Subject: thoughts on pervasive monitoring

From: IETF Chair <[email-masked]>
Date: Mon, 9 Sep 2013 05:53:26 +0800

Here are some thoughts on reports related to wide-spread monitoring and potential impacts on Internet standards, from me and Stephen Farrell:

  http://www.ietf.org/blog/2013/09/security-and-pervasive-monitoring/

Comments appreciated, as always.

Jari & Stephen

---

From: Jorge Amodio <[email-masked]>
Date: Sun, 8 Sep 2013 19:24:42 -0500

Will the discussion include the pervasive data mining from companies
exploiting our Internet use for marketing and targeted advertising purposes
?

-J

On Sun, Sep 8, 2013 at 4:53 PM, IETF Chair <[email-masked]> wrote:

> Here are some thoughts on reports related to wide-spread monitoring and
> potential impacts on Internet standards, from me and Stephen Farrell:
>

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 09 Sep 2013 01:43:04 +0100

> exploiting our Internet use for marketing and targeted advertising purposes

IMO the discussion should of course include that as one part
of a larger thing.

Corporate privacy-busting is however somewhat different from
recent news stories, for almost all corporates. There are a
few companies who can monitor so much that they'd compete
with governments in terms of being pervasive monitors. But
recent reports indicate that some governments may have
raised the ante quite a bit higher - if you're accumulating
data from the largest corporate service providers and the
phone companies/ISPs and the trans-atlantic fibres then
you really probably are in a different category than any
of even the largest corporates. I suspect the "new" part
of the new threat model here is the level of pervasiveness
of the monitoring.

Separately, if we can figure out protocol mechanisms or
implementation/deployment guidance that helps mitigate
pervasive monitoring, then those same mechanisms will I
would hope/guess also mitigate corporate non-pervasive
monitoring. But, we'll have to wait and see for that.

So I'd guess that we might be better to consider the
pervasive monitoring attacker for now and then see if the
kinds of mitigation we develop might also be helpful
against somewhat less ubiquitous attackers.

Cheers,
S.

---

From: t.p. <[email-masked]>
Date: Tue, 10 Sep 2013 09:12:11 +0100

It is a shame that this opportunity was not taken to highlight the need
for authentication.  Having a totally secure channel with perfect
encryption is of little value if the other end of the channel is a
hostile power.

RFC3365, which you cite, gets in right (of course!).  It lists three
requirements and top of the list - Authentication service.  It may of
course be that the author was only putting the requirements in
alphabetic order but whatever the reason, the emphasis is appropriate.

Tom Petch

----- Original Message -----
From: "IETF Chair" <[email-masked]>
To: <[email-masked]>; <[email-masked]>
Sent: Sunday, September 08, 2013 10:53 PM

Jari & Stephen

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 10 Sep 2013 11:03:27 +0100

> encryption is of little value if the other end of the channel is a

True. But if strong authentication at Internet scale is so
hard that people fall back to cleartext then that's worse.

Strong authentication can also in some cases expose identifiers
where you wouldn't otherwise need to, which is not the best
thing from a privacy perspective.

So for at least some of what's recently reported, it seems
to me that there is value in exploring whether opportunistic
encryption is worthwhile, maybe for cases where we don't yet
have strong authentication schemes that are privacy
friendly and that are deployable at Internet scale.

But yes, we also need to worry about strong authentication
and making that easier/better. I'd be happy to see folks
working on this from both approaches - making strong
authentication easier/better but also taking the approach
of seeing whether and when opportunistic encryption adds
value. I would not be happy if we dive into either one while
ignoring the other.

S.