Hi Andreas,

I tend to agree with Stephen that there is no value in saying that hidden proxies' use of this field has "no end-user privacy impact." In fact, it's not even true. Every IP address that gets conveyed has a potential privacy impact, not least because they can be used as the basis for legal information requests. Conveyance of identifiers is obviously not unique to this spec, but that doesn't mean this spec can claim some high ground that all other IP-based protocols cannot.

Also, as far as I can tell my question about the limits on which identifiers can be carried in the header <http://www.ietf.org/mail-archive/web/apps-discuss/current/msg05938.html> was not addressed in the text. At the least I would expect caution against the use of permanent, unique identifiers in public network environments. If it's not even possible to say that, then the fact that absolutely any identifier might show up here needs to be called out explicitly.

I still think http://tools.ietf.org/html/draft-ietf-intarea-nat-reveal-analysis-02#section-4 is worth a look, as there are topics in there that deserve a mention here too (e.g., the fact that Forwarded identifiers contribute to end host fingerprinting, certainly more so than direct connections).

Alissa 

On Jul 5, 2012, at 8:19 AM, Andreas Petersson wrote:

> On Wed, 04 Jul 2012 21:45:31 +0100
> Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:
> 
>> 
>> Hiya,
>> 
>> Basically agreeing with SM's latest below...
>> ... 
>> 
> 
> Hi,
> 
> I have rewritten the "Privacy Considerations", using parts of your
> suggestions.
> 
> 
> My proposal:
> 
> "In recent years, there has been growing concerns about privacy.
> There is a tradeoff beteween ensuring privacy for users versus
> disclosing information which is useful for debugging and statistics.
> The Forwarded HTTP header field, by design, exposes information that
> some users consider privacy sensitive.
> 
> From an end-user perspective, intermediate proxies in the request path
> are either known or unknown. Hidden proxies using this extension will
> preserve the information of a direct connection, and thus it has no
> end-user privacy impact. Proxies that are known to the end-user,
> such as explicitly configured proxies, using this extention may not
> anonymize the end-user IP address. The possessor of such proxy need
> to consider whether, and how, deploying this extension impacts on
> user privacy.
> 
> An end-user must also be aware of that the users IP address may already
> be forwarded by proxies using the header field X-Forwarded-For, which is
> already wideley used.
> An end-user who want to be anonymus must be aware of these extensions.
> Such end-users must also ensure that the used proxy server, thought
> being anonymizing, in reality is.
> 
> A proxy server that is intended to anonymize the request should not use
> this header field. In cases where the possessor of the proxy want to be
> able to trace where requests came from, but do not want to leak the
> information further, can use the possibility of obfuscating the client
> address."
> 
> 
> Let me know what you think.
> 
> Best regards,
> Andreas
> _______________________________________________
> apps-discuss mailing list
> apps-discuss@ietf.org
> https://www.ietf.org/mailman/listinfo/apps-discuss
>