Subject: Re: [perpass] privacy/PM reviews of existing stuff

From: Avri Doria <[email-masked]>
Date: Sat, 01 Feb 2014 09:58:11 -0500

Hi,

I am willing to be self-organized into a PM worrier's klatch.
and even to review drafts for PM

I think one of the things the Worriers would need to accumulate over 
time, though I am sure the basic list can be created already from 
draft-farrell-perpass-attack, is a list of clues for practices and such 
that might be something to be worried about.

avri

On 29-Jan-14 08:55, Stephen Farrell wrote:
>
> Hiya,
>
> One idea that came up in Vancouver and that we (meaning at least
> me:-) haven't had a chance to progress was the idea of trying to
> get a team of folks together to go do privacy reviews of existing
> RFCs. Or perhaps slightly differently, reviews that explicitly
> consider pervasive monitoring, which might be more constrained
> and a bit easier.
>
> I think Christian H. commented at the mic that there is probably
> a *lot* of low hanging fruit out there, and I suspect he's quite
> right:-)
>
> Now that we're in the run up to the London IETF, if some of you
> had time to try self-organise that kind of thing that'd be great.
> Any takers for trying to organise that?
>
> Using this list to start with should be fine, if it results in
> loads of traffic we can spin up a new one, or move over to
> [email-masked].
>
> If there are folks willing to take this on and having a
> side-meeting in London helps, I can get you a room for that.
>
> Thanks,
> S.
>
>
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass
>
>

---

From: Dave Crocker <[email-masked]>
Date: Sat, 01 Feb 2014 07:08:33 -0800

On 1/31/2014 2:50 AM, Stephane Bortzmeyer wrote:
> On Wed, Jan 29, 2014 at 07:50:52AM -0800,
>   Dave Crocker <[email-masked]> wrote
>> We don't have a track record of those specific types of reviews and
>> I believe we are some distance away from having a shared, usable
>> model of what to review for.
>
> We don't start from zero, we have already RFC 6973 and its section 8
> is a very good example of privacy/PM analysis of an existing protocol.

That's nice input for someone considering how to do a PM review, yes, 
but my comment was about actual performance of PM reviews in the IETF.

Think of the example as being based on theory, and an actual review -- 
and all the group interaction that accompanies it -- as demonstrating 
practice.

Of course, in theory there's no difference between theory and practice, 
but...

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 01 Feb 2014 17:07:50 +0000

On 01/31/2014 10:38 AM, Stephane Bortzmeyer wrote:
> On Wed, Jan 29, 2014 at 01:55:47PM +0000,
>  Stephen Farrell <[email-masked]> wrote 
>  a message of 33 lines which said:
> 
>> privacy reviews of existing RFCs.
> 
> Just to check that I understand you correctly: do you think that
> Internet-Drafts like draft-bortzmeyer-dnsop-dns-privacy are such
> "privacy reviews of existing RFC"? If yes, are there other examples to
> follow? If not, what is missing in it?

Yes that seems like a reasonable example to me. The other
questions would be fine things for the putative group of
worriers (better name needed!) to consider.

Cheers
S

> 
> I miss a privacy review of IP, which would help to answer questions
> like "is the IP address a personal identifier" or "is IPv6 better or
> worse than IPv4 for privacy, taking into account CGN and things like
> that"

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 01 Feb 2014 17:15:16 +0000

Hiya

> and even to review drafts for PM

But you don't want to be a non-self-organizer? :-)

I'm still looking for one, at least between now and London.
What happens later can be figured out there. I think it'd
help for a more productive meeting if someone has time to
think some about the options for doing these kinds of review
for example.

I've requested a room for Monday lunchtime for this anyway.

There will not be a perfect time for such a session of course,
but that's probably as good/bad as any earlier-week slot.

S.

---

From: Scott Brim <[email-masked]>
Date: Sat, 1 Feb 2014 12:59:02 -0500

> think some about the options for doing these kinds of review

If I don't send them before the meeting I'll certainly come to London with
some ideas about that.

I'm still doubtful that a lot of organizing would be beneficial. I'm
inclined to providing tools to help the group organize itself. Let's see
what happens.

> I've requested a room for Monday lunchtime for this anyway.

Thanks for the info.

Scott

---

From: Alissa Cooper <[email-masked]>
Date: Sun, 02 Feb 2014 09:37:24 -0800

In the IAB privacy program we did a little bit of this, not focused on PM,
but on a variety of privacy aspects:
<http://www.iab.org/activities/programs/privacy-program/privacy-reviews/>.
Just wanted to bring those reviews to people's attention in case they are
helpful.

I would also suggest that the guidelines/checklist in
http://tools.ietf.org/search/rfc6973#section-7 might be of some help,
particularly if these reviews want to go beyond analysis of a single privacy
aspect (say, confidentiality). The guidelines did not contemplate PM, but
probably could be adapted to do so.

Alissa

On 1/29/14 6:16 AM, "Scott Brim" <[email-masked]> wrote:

> 
> First, what are the goals of getting organized? ☺  Some of us already consider
> privacy as a matter of course for new drafts (I do gen-art reviews in addition
> to WG reviews). I don't think we want to organize a group to comment on new
> material - it would be better get privacy/pm to be included in security
> considerations. My goal for a group would be to organize reviews of *existing*
> drafts/RFCs that are in common use. It shouldn't take a lot of work, maybe
> just a wiki page.
> 
> I'm enthusiastic about having a side meeting in London.
> 
> Scott
> _______________________________________________ perpass mailing list
> [email-masked] https://www.ietf.org/mailman/listinfo/perpass

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 3 Feb 2014 16:34:22 +0100

On Sun, Feb 02, 2014 at 09:37:24AM -0800,
 Alissa Cooper <[email-masked]> wrote 
 a message of 109 lines which said:

> Just wanted to bring those reviews to people's attention in case
> they are helpful.

They are. IMHO, some of them should be turned in RFCs "Protocol X
privacy problem statement" and some could be used to make a Privacy
Considerations section in the next revision of the protocol.