQHP9HRO/P1Iyju58EKiuZkHvpWeXZxKXTZQ Date: Fri, 31 Oct 2014 16:03:34 +0000 Message-ID: <787AE7BB302AE849A7480A190F8B93301C37D5@OPEXCLILM23.corporate.adroot.infra.ftgroup> References: <545067B6.4020704@bogus.com> <5450F1B2.9070604@akamai.com> <787AE7BB302AE849A7480A190F8B93301C0A81@OPEXCLILM23.corporate.adroot.infra.ftgroup> <545100BE.7090604@bogus.com> <54515DDA.3060500@bogus.com> In-Reply-To: Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.168.234.1] Content-Type: multipart/mixed; boundary="_002_787AE7BB302AE849A7480A190F8B93301C37D5OPEXCLILM23corpor_" MIME-Version: 1.0 X-PMX-Version: 6.0.3.2322014, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2014.10.31.145720 Archived-At: http://mailarchive.ietf.org/arch/msg/hiaps/ocJXySzst6zkjbTFp8xZvg8h7Ro Cc: "hiaps@ietf.org" , Brandon Williams Subject: Re: [hiaps] some discussion in the press... X-BeenThere: hiaps@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Host Identification, Address and Prefix Sharing in Wi-Fi Access \(hiaps\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Oct 2014 16:03:40 -0000 --_002_787AE7BB302AE849A7480A190F8B93301C37D5OPEXCLILM23corpor_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQmVoY2V0LA0KDQpJJ20gc3RpbGwgc3VwcG9ydGl2ZSBvZiB0aGlzIHdvcmsgYW5kIGFjdHVh bGx5IEknZCBsaWtlIHRvIHNlZSBzb21lIGNvbmNyZXRlIHByb2dyZXNzLiBTYXlpbmcgdGhhdCwg SSdtIG5vdCBzdXJlIEpvZWwgaXMgYXNraW5nIGZvciBhbm90aGVyIEJvRiBidXQgcGVyaGFwcyBJ J20gd3JvbmcgaGVyZS4NCg0KSnVzdCBsaWtlIHRoZSAicGFuaWMiIHdpdGggcGVydmFzaXZlIG1v bml0b3JpbmcsIHRoZXJlIGFyZSBzZXZlcmFsIG1haWxpbmcgbGlzdHMgdGhhdCBhcmUgYWxhcm1l ZCB3aXRoIGluamVjdGlvbiBvZiB0aGUgaWRlbnRpZmllcnMuIFRoZXNlIHByYWN0aWNlcyBhcmUg bm90IG5ldyBidXQgdGhlc2UgYXJlICJwYW5pYyIgY3ljbGVzLi4uIFRoZSBzaWRlIGVmZmVjdCBv ZiBpdCBpcyB0aGF0IHRoZXNlIGFsYXJtaW5nIG5ld3MgY2FuIHBvbGx1dGUgdGhlIEhPU1RfSUQg d29yayBkZXNwaXRlIHRoZSBmYWN0IHRoYXQgd2UgYXJlIG5vdCBhc2tpbmcgZm9yIHVuaXF1ZS9z dGFibGUgaWRlbnRpZmllcnMgbm9yIGFza2luZyB0byBsZWFrL3JldmVhbCBhbnkgY3VzdG9tZXIg SUQsIHByb2ZpbGUgSUQsIGV0Yy4gIA0KDQpCVFcsIHRoZXJlIElFVEYgZG9jdW1lbnRzIHRoYXQg YWxyZWFkeSBkb2N1bWVudHMgc29tZSBwcmFjdGljZXMgb2YgaW5qZWN0aW5nIGlkZW50aWZpZXJz LCBzZWUgZm9yIGluc3RhbmNlOiBodHRwOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRm LXNmYy11c2UtY2FzZS1tb2JpbGl0eS0wMSNzZWN0aW9uLTMuMyB0aGF0IGlzIG1vcmUgY2xvc2Ug dG8gd2hhdCBKb2VsIHNoYXJlZCBpbiB0aGlzIGxpc3QuDQoNCkNoZWVycywNCk1lZA0KDQotLS0t LU1lc3NhZ2UgZCdvcmlnaW5lLS0tLS0NCkRlwqA6IEJlaGNldCBTYXJpa2F5YSBbbWFpbHRvOnNh cmlrYXlhMjAxMkBnbWFpbC5jb21dIA0KRW52b3nDqcKgOiBqZXVkaSAzMCBvY3RvYnJlIDIwMTQg MjA6MDQNCsOAwqA6IGpvZWwgamFlZ2dsaQ0KQ2PCoDogaGlhcHNAaWV0Zi5vcmc7IEJPVUNBREFJ UiBNb2hhbWVkIElNVC9PTE47IEJyYW5kb24gV2lsbGlhbXMNCk9iamV0wqA6IFJlOiBbaGlhcHNd IHNvbWUgZGlzY3Vzc2lvbiBpbiB0aGUgcHJlc3MuLi4NCg0KSGkgTWVkLCBCcmFuZG9uLA0KDQpM YXN0IHRpbWUgTWVkIHdhcyBvbiBwYXRlcm5pdHkgbGVhdmUgYW5kIGhlIGNvdWxkIGhlbHAuIEJy YW5kb24gZm91bmQNCm91dCBhYm91dCBoaWFwcyBsYXRlLg0KDQpOb3csIGl0IGlzIHRpbWUgZm9y IHlvdSB0d28gdG8gc2F5IHNvbWV0aGluZyByZWdhcmRpbmcNCg0KPiBhIGJvZiBwcm9wb3NhbCB0 aGF0IGFkZHJlc3NlcyB0aGUgc2NvcGUgYW5kDQo+IHByaXZhY3kvcGVydmFzaXZlIG1vbml0b3Jp bmcgY29uY2VybnMgYW5kIHdoaWNoIGhhcyBhIGNyaXRpY2FsIG1hc3Mgb2YNCj4gZWZmb3J0IGJl aGluZCBpdCBtaWdodCBjZXJ0YWlubHkgYmUgd29ydGh5IG9mIGNvbnNpZGVyYXRpb24gYXMgYm9m Lg0KDQoNClJlZ2FyZHMsDQoNCkJlaGNldA0KT24gV2VkLCBPY3QgMjksIDIwMTQgYXQgNDozNiBQ TSwgam9lbCBqYWVnZ2xpIDxqb2VsamFAYm9ndXMuY29tPiB3cm90ZToNCj4gT24gMTAvMjkvMTQg OTo1MSBBTSwgQmVoY2V0IFNhcmlrYXlhIHdyb3RlOg0KPj4gSGkgSm9lbCwNCj4+DQo+PiBPbiBX ZWQsIE9jdCAyOSwgMjAxNCBhdCA5OjU5IEFNLCBqb2VsIGphZWdnbGkgPGpvZWxqYUBib2d1cy5j b20+IHdyb3RlOg0KPj4+IE9uIDEwLzI5LzE0IDc6MTAgQU0sIG1vaGFtZWQuYm91Y2FkYWlyQG9y YW5nZS5jb20gd3JvdGU6DQo+Pj4+IEhpIEJyaWFuLA0KPj4+Pg0KPj4+PiBJIGVjaG8geW91ciBj b21tZW50Lg0KPj4+Pg0KPj4+PiBOb25lIG9mIHRoZSBwcm9wb3NhbHMgaW52ZW50b3JpZWQgaW4g dGhlIEhPU1RfSUQgZWZmb3J0IGlzIHRyeWluZyB0byBkbyB0aGUgc2FtZSB0aGluZyBhcyBYLVVJ REggaGVhZGVyLiBNb3Jlb3Zlciwgbm9uZSBvZiB0aGVzZSBwcm9wb3NhbHMgaXMgZW5kb3JzaW5n IHRoZSBmb2xsb3dpbmcgaGVhZGVycyAoYnV0IG5vdCBsaW1pdGVkIHRvKSBub3IgYWltcyBhdCBy ZXZlYWxpbmcgYSBjdXN0b21lciBJRCwgYWNjb3VudCBJRCwgcHJvZmlsZSBJRCwgZXRjLjoNCj4+ Pj4NCj4+Pj4gSFRUUF9NU0lTRE4sIEhUVFBfWF9NU0lTRE4sIEhUVFBfWF9VUF9DQUxMSU5HX0xJ TkVfSUQsDQo+Pj4+IEhUVFBfWF9OT0tJQV9NU0lTRE4sIEhUVFBfWF9IVFNfQ0xJRCwgSFRUUF9Y X01TUF9DTElELA0KPj4+PiBIVFRQX1hfTlhfQ0xJRCwgSFRUUF9fUkFQTUlOLCBIVFRQX1hfV0FQ X01TSVNETiwNCj4+Pj4gSFRUUF9DT09LSUUsIEhUVFBfWF9VUF9MU0lELCBIVFRQX1hfSDNHX01T SVNETiwNCj4+Pj4gSFRUUF9YX0pJTk5ZX0NJRCwgSFRUUF9YX05FVFdPUktfSU5GTywgLi4uDQo+ Pj4+DQo+Pj4+IENoZWVycywNCj4+Pj4gTWVkDQo+Pj4+DQo+Pj4+IC0tLS0tTWVzc2FnZSBkJ29y aWdpbmUtLS0tLQ0KPj4+PiBEZSA6IGhpYXBzIFttYWlsdG86aGlhcHMtYm91bmNlc0BpZXRmLm9y Z10gRGUgbGEgcGFydCBkZSBCcmFuZG9uIFdpbGxpYW1zDQo+Pj4+IEVudm95w6kgOiBtZXJjcmVk aSAyOSBvY3RvYnJlIDIwMTQgMTQ6NTUNCj4+Pj4gw4AgOiBqb2VsIGphZWdnbGk7IGhpYXBzQGll dGYub3JnDQo+Pj4+IE9iamV0IDogUmU6IFtoaWFwc10gc29tZSBkaXNjdXNzaW9uIGluIHRoZSBw cmVzcy4uLg0KPj4+Pg0KPj4+PiBBZ3JlZWQuIEluc2VydGluZyBhIHB1YmxpY2x5IHZpc2libGUg dXNlciBpZGVudGlmaWVyIGlzIGEgYmFkIGlkZWEuDQo+Pj4+IFRoYXQncyB3aHkgYWxsIHRoZSBw cm9wb3NhbHMgdGhhdCBoYXZlIGNvbWUgZnJvbSBwZW9wbGUgb24gdGhlIGhpYXBzDQo+Pj4+IGxp c3QgKHRvIHRoZSBiZXN0IG9mIG15IGtub3dsZWRnZSkgaGF2ZSBmb2N1c2VkIG9uIHJlbGF5aW5n IF9ob3N0Xw0KPj4+PiBpZGVudGlmaWVycyB0aGF0IGFyZSBhbHJlYWR5IHB1YmxpY2x5IHZpc2li bGUgKGdlbmVyYWxseSB0aGUgcHVibGljIElQDQo+Pj4+IGFkZHJlc3MpIHRocm91Z2ggdG8gdGhl IG90aGVyIHNpZGUgb2YgbWlkZGxlYm94ZXMgdGhhdCBhcmUgaGlkaW5nIHN1Y2gNCj4+Pj4gcHVi bGljbHkgdmlzaWJsZSBpZGVudGlmaWVycy4gSWYgdGhlcmUgYXJlIHByb3Bvc2FscyBvdXQgdGhl cmUgdGhhdA0KPj4+PiB2aW9sYXRlIHRoaXMgcHJpbmNpcGxlLCBJIGFncmVlIGVudGlyZWx5IHRo YXQgdGhleSBzaG91bGQgYmUgYWJhbmRvbmVkLg0KPj4+DQo+Pj4gaW1obyBvbmUgb2YgdGhlIGFz c3VtcHRpb25zIEkgc2VlIGluIHRoZSB3b3JrIGlzIHRoYXQgdGhlIGhvc3QNCj4+PiBpZGVudGlm aWVyIGJlaW5nIHJlbGF5ZWQgd2FzIHByZXZpb3N1bHkgbm90IHB1YmxpY2x5IHZpc2libGUsIGhl bmNlIHRoZQ0KPj4+IG5lZWQgZm9yIGhvc3RpZCBpbmplY3Rpb24uICBUaGF0IGFwcGxpZXMgdG8g bmF0IHRyYW5zbGF0aW9uIGZvciBleGFtcGxlDQo+Pj4gaXQgYWxzbyAgYXBwbGllcyB0byBkaWZm ZXJlbnRhdGluZyBiZXR3ZWVuIHByZWZpeCBzaGFyaW5nIFVFJ3MgaW4gSVBWNg0KPj4+IGJ5IHNv bWV0aGluZyBvdGhlciB0aGFuIHNvdXJjZSBhZGRyZXNzLg0KPj4+DQo+Pj4gaHR0cDovL3Rvb2xz LmlldGYub3JnL2h0bWwvZHJhZnQtYm91Y2FkYWlyLWludGFyZWEtaG9zdC1pZGVudGlmaWVyLXNj ZW5hcmlvcy0wNw0KPj4+IGh0dHA6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzYyNjkNCj4+Pg0K Pj4+IHRoYXQncyBwYXJ0IG9mIHRoZSByZWFzb24gZm9yIGhpYXBzIGJvZiBwcm9wb3NhbCB0byBj b25zaWRlciB0aGUgcHJvYmxlbQ0KPj4+IG9mIHNlY3VyaW5nIHN1Y2ggYW4gaWRlbnRpZmllciBm cm9tIGRpZmZlcmVudGlhdGlvbiBieSBzdXJ2ZWlsbGFuY2UuDQo+Pg0KPj4gQWJzb2x1dGVseS4N Cj4+DQo+PiBTaG91bGQgd2UgcmV2aXZlIHRoZSBib2YgZWZmb3J0Pw0KPg0KPiB5b3UgZGlkbid0 IGhlYXIgbWUgc2F5IHRoYXQuIEkgdGhpbmsgeW91IGtub3cgd2hlcmUgd2UgbGVmdCBpdC4NCj4N Cj4gRnJvbSBteSB2YW50YWdlIHBvaW50IGEgYm9mIHByb3Bvc2FsIHRoYXQgYWRkcmVzc2VzIHRo ZSBzY29wZSBhbmQNCj4gcHJpdmFjeS9wZXJ2YXNpdmUgbW9uaXRvcmluZyBjb25jZXJucyBhbmQg d2hpY2ggaGFzIGEgY3JpdGljYWwgbWFzcyBvZg0KPiBlZmZvcnQgYmVoaW5kIGl0IG1pZ2h0IGNl cnRhaW5seSBiZSB3b3J0aHkgb2YgY29uc2lkZXJhdGlvbiBhcyBib2YuDQo+DQo+PiBJIHRoaW5r IHRoYXQgZG9pbmcgdGhlIHN0YW5kYXJkaXphdGlvbiByZWxhdGVkIHRvIGhvc3RlZCBpbiBoaWFw cw0KPj4gcmF0aGVyIHRoYW4gaW50YXJlYSBpcyB0aGUgcmlnaHQgd2F5IHRvIGdvIGZvciBJRVRG Lg0KPg0KPiBXZSBjcmVhdGVkIHRoaXMgbWFpbGluZyBsaXN0IHRvIGhhdmUgYSBwbGFjZSB0byBk aXNjdXNzIGhvc3QNCj4gaWRlbnRpZmljYXRpb24sIHdlIGNhbiB1c2UgaXQgZm9yIHRoYXQgb3Ig d2UgY2FuIGdldCByaWQgb2YgaXQuDQo+DQo+PiBCZWhjZXQNCj4+Pg0KPj4+PiAtLUJyYW5kb24N Cj4+Pj4NCj4+Pj4gT24gMTAvMjkvMjAxNCAxMjowNiBBTSwgam9lbCBqYWVnZ2xpIHdyb3RlOg0K Pj4+Pj4gdGhpcyBpcyBwcmV0dHkgbXVjaCBleGFjdGx5IHdoYXQgSSB3b3VsZCBoYXZlIGV4cGVj dGVkIGZyb20gaW5qZWN0aW9uIG9uDQo+Pj4+PiB0aGUgd2lyZSBvZiBhbiBpZGVudGl0eSB0b2tl bi4uLg0KPj4+Pj4NCj4+Pj4+IGh0dHA6Ly93ZWJwb2xpY3kub3JnLzIwMTQvMTAvMjQvaG93LXZl cml6b25zLWFkdmVydGlzaW5nLWhlYWRlci13b3Jrcy8NCj4+Pj4+DQo+Pj4+PiBodHRwOi8vd3d3 LndpcmVkLmNvbS8yMDE0LzEwL3Zlcml6b25zLXBlcm1hLWNvb2tpZS8NCj4+Pj4+DQo+Pj4+PiBo dHRwOi8vd3d3LmZvcmJlcy5jb20vc2l0ZXMva2FzaG1pcmhpbGwvMjAxNC8xMC8yOC9hdHQtc2F5 cy1pdHMtdGVzdGluZy11bmtpbGxhYmxlLXRyYWNrZXItb24tY3VzdG9tZXJzLXNtYXJ0cGhvbmVz Lw0KPj4+Pj4NCj4+Pj4NCj4+Pg0KPj4+DQo+Pj4NCj4+PiBfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXw0KPj4+IGhpYXBzIG1haWxpbmcgbGlzdA0KPj4+IGhp YXBzQGlldGYub3JnDQo+Pj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9o aWFwcw0KPj4+DQo+Pg0KPj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18NCj4+IGhpYXBzIG1haWxpbmcgbGlzdA0KPj4gaGlhcHNAaWV0Zi5vcmcNCj4+IGh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaGlhcHMNCj4+DQo+DQo+DQo= --_002_787AE7BB302AE849A7480A190F8B93301C37D5OPEXCLILM23corpor_ Content-Type: message/rfc822 Content-Disposition: attachment; creation-date="Fri, 31 Oct 2014 16:03:33 GMT"; modification-date="Fri, 31 Oct 2014 16:03:33 GMT" Received: from omfeda06.si.francetelecom.fr (10.98.3.82) by OPEXCLILH05.corporate.adroot.infra.ftgroup (10.114.31.16) with Microsoft SMTP Server id 14.3.195.1; Thu, 30 Oct 2014 09:30:26 +0100 Received: from omfeda09.si.francetelecom.fr (unknown [xx.xx.xx.161]) by omfeda06.si.francetelecom.fr (ESMTP service) with ESMTP id 999ADC80B1 for ; Thu, 30 Oct 2014 09:30:25 +0100 (CET) Received: from mail.ietf.org (mail.ietf.org [4.31.198.44]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by relais-inet.francetelecom.com (ESMTP service) with ESMTPS id 4282EC07B6 for ; Thu, 30 Oct 2014 09:30:24 +0100 (CET) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D22C1A1A2A; Thu, 30 Oct 2014 01:30:22 -0700 (PDT) Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A2F61A1A2A for ; Thu, 30 Oct 2014 01:30:20 -0700 (PDT) Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OVyjBMYs6Yqj for ; Thu, 30 Oct 2014 01:30:18 -0700 (PDT) Received: from moof.catpipe.net (moof.catpipe.net [194.28.252.64]) by ietfa.amsl.com (Postfix) with ESMTP id F24E81A0369 for ; Thu, 30 Oct 2014 01:30:17 -0700 (PDT) Received: from localhost (moof.catpipe.net [194.28.252.64]) by localhost.catpipe.net (Postfix) with ESMTP id AE6784CE9CC; Thu, 30 Oct 2014 09:30:15 +0100 (CET) Received: from moof.catpipe.net ([194.28.252.64]) by localhost (moof.catpipe.net [194.28.252.64]) (amavisd-new, port 10024) with ESMTP id jUCDmmku+Vnh; Thu, 30 Oct 2014 09:30:14 +0100 (CET) Received: from macbook.bluepipe.net (unknown [195.249.214.179]) (Authenticated sender: relayuser) by moof.catpipe.net (Postfix) with ESMTPA id 9DC994CE9C9; Thu, 30 Oct 2014 09:30:14 +0100 (CET) Received: by macbook.bluepipe.net (Postfix, from userid 1001) id 982E828E3AEE; Thu, 30 Oct 2014 09:30:14 +0100 (CET) From: Phil Regnauld To: Melissa Densmore CC: gaia Subject: Re: [gaia] Vodacom exposing your number to every website you visit Thread-Topic: [gaia] Vodacom exposing your number to every website you visit Thread-Index: AQHP9BvDpZ3SY3y15kaXKF6mcdcgQA== Sender: gaia Date: Thu, 30 Oct 2014 08:30:14 +0000 Message-ID: <20141030083014.GA55858@macbook.bluepipe.net> References: List-Help: List-Subscribe: , List-Unsubscribe: , In-Reply-To: Content-Language: fr-FR X-MS-Exchange-Organization-AuthSource: OPEXCLILH05.corporate.adroot.infra.ftgroup X-MS-Has-Attach: X-Auto-Response-Suppress: All X-MS-TNEF-Correlator: x-pmx-version: 6.0.3.2322014, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2014.10.30.82119 x-perlmx-spam: Gauge=IIIIIIII, Probability=8%, Report=' RCVD_FROM_IP_DATE 0.1, HTML_00_01 0.05, HTML_00_10 0.05, BODYTEXTP_SIZE_3000_LESS 0, BODY_SIZE_1000_LESS 0, BODY_SIZE_2000_LESS 0, BODY_SIZE_5000_LESS 0, BODY_SIZE_7000_LESS 0, BODY_SIZE_900_999 0, DKIM_SIGNATURE 0, ECARD_KNOWN_DOMAINS 0, SPF_PASS 0, __ANY_URI 0, __BOUNCE_CHALLENGE_SUBJ 0, __BOUNCE_NDR_SUBJ_EXEMPT 0, __CD 0, __CP_URI_IN_BODY 0, __CT 0, __CTE 0, __CT_TEXT_PLAIN 0, __FORWARDED_MSG 0, __FRAUD_LOC 0, __HAS_FROM 0, __HAS_LIST_HEADER 0, __HAS_LIST_HELP 0, __HAS_LIST_SUBSCRIBE 0, __HAS_LIST_UNSUBSCRIBE 0, __HAS_MSGID 0, __IN_REP_TO 0, __MIME_TEXT_ONLY 0, __MIME_VERSION 0, __SANE_MSGID 0, __SUBJ_ALPHA_END 0, __SUBJ_ALPHA_NEGATE 0, __TO_MALFORMED_2 0, __URI_NS , __USER_AGENT 0' dkim-signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1414657822; bh=aiefs/LFOeAkN1QPAWZm8yIP+DQFkh1pY7fNMk/Tpkc=; h=Date:From:To:Message-ID:References:MIME-Version:In-Reply-To:Cc: Subject:List-Id:List-Unsubscribe:List-Archive:List-Post:List-Help: List-Subscribe:Content-Type:Content-Transfer-Encoding:Sender; b=SGJPM68TcJocW/EVVhYfhVpd9o4vgL82BXOFSxSObNqeYBgy/if/dycYXnNT/Gdti SQIeMCa97RiSdoeRFrrWnB0VXQIMv281qBZdxd5o1N8TtlcOw4wUYQPzejk9lGdCXx iYrbIbFJdOt1OxdYdcJLWLnoRPmX65aUl2v5KDdo= user-agent: Mutt/1.5.21 (2010-09-15) list-id: Global Access to the Internet for All errors-to: gaia-bounces@irtf.org x-spam-status: No, score=0.699 tagged_above=-999 required=5 tests=[BAYES_50=0.8, J_CHICKENPOX_12=0.6, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham x-virus-scanned: amavisd-new at amsl.com x-spam-level: list-post: list-archive: x-mailman-version: 2.1.15 x-beenthere: gaia@irtf.org delivered-to: gaia@ietfa.amsl.com x-original-to: gaia@ietfa.amsl.com x-spam-flag: NO x-spam-score: 0.699 Content-Type: text/plain; charset="us-ascii" Content-ID: <8C233B4BBF297C479F21775422165453@adroot.infra.ftgroup> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Melissa Densmore (melissa.r.densmore) writes: > Vodacom South Africa is injecting HTTP headers into requests we send to w= eb > servers. Includes IMEI and phone number. > > http://mybroadband.co.za/news/security/113037-vodacom- > exposing-your-number-to-every-website-you-visit.html This is happening other places - here's an article in Danish: http://www.version2.dk/artikel/mobilsurf-danske-teleselskaber-sende= r-dit-telefonnummer-til-hjemmesider-70145 Google translate can probably do a good job of summarising it :) The problem was already brought up back in 2012. -- Phil Regnauld Network Startup Resource Center (NSRC) - www.nsrc.org regnauld@nsrc.org fb.com/nsrc.org | google.com/+NSRCorg | twitter.com/nsrcw= orld PGP Fingerprint: 60FD D10F DA87 7706 A426 3177 C0FD ACDB E408 E96D _______________________________________________ gaia mailing list gaia@irtf.org https://irtf.org/mailman/listinfo/gaia --_002_787AE7BB302AE849A7480A190F8B93301C37D5OPEXCLILM23corpor_--