[LINK] IPv6 vs. Human Security [Was Re: smartphone privacy problems]

[Paul Brooks]

On 31/01/2011 2:59 PM, Richard Chirgwin wrote:
>
> A question: does anyone know whether those implementing v6 support (eg 
> in routers, etc) in 2011 take into account the existence of privacy 
> extensions?
Like most things, that may  depend on the feature requests that those implementing v6
support receive from their current and intended future customers.
If you want a certain feature, they've got to hear there's a demand for it.
Having a recognised implementation document will certainly help it be implemented in
the initial coding run, as suppliers strive to field the most complete, or more
realisticly the 'ticks the most boxes' implementation - but then, that theory hasn't
worked too well in getting even base level IPv6 code into consumer-level devices.

On 31/01/11 2:34 PM, Roger Clarke wrote:
>> Right now, considerable effort is required before a law enforcement
>> agency (or a marketer) can associate all of the messages that a
>> person sends and receives from various locations using their portable
>> device.
>>
>> If the IPv6 default remains in place, that 'natural' protection is
>> destroyed, because the identifier is extractable from the IP-address,
>> and both are persistent.
>>
>> Among the many design requirements for IPv6 had to be retention of
>> natural protections of this nature.
I'm curious - what "natural protections of this nature" are you talking about Roger?
There are no such "natural protections" - not for TXT messages, phone calls, even
driving around.
Not for IPv4 addresses either - so what 'natural protections' are you referring to
here, that IPv6 is supposed to emulate out-of-the-box?

Among the many design requirements for IPv6 were things like interoperability,
stability, global scalability and easeof deployment. It is entirely possible the
hundreds and thousands of people putting the initial specs in place over a decade ago
missed "must by default obfuscate all source information" - but fortunately the rest
of the world has had that decade to read through, recognise the holes for their domain
of expertise, so the "privacy extensions" document was created as part of the
evolution with experience, along with many other enhancements that continue to be
developed.

>> As things have transpire, one of the following must be true:
>> -   that vital design requirement wasn't recognised;  or
>> -   it was recognised but not delivered
>>
>> Either is a failure by the designers.
Fortunately, neither of these are true. It was recognised, and a specification was
created.

Paul.