We live in Stockholm, Sweden and have the big government telephone company TELIA as our ISP. We have had internet services through their ADSL for a little over a year now and to my surprise I have recently found out that Telia has assigned us a fixed IP address. Every time we log on to the internet we start surfing with the same IP address every time. From a security and personal integrity point of view we may as well be surfing with our Social Security Numbers if thats the case. Of course dealing with a company the size of Telia you are immediately in David against Goliath position, and their position up to now is to just jack us around and assume no responsibility. When we had the old 56K modem and even ISDN, every time we got on the net we had a new IP address. Impossible to trace us and our surfing habits to a specific number. But not so with Telias ADSL. My questions are the following: * Is Telias current practice as I have described considered a breach of privacy for the private person/customer? * Is Telia following agreed International and /or European standards regarding IP addresses? * Am I able to lodge a formal complaint against such practices, either at the Ripe 44 meeting in Amsterdam in January or somewhere else? I do hope that The LIR-WG will be able to provide me with some answers. Regards, Robert Arnesen
Bob Arnesen wrote:
We live in Stockholm, Sweden and have the big government telephone company TELIA as our ISP. We have had internet services through their ADSL for a little over a year now and to my surprise I have recently found out that Telia has assigned us a fixed IP address. Every time we log on to the internet we start surfing with the _same IP address every time._ From a security and personal integrity point of view we may as well be surfing with our Social Security Numbers if that?s the case. Of course dealing with a company the size of Telia you are immediately in David against Goliath position, and their position up to now is to just jack us around and assume no responsibility. When we had the old 56K modem and even ISDN, every time we got on the net we had a new IP address. Impossible to trace us and our surfing habits to a specific number. But not so with Telia?s ADSL.
If you think that a variable ip address gives you internet anonymity then you are very very niave indeed. ISP's can easily track individual address's back to login accounts via stored logs. All someone needs is an ip address and a time and the isp can locate the person that was logged in. Me thinks you are suffering from a reaction of the jerky knee variety
My questions are the following:
q Is Telia?s current practice as I have described considered a breach of privacy for the private person/customer?
I doubt it. Are they in breach of privacy for giving you a static phone number?
q Is Telia following agreed International and /or European standards regarding IP addresses?
Working for an ISP myself what they're doing looks pretty normal to me.
q Am I able to lodge a formal complaint against such practices, either at the Ripe 44 meeting in Amsterdam in January or somewhere else?
I guess you probably can, I'm sure the ensuing mirth will be quite refreshing. given the sudden increase in paranoia levels around here this might be of some use to you aswell http://zapatopi.net/afdb.html ;-) Regards Mark Guz
I do hope that The LIR-WG will be able to provide me with some answers. Regards,
Robert Arnesen
ISP's can easily track individual address's back to login accounts via stored logs. All someone needs is an ip address and a time and the isp can locate the person that was logged in.
Cookies anyone? - kurtis -
Bob, Most ISP's give out fixed IP's for their ADSL customers. Hope this helps, ____________________________________ Leigh Geary - Internet Engineer Internet Central Limited Visit us now for all your Internet solutions - www.netcentral.co.uk WebSupport: www.support.netcentral.co.uk Email: leigh.geary@netcentral.co.uk Direct: 01782 667761 Support: 01782 667766 Sales: 01782 667788 Fax: 01782 667799 This communication is confidential to the addressee shown in the main text of the message. It must not be disclosed to or used by anyone other than the addressee unless disclosure is a legal requirement or has been agreed to by a separate written agreement. The company scans for but accepts no responsibility for viruses and it is the addressees responsibility to scan attachments ____________________________________ -----Original Message----- From: owner-support@mail.keele.netcentral.co.uk [mailto:owner-support@mail.keele.netcentral.co.uk]On Behalf Of Bob Arnesen Sent: Wednesday, October 02, 2002 7:05 PM To: lir-wg@ripe.net Subject: [lir-wg] Static IP addresses We live in Stockholm, Sweden and have the big government telephone company TELIA as our ISP. We have had internet services through their ADSL for a little over a year now and to my surprise I have recently found out that Telia has assigned us a fixed IP address. Every time we log on to the internet we start surfing with the same IP address every time. From a security and personal integrity point of view we may as well be surfing with our Social Security Numbers if thats the case. Of course dealing with a company the size of Telia you are immediately in David against Goliath position, and their position up to now is to just jack us around and assume no responsibility. When we had the old 56K modem and even ISDN, every time we got on the net we had a new IP address. Impossible to trace us and our surfing habits to a specific number. But not so with Telias ADSL. My questions are the following: q Is Telias current practice as I have described considered a breach of privacy for the private person/customer? q Is Telia following agreed International and /or European standards regarding IP addresses? q Am I able to lodge a formal complaint against such practices, either at the Ripe 44 meeting in Amsterdam in January or somewhere else? I do hope that The LIR-WG will be able to provide me with some answers. Regards, Robert Arnesen _____________________________________________________________________ This message has been checked for all known viruses by the MessageLabs Virus Control Centre. Service supplied by Internet Central http://www.internet-central.net
On Wed, Oct 02, 2002 at 08:05:22PM +0200, Bob Arnesen wrote:
We live in Stockholm, Sweden and have the big government telephone company TELIA as our ISP. We have had internet services through their ADSL for a little over a year now and to my surprise I have recently found out that Telia has assigned us a fixed IP address. Every time we log on to the internet we start surfing with the same IP address every time. This is how the Internet was designed over 30 years ago and how it is supposed to work.
From a security and personal integrity point of view we may as well be surfing with our Social Security Numbers if thats the case. Of course dealing That is a ridiculous statement. You don't use your IP address to formally or legally identify yourself like you do with Social Security Numbers. From a security and personal integrity point of view it would be much more appropriate for you to complain and protest about how Social Security Numbers are (mis-)used nowadays in many countries for purposes that they were not meant to (like authentication and autorization in the private sector). Giving people a static IP address is a *nice* thing to do. Dynamic addresses are a way to multiplex a scarce resource, and *not* a way to protect your personal integrity or privacy. Dynamic addresses basically provide you with a one-way service while a static IP address makes you fully connected to the Internet with a two-way service (just like a stable telephone number does for your mobile).
on the net we had a new IP address. Impossible to trace us and our surfing habits to a specific number. But not so with Telias ADSL. Non-sense. It is very easy to trace you. That has little to nothing do with static or dynamic allocation of IP addresses. Nobody uses IP addresses to trace people or consumers behaviour, right now. There are much easier and reliable ways, like cookies, invisible anchors in WWW-pages or other similar techniques at the application level. Some comments:
1. Your service provider can always trace you (independent of the technology used). Your protection should be legal or contractual, not technical. 2. The only way to not be identified and be somewaht untraceable for the other end of your surfing connection is by not talking to them directly, but bury yourself in the noise of a big crowd (that is not homogeneous). In practice this means you need to surf through an anonymizing proxy that strips your connection/communication of all (or most) of the bits that can identify you (this is actually technically near impossible). Many people use regular proxies (even without knowing it) because the ISP has set them up to save bandwith. Very few use (or will use) proxies that have as main goal to anonimize their clients. 3. Anonymity is not a legal nor moral right in most (if not all) civilizations and societies, including the Western democracies. Anonymity is not the same as privacy or personal integrity, and sometimes it is the opposite (e.g. when a marketing company calls me I experience that as a violation of my privacy and an invasion into my private sphere, while they typically use the `privacy-protecting' feature of caller-ID blocking to hide their identity). 4. Your ISP is not responsible for your privacy *in general*. They are legally and morally responsible for protecting the information they have collected about you (for example personal info, billing info or logs of their portal or servers).
Is Telias current practice as I have described considered a breach of privacy for the private person/customer? Surely not.
Is Telia following agreed International and /or European standards regarding IP addresses? Of course.
Am I able to lodge a formal complaint against such practices, either at the Ripe 44 meeting in Amsterdam in January or somewhere else? Are you able to do so for getting a telephone number that never changes when you subscribe to a telephone service? I think not.
I do hope that The LIR-WG will be able to provide me with some answers. Regards,
Feico Dillema. - Data Snekker - Department of Computer Science - University of Tromsø
On Wed, 2 Oct 2002, Bob Arnesen wrote:
to my surprise I have recently found out that Telia has assigned us a fixed IP address.
From the RIPE policy perspective, ADSL is sitting in the vacuum between dial-in (needing dynamically assigned addresses) and leased
Yes ... as that's the case with most of the ADSL providers elsewhere. line access (where static addresses are justifiable). ADSL is, in fact, an "always on" kind of service and thus usage of statically assigned IP addresses is justified (see ripe-234 - section 5.2.2). Most customers, however, seem to like this. Of course, for people who dislike it there might always be a solution but it's up to your ISP to implement it. There is no policy that would force the ISP to do it though. Current RIPE policies primarily deal with conservation of public IP addresses, since they are a limited resource. Privacy issue is an interesting aspect and probably deserves some attention, but noone addressed it so far. RIPE policies are created and modified by a wide community of Internet users. Anyone interested to voluntarily participate in the policy making process is welcome to join and contribute - either by attending the meetings or participating on the mailing lists. The process itself is based on general consensus. Be, however, aware that neither RIPE, nor RIPE NCC will deal with any complaints about how ISPs are doing their business and treating their customers. Your national telecom regulator is the proper authority for such things. For Sweden - try PTS (www.pts.se). Hope this helps. Regards, Beri --------- Berislav Todorovic, Senior IP Specialist -------- ----- KPN Eurorings B.V. - IP Engineering/NOC/Support ----- ---- Wilhelmina van Pruisenweg 78, 2595 AN Den Haag, NL ---- ----- Email: beri@eurorings.net <=> beri@EU.net ----
On Thu, 3 Oct 2002 11:23:16 +0200 (MET DST) Berislav Todorovic <beri@eurorings.net> wrote:
On Wed, 2 Oct 2002, Bob Arnesen wrote:
to my surprise I have recently found out that Telia has assigned us a fixed IP address.
Yes ... as that's the case with most of the ADSL providers elsewhere.
From the RIPE policy perspective, ADSL is sitting in the vacuum between dial-in (needing dynamically assigned addresses) and leased line access (where static addresses are justifiable). ADSL is, in fact, an "always on" kind of service and thus usage of statically assigned IP addresses is justified (see ripe-234 - section 5.2.2).
Telia assigns IPs with DHCP but they try to lock it to the users MAC adress, so I don't see that as a problem. They try to assign the same IP as often as possible since most users like that, the adress is locked to the MAC but is released if that MAC isn't avaliable after a few hours /John
Hi, On Thu, Oct 03, 2002 at 11:23:16AM +0200, Berislav Todorovic wrote:
From the RIPE policy perspective, ADSL is sitting in the vacuum between dial-in (needing dynamically assigned addresses) and leased line access (where static addresses are justifiable). ADSL is, in fact, an "always on" kind of service and thus usage of statically assigned IP addresses is justified (see ripe-234 - section 5.2.2).
Just to clarify this. Dial-In does NOT NEED TO USE dynamic IP addresses. Neither does cable modem. The "issue" about dial-in customers is just that ISPs are usually unwilling to enter all their individual IP assignments into the RIPE database, and so it's much easier to go down the dynamic dial-in route.
From the RIPE policy standpoint, there is NO difference between dial-in, ADSL, cable, leased lines, and whatever technologies people use to hook up to the net.
Gert Doering -- NetMaster -- Total number of prefixes smaller than registry allocations: 47686 (47095) SpaceNet AG Mail: netmaster@Space.Net Joseph-Dollinger-Bogen 14 Tel : +49-89-32356-0 80807 Muenchen Fax : +49-89-32356-299
On Thu, 2002-10-03 at 15:12, Gert Doering wrote:
The "issue" about dial-in customers is just that ISPs are usually unwilling to enter all their individual IP assignments into the RIPE database, and so it's much easier to go down the dynamic dial-in route.
From the RIPE policy standpoint, there is NO difference between dial-in, ADSL, cable, leased lines, and whatever technologies people use to hook up to the net.
However for dialup it's generally a more effcient use of IP space to use dynamic pools due the contention of the service (ie 20:1 modem ratios and the like). With ADSL and other fixed circuit technologies the connection often uncontended at the port level (bandwidth is a different issue) so allocating static/semi-static IPs make sense as the savings in IP space usage are likely to be less or nil. Mark -- The Flying Hamster <hamster@korenwolf.net> http://www.korenwolf.net/ I like to travel to other countries and make new friendships based on trust and mutual understanding. - Ghengis Kahn
Hi, On Thu, Oct 03, 2002 at 03:17:03PM +0100, Mark Lowes wrote:
On Thu, 2002-10-03 at 15:12, Gert Doering wrote:
The "issue" about dial-in customers is just that ISPs are usually unwilling to enter all their individual IP assignments into the RIPE database, and so it's much easier to go down the dynamic dial-in route.
From the RIPE policy standpoint, there is NO difference between dial-in, ADSL, cable, leased lines, and whatever technologies people use to hook up to the net.
However for dialup it's generally a more effcient use of IP space to use dynamic pools due the contention of the service (ie 20:1 modem ratios and the like).
It might be more efficient, yes. As people are doing it with ADSL connections for "home users", that are not really "always on". On the other hand, you can have dialup connections that are demand-dialled from the ISPs side if a packet for that customer arrives. Those certainly need a static IP. Nevertheless: my point is that the RIPE policies do *not* force that upon an ISP. It's their decision whether they want to do dynamic addressing or not, regardless of the technology used. Gert Doering -- NetMaster -- Total number of prefixes smaller than registry allocations: 47686 (47095) SpaceNet AG Mail: netmaster@Space.Net Joseph-Dollinger-Bogen 14 Tel : +49-89-32356-0 80807 Muenchen Fax : +49-89-32356-299
On Wed, Oct 02, 2002 at 08:05:22PM +0200, Bob Arnesen <bob.arnesen@telia.com> wrote a message of 288 lines which said:
Telia has assigned us a fixed IP address. Every time we log on to the ... * Am I able to lodge a formal complaint against such practices, either
It is very funny. In most cases, people want a fixed IP address. In France, expect Nerim, *all* ADSL providers make you *pay* an extra if you want a fixed IP address.
On 2002-10-03T11:53:41, Stephane Bortzmeyer <bortzmeyer@gitoyen.net> said:
It is very funny. In most cases, people want a fixed IP address.
Except in those cases where customers want security through obscurity and don't understand networking. Sincerely, Lars Marowsky-Brée <lmb@suse.de> -- Principal Squirrel Research and Development, SuSE Linux AG ``Immortality is an adequate definition of high availability for me.'' --- Gregory F. Pfister
It isn't only in France.. In Portugal -all- ADSL providers charge you for static ip addresses, when prices can reach 40 EUR / month -only- for that. -- Nuno Vieira - <nuno@nfsi.pt> NFSi - Solucoes Internet, Lda. http://www.nfsi.pt/ -----Mensagem original----- De: owner-lir-wg@ripe.net [mailto:owner-lir-wg@ripe.net] Em nome de Stephane Bortzmeyer Enviada: quinta-feira, 3 de Outubro de 2002 10:54 Para: Bob Arnesen Cc: lir-wg@ripe.net Assunto: Re: [lir-wg] Static IP addresses On Wed, Oct 02, 2002 at 08:05:22PM +0200, Bob Arnesen <bob.arnesen@telia.com> wrote a message of 288 lines which said:
Telia has assigned us a fixed IP address. Every time we log on to the ... * Am I able to lodge a formal complaint against such practices, either
It is very funny. In most cases, people want a fixed IP address. In France, expect Nerim, *all* ADSL providers make you *pay* an extra if you want a fixed IP address.
On Thu, Oct 03, 2002 at 11:03:16AM +0100, Nuno Vieira <nuno.vieira@nfsi.pt> wrote a message of 33 lines which said:
It isn't only in France..
In Portugal -all- ADSL providers charge you for static ip addresses,
So it seems that, for most European users, convenience is more important than privacy (if we admit that the market is always right).
On Thu, 3 Oct 2002, Stephane Bortzmeyer wrote:
So it seems that, for most European users, convenience is more important than privacy (if we admit that the market is always right).
I think it is more likely that your average common user is simply unaware of possible privacy implications. Most people simply want to 'get on the net'. m [speaking for himself, not his employer]
On 2002-10-03T12:06:32, Stephane Bortzmeyer <bortzmeyer@gitoyen.net> said:
So it seems that, for most European users, convenience is more important than privacy (if we admit that the market is always right).
No worthwhile privacy is gained through dynamic IP assignment. Sincerely, Lars Marowsky-Brée <lmb@suse.de> -- Principal Squirrel Research and Development, SuSE Linux AG ``Immortality is an adequate definition of high availability for me.'' --- Gregory F. Pfister
Most ISP's use static IP's with ADSL customers. Usually a 30 bit address. Regards, ____________________________________ Leigh Geary - Internet Engineer Internet Central Limited Visit us now for all your Internet solutions - www.netcentral.co.uk WebSupport: www.support.netcentral.co.uk Email: leigh.geary@netcentral.co.uk Direct: 01782 667761 Support: 01782 667766 Sales: 01782 667788 Fax: 01782 667799 This communication is confidential to the addressee shown in the main text of the message. It must not be disclosed to or used by anyone other than the addressee unless disclosure is a legal requirement or has been agreed to by a separate written agreement. The company scans for but accepts no responsibility for viruses and it is the addressee's responsibility to scan attachments ____________________________________ -----Original Message----- From: owner-support@mail.keele.netcentral.co.uk [mailto:owner-support@mail.keele.netcentral.co.uk]On Behalf Of Stephane Bortzmeyer Sent: Thursday, October 03, 2002 11:07 AM To: Nuno Vieira Cc: lir-wg@ripe.net; Bob Arnesen Subject: Re: [lir-wg] Static IP addresses On Thu, Oct 03, 2002 at 11:03:16AM +0100, Nuno Vieira <nuno.vieira@nfsi.pt> wrote a message of 33 lines which said:
It isn't only in France..
In Portugal -all- ADSL providers charge you for static ip addresses,
So it seems that, for most European users, convenience is more important than privacy (if we admit that the market is always right). _____________________________________________________________________ This message has been checked for all known viruses by the MessageLabs Virus Control Centre. Service supplied by Internet Central http://www.internet-central.net SPAM: -------------------- Start SpamAssassin results ---------------------- SPAM: This mail is probably spam. The original message has been altered SPAM: so you can recognise or block similar unwanted mail in future. SPAM: See http://spamassassin.org/tag/ for more details. SPAM: SPAM: Content analysis details: (-4.4 hits, 7 required) SPAM: Hit! (-4.4 points) 'In-Reply-To' line found SPAM: SPAM: -------------------- End of SpamAssassin results ---------------------
On Wed, Oct 02, 2002 at 08:05:22PM +0200, Bob Arnesen <bob.arnesen@telia.com> wrote a message of 288 lines which said:
* Is Telias current practice as I have described considered a breach of privacy for the private person/customer?
When the connection is through a leased line (companies, universities, etc), it is very common that every machine has a fixed IP address. It is currently the case with my machine in my office. It seems it has never been a problem. Only dialup users were used to dynamic addresses but they are not the norm. RFC 3041 discusses a similar problem for IPv6. Most of the discussion applies to IPv4. I quote it: A more interesting case concerns always-on connections (e.g., cable modems, ISDN, DSL, etc.) that result in a home site using the same address for extended periods of time. This is a scenario that is just starting to become common in IPv4 and promises to become more of a concern as always-on internet connectivity becomes widely available. Although it might appear that changing an address regularly in such environments would be desirable to lessen privacy concerns, it should be noted that the network prefix portion of an address also serves as a constant identifier.
* Is Telia following agreed International and /or European standards regarding IP addresses?
It is not RIPE-NCC business to do anything about privacy issues.
On 02-10-2002 20:05PM, "Bob Arnesen" <bob.arnesen@telia.com> wrote: [ Telia apparently assigns static addresses to their ADSL customers ]
* Is Telias current practice as I have described considered a breach of privacy for the private person/customer?
No. In fact many would like it because it's handy when running services and it's necessary for ACLs on remote systems. But many ISPs only assign IP addresses dynamically using DHCP. Meanly to avoid the administrative burden that comes with statically assigned addresses.
* Is Telia following agreed International and /or European standards regarding IP addresses?
No. Naturally your ISP should respect your normal privacy rights as an individual. But that has little to do with dynamic/static IP addresses. Even if you where to get dynamic address it will be out of a limited pool.
* Am I able to lodge a formal complaint against such practices, either at the Ripe 44 meeting in Amsterdam in January or somewhere else?
The meetings are open for everyone (who pays the fee that is). But keep in mind that RIPE deals with large blocks of IP address space which they hand out to organisations (LIRs). RIPE does not deal with address assignments to individuals.
I do hope that The LIR-WG will be able to provide me with some answers.
LIR-wg deals with processes and policies to distribute address space to LIRs. I don't think it is the right platform to raise this issue. I suggest you have a look into IPv6 and it's privacy extensions. If you really think it's a problem to use the same address over and over again. IPv4 space is just to small to hide ;-) Arien
On Thu, 03 Oct 2002 13:26:58 +0200 Arien Vijn <arien.vijn@ams-ix.net> wrote:
On 02-10-2002 20:05PM, "Bob Arnesen" <bob.arnesen@telia.com> wrote:
[ Telia apparently assigns static addresses to their ADSL customers ]
* Is Telia_s current practice as I have described considered a breach of privacy for the private person/customer?
No. In fact many would like it because it's handy when running services and it's necessary for ACLs on remote systems.
But many ISPs only assign IP addresses dynamically using DHCP. Meanly to avoid the administrative burden that comes with statically assigned addresses.
Telia uses DHCP but they tend to lock it to the MAC and the users like that.
* Is Telia following agreed International and /or European standards regarding IP addresses?
No. Naturally your ISP should respect your normal privacy rights as an individual.
But that has little to do with dynamic/static IP addresses. Even if you where to get dynamic address it will be out of a limited pool.
* Am I able to lodge a formal complaint against such practices, either at the Ripe 44 meeting in Amsterdam in January or somewhere else?
The meetings are open for everyone (who pays the fee that is).
But keep in mind that RIPE deals with large blocks of IP address space which they hand out to organisations (LIRs). RIPE does not deal with address assignments to individuals.
I do hope that The LIR-WG will be able to provide me with some answers.
LIR-wg deals with processes and policies to distribute address space to LIRs. I don't think it is the right platform to raise this issue.
Yes you are right. susning.nu/telia there's some good info in Swedish /John
I suggest you have a look into IPv6 and it's privacy extensions. If you really think it's a problem to use the same address over and over again. IPv4 space is just to small to hide ;-)
Arien
Hi, On Wed, Oct 02, 2002 at 08:05:22PM +0200, Bob Arnesen wrote:
My questions are the following:
* Is Telias current practice as I have described considered a breach of privacy for the private person/customer? * Is Telia following agreed International and /or European standards regarding IP addresses? * Am I able to lodge a formal complaint against such practices, either at the Ripe 44 meeting in Amsterdam in January or somewhere else?
I do hope that The LIR-WG will be able to provide me with some answers.
Your approach is *interesting*. Usually people are quite happy if they can get a fixed IP address at all (which could be used to provide services, set up a VPN connection to your home network from abroad, and whatnot), and the cheap DSL services *usuall* provide only dynamic IP addresses. I don't think there is anything formally wrong with providing you a static IP address, so there is no basis for a "formal" complaint. As for the privacy concerns - there are worse things than tracking IP addresses (HTML cookies, web bugs, and so on) - you might want to check services as www.anonymizer.com that have been set up to handle exactly all those issues. Gert Doering -- NetMaster -- Total number of prefixes smaller than registry allocations: 47686 (47095) SpaceNet AG Mail: netmaster@Space.Net Joseph-Dollinger-Bogen 14 Tel : +49-89-32356-0 80807 Muenchen Fax : +49-89-32356-299
participants (15)
-
Arien Vijn -
Berislav Todorovic -
Bob Arnesen -
Feico Dillema -
Gert Doering -
John Angelmo -
Kurt Erik Lindqvist -
Lars Marowsky-Bree -
Leigh Geary -
Mally Mclane -
Mark Lowes -
Mark S. Guz -
Nuno Vieira -
Stephane Bortzmeyer -
Webmaster