Subject: Re: Bruce Schneier's Proposal to dedicate November meeting to saving the Internet from the NSA

From: [email-masked] (Noel Chiappa)
Date: Fri, 6 Sep 2013 10:45:48 -0400 (EDT)

> From: Scott Brim <[email-masked]>

    > I wouldn't focus on government surveillance per se. The IETF should
    > consider that breaking privacy is much easier than it used to be ...
    > right now the Internet's weakness in privacy is far from "better". The
    > mandatory security considerations section should become security and
    > privacy considerations. The privacy RFC should be expanded and worded
    > more strongly than just nice suggestions. 

Excellent point. There are a lot more threats to privacy than just the NSA
(and similar agencies in other large, powerful countries, which probably do
their own snooping, although not on the scale of the NSA's).

I am minded of the 'recent' revelations that Google, etc trawl through email
they handle, looking for URLs, which they then crawl. (I say 'recent' because
I discovered this some years ago. A 'private' page of mine - i.e. one with no
links to it - wound up in Google's search results, because I'd sent someone
on gmail a message with the URL in it...) Etc, etc. Added up across all the
large companies, I reckon the amount of 'private' surveillance is probably
close to what the NSA does.

    > From: Theodore Ts'o <[email-masked]>

    > For too long, I think, we've let the perfect be the enemy of the good.
    > At least this way they will be forced to go the NSL route ... or spend
    > $$$ on huge racks of servers in public data centers, which maybe means
    > less money to subvert standards setting activities.
    > ...
    > Although perfect security is ideal, increasing the cost of casual style
    > dragnet surveillance is still a Good Thing.

Good point. But let's not make a similar diversion ourselves.

I suspect that for most people, the results of having their machine infected
with a virus, or identity theft from compromised information, is probably a
lot more painful than being the subject of dragnet surveillance by a
government (irritating though that may be).

So if we throw resources at attacking the dragnet surveillance, and take
those resources from efforts to tackle other security problems, that might
not be in the best overall interests of the networks' users.

	Noel

PS: I'm having fun trying to imagine the reaction of the people at the NSA,
GCHQ, etc who are reading this thread. (Hi, all!)

---

From: Dave Crocker <[email-masked]>
Date: Fri, 06 Sep 2013 08:20:17 -0700

> There are a lot more threats to privacy than just the NSA

We currently do not have a concise catalog the basic 'privacy' threats 
and their typical mitigations, appropriate for concern with IETF 
protocols.  In effect, every new protocol effort must start with a blank 
sheet, and invent its own list of threats and possible protections 
against them.

One common outcome from this is that we tend to think of very localized 
mechanisms, rather than end-to-end.  So we assume a model of things 
being one-hop or we implicitly trust intermediaries.  (Hint, the web is 
often not 1-hop, what with proxies, etc...)

We need privacy templates for protocol design.

d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 6 Sep 2013 17:34:09 +0200

On Fri, Sep 06, 2013 at 08:20:17AM -0700,
 Dave Crocker <[email-masked]> wrote 
 a message of 21 lines which said:

> We currently do not have a concise catalog the basic 'privacy'
> threats and their typical mitigations, appropriate for concern with
> IETF protocols.

What about RFC 6973?

---

From: Dave Crocker <[email-masked]>
Date: Fri, 06 Sep 2013 08:58:48 -0700

>> threats and their typical mitigations, appropriate for concern with

It certainly provides useful background.  As such, it's an excellent 
starting point for the topic.

However it is not concise nor does it offer threat templates nor design 
templates.

It also doesn't define privacy...

d/

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 06 Sep 2013 19:47:36 +0300

Dave,

> However it is not concise nor does it offer threat templates nor design

The document actually contains a list of common threats that we found 
applicable in the Internet protocol standardization context.

The design template is essentially the questions listed in the 
guidelines section.

Unfortunately, like in security the story is not that easy that you can 
give simple recommendation. As a protocol designer, you unfortunately 
have to think a bit.

> It also doesn't define privacy...

It does define privacy but not in a single sentence.

Ciao
Hannes