Privacy Considerations for Protocols Relying on IP Broadcast or Multicast
draft-ietf-intarea-broadcast-consider-09

[Ballot comment]
I found this sentence very confusing:
" For one, non-standard  protocols will likely not receive operational attention and support in making them more secure such as e.g.  DHCP snooping does for DHCP because they typically are not documented. "  -- I know what it is trying to say, but I don't think it accomplishes what it intends to.


[ This was originally a DISCUSS, emails with authors have addressed my concerns. Old text below for posterity]:
"Sorry for the late DISCUSS. I'm likely to clear after discussions on the call tomorrow.

I'm somewhat surprised at how much this document glosses over the (sometimes extensive) broadcast/multicast twiddling that Access Points and similar do (a fair bit of discussion of which can be found in draft-perkins-intarea-multicast-ieee802 (which I think will be expiring) or draft-mcbride-mboned-wifi-mcast-problem-statement).
Simply saying: "A feature not uncommonly found on access points e.g. is to filter broadcast and multicast traffic.  This will potentially break certain applications or some of their functionality but will also protect the users from potentially leaking sensitive information." seems to be shrugging off all of the privacy benefits (or possibly harms) that this might create.
"

[Ballot comment]
Thank you for the effort invested into this draft.

I am balloting YES, but like Spencer I wonder if this might be better placed as a BCP.

[Ballot discuss]
Sorry for the late DISCUSS. I'm likely to clear after discussions on the call tomorrow.

I'm somewhat surprised at how much this document glosses over the (sometimes extensive) broadcast/multicast twiddling that Access Points and similar do (a fair bit of discussion of which can be found in draft-perkins-intarea-multicast-ieee802 (which I think will be expiring) or draft-mcbride-mboned-wifi-mcast-problem-statement).
Simply saying: "A feature not uncommonly found on access points e.g. is to filter broadcast and multicast traffic.  This will potentially break certain applications or some of their functionality but will also protect the users from potentially leaking sensitive information." seems to be shrugging off all of the privacy benefits (or possibly harms) that this might create.

[Ballot comment]
I found this sentence very confusing:
" For one, non-standard  protocols will likely not receive operational attention and support in making them more secure such as e.g.  DHCP snooping does for DHCP because they typically are not documented. "  -- I know what it is trying to say, but I don't think it accomplishes what it intends to.

[Ballot comment]
I really like this document. I learned a lot.

I'm not gonna argue, but could this have been a BCP?

I have a couple of comments.

ISTM that

  When protocols that
  make use of broadcast/multicast need to make use of IDs, frequent
  rotations of these IDs SHOULD be considered to make user tracking
  more difficult.

should be either

  When protocols that
  make use of broadcast/multicast need to make use of IDs, frequent
  rotations of these IDs MUST be considered to make user tracking
  more difficult.

or

  When protocols that
  make use of broadcast/multicast need to make use of IDs,
  these IDs SHOULD be rotated frequently to make user tracking
  more difficult.

assuming that frequent rotation is the goal, not considering frequent rotation.

I'm not surprised that

  A feature not uncommonly found on access points e.g. is to filter
  broadcast and multicast traffic.  This will potentially break certain
  applications or some of their functionality but will also protect the
  users from potentially leaking sensitive information.

is the only action listed that network administrators/operators can take to limit problems, but I note that the paragraph above it says there are things, plural, that network administrators/operators can do to limit problems, and this action can be paraphrased as "you can filter broadcast and multicast traffic, but then the applications stop working, so make good choices". If that's the only action you can think of, you may want to make the first paragraph sound a bit less hopeful!

[Ballot comment]
Section 3 strikes me as a bit odd. Are you implicitly recommending that access points block broadcast/multicast traffic? That does not seem like it would yield a good user experience and also seems like a rather blunt instrument to address the rest of the problems discussed in the document.

[Ballot comment]
I'm balloting "Yes", but I do have a few comments:

Substantive Comments:

-2.2: "These IDs, which e.g. identify the installation of a
  certain application might not change across updates of the software
  and are therefore extremely long lived"

That seems to imply that they may be extremely long lived, not that they always are.

-2.2, last paragraph: "When protocols that
  make use of broadcast/multicast need to make use of IDs, frequent
  rotations of these IDs SHOULD be considered to make user tracking
  more difficult."
Can this say something stronger than "... be considered..." Maybe "be required"?

-2.3, first paragraph: It seems worth noting that a host name can be a persistent ID even if it contains no personally identifiable info.

-- Same paragraph: The last sentence gives a nod to device fingerprinting. Would it be reasonable to offer some more general guidance around avoiding such fingerprinting?

-2.3, last paragraph: It seems counterproductive to explain better ways of creating persistent IDs after a whole section was dedicated to telling people to avoid them.

-2.4: This section talks about how broadcast/multicast data might be used for correlation.  Is there any reasonable guidance to give on how to avoid that?

-2.5: It seems the configurability discussion could go a bit further and suggest that platforms avoid broadcast/multicast services for features that the user is not actively using.




Editorial Comments and Nits:

-1, paragraph 6: While I like citations of the form of " 'document title' [ref] " better than just "[ref]" , when that becomes "  RFC 7721 [RFC7721] or RFC 7819  [RFC7819]", it adds no information. Please consider replacing "RFC 7221" and "RFC 7819" with something more descriptive.

-1, paragraph 7: " For one, non-standard
  protocols will likely not receive operational attention and support
  in making them more secure such as e.g.  DHCP snooping does for DHCP
  because they typically are not documented."

I find that hard to parse.

-- same paragraph: "... where a set of
  considerations to follow is useful in the absence of a larger
  community providing feedback. "

I don't understand the intent.

-1.1, first paragraph: "The same is true for directed broadcasts by
  default, but routers MAY provide an option to do this [RFC2644]"
That MAY seems like a statement of fact or an external requirement. Neither should use the upper-case MAY.

-1.1, last paragraph: Please expand LLMNR and mDNS on first mention.
-- same paragraph: The last sentence seems out of place in this paragraph. Perhaps it should go with one of the two previous paragraphs?

-1.2: I don't think the use of RFC 2119 keywords adds much value in this document. The document mainly uses them to talk about thins people should consider in protocol design, rather than requirements on the protocols themselves. I suggest making the boilerplate more descriptive of that use, or even better get rid of it (and the capitalized keywords) entirely.

-2.1, last sentence is hard to parse.

-2.2, 2nd to last paragraph: s/" did never " / " never did "
-- same paragraph: "allowed to track" is grammatically incorrect. It should say "allowed  to track" or "allowed the tracking of"

-3, 2nd paragraph: By "not uncommonly", do you mean "commonly"?

(Via drafts-lastcall@iana.org): IESG/Authors/WG Chairs:

The IANA Services Operator has reviewed draft-ietf-intarea-broadcast-consider-05, which is currently in Last Call, and has the following comments:

We understand that this document doesn't require any registry actions.

While it's often helpful for a document's IANA Considerations section to remain in place upon publication even if there are no actions, if the authors strongly prefer to remove it, we do not object.

If this assessment is not accurate, please respond as soon as possible.

Thank you,

Amanda Baber
Lead IANA Services Specialist

The following Last Call announcement was sent out (ends 2018-01-16):

From: The IESG
To: IETF-Announce
CC: int-area@ietf.org, juancarlos.zuniga@sigfox.com, draft-ietf-intarea-broadcast-consider@ietf.org, Juan-Carlos Zuniga , suresh@kaloom.com, intarea-chairs@ietf.org
Reply-To: ietf@ietf.org
Sender:
Subject: Last Call:  (Privacy considerations for IP broadcast and multicast protocol designers) to Informational RFC


The IESG has received a request from the Internet Area Working Group WG
(intarea) to consider the following document: - 'Privacy considerations for
IP broadcast and multicast protocol
  designers'
  as Informational RFC

The IESG plans to make a decision in the next few weeks, and solicits final
comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2018-01-16. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the beginning of
the Subject line to allow automated sorting.

Abstract


  A number of application-layer protocols make use of IP broadcasts or
  multicast messages for functions like local service discovery or name
  resolution.  Some of these functions can only be implemented
  efficiently using such mechanisms.  When using broadcasts or
  multicast messages, a passive observer in the same broadcast/
  multicast domain can trivially record these messages and analyze
  their content.  Therefore, broadcast/multicast protocol designers
  need to take special care when designing their protocols.




The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-intarea-broadcast-consider/

IESG discussion can be tracked via
https://datatracker.ietf.org/doc/draft-ietf-intarea-broadcast-consider/ballot/


No IPR declarations have been submitted directly on this I-D.

Shepherd review of draft-ietf-intarea-broadcast-consider-04

1. Summary

The document shepherd is Juan Carlos Zuniga. The responsible Area Director is Suresh Krishnan.

This document highlights potential privacy issues that take place when protocol designers make use of broadcast / multicast messages
to exchange information that can expose individuals to privacy threats.

The work has been backed up by experimental data, both at the IETF and elsewhere.

The document also provides useful considerations for protocol designers to avoid creating those privacy issues.



2. Review and Consensus

The docuement was discussed at length in the WG, following some experiments that were made over the IETF network.
Because of the obviousness of the issues and usefulness of the document, there was little real discussion about the intention the document.

There were comments for completeness from C. Huitema, T. Chown, T. Hebert, J. Touch, and myself, and these were all addressed.
We believe the working group is solidly behind this work.

I found some editorial errors during the shepherd review, but they have been corrected and everything looks fine now.



3. Intellectual Property

Each author has confirmed conformance with BCP 78/79. There are no IPR disclosures on the document.



4. Other Points

There is a single normative downref to RFC 2119, "Key words for use in RFCs to Indicate Requirement Levels"
due to the use of SHOULD throughout the text.