Hi Derek -

Brief comment in-line...

On 25 Nov 2015, at 12:27, Derek Fawcus <[email protected]> 
wrote:

> On Wed, Nov 25, 2015 at 01:05:06PM +0100, Eliot Lear wrote:
>> Hi,
>> 
>> This smells a lot more like an attempt to inhibit lawful intercept than
>> it does to stop a bad guy spying on email.
> 
> Hardly,  they can still intercept it,  it would just be encrypted.
> 
> There are multiple levels of privacy:
> 
> 1) A communicated with B,  but the nature of the comms is uncharacterised.
> 2) A communicated with B (using email)
> 3) A communicated with B, the email had contents X
> 
> Encryption should defeat 3,  leaving 1 & 2.
> 
> I'm suggesting a way to also defeat 2,  or at least make its recognition
> more difficult.  None of these prevent 1.
> 
> This is an attempt to make bulk interception,  and its offline post facto
> analysis more awkward.  It'll have no effect upon targetted inteception.
> (since there one could see the DNS queries,  and know which were for SMTP).
> 
> But,  if there is not interest in this;  I guess I'll drop it.

Whether or not this functionality ends up in an RFC or implemented, I think it 
is exactly this level of clarity over “levels of privacy” (and corresponding 
levels of protection vs levels of interception capability) that we need to be 
discussing as a community.

I’m sure I’m not the only one who has been depressed by a lot of the public 
discourse on this topic (present list definitely excepted!), and the lack of 
clarity/understanding demonstrated by much of it (this being a lamentable case 
in point: 
http://www.telegraph.co.uk/technology/12008689/Why-is-Silicon-Valley-helping-the-tech-savvy-jihadists.html
 ).

I think an important antidote to that is our own clarity about the protective 
mechanisms that can be applied at the various layers of the protocol stack, and 
the nature and extent of the protection they each provide.

This is entirely in line with my understanding of RFC7258.


> 
> DF
> 
> _______________________________________________
> perpass mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/perpass

Robin Wilton
Technical Outreach Director - Identity and Privacy
Internet Society

email: [email protected]
Phone: +44 705 005 2931
Twitter: @futureidentity

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

_______________________________________________
perpass mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/perpass

Reply via email to