chris-wood / ip-reputation Goto Github PK

(I'm being a little pedantic, sorry in advance).

This document is called IP Reputation, is IP shorthand for IP address? I'm asking because it talks about how IP addresses are used in calculating a reputation, and then the introduction section concludes by saying clients could present proof of reputation that is separate from the IP address, and uniquely bound to a given connection. However, Identity is specifically defined as Any identifying information about an end-user or service [...] including IP addresses.

Questions:

1. Should the definition of Identity be possibly including IP addresses?
2. Can this document decouple Reputation/Identity and IP addresses, or are they fundamentally coupled such that the IP address will always influence a Reputation (even if only by a small amount)?
3. Should this document be renamed as (something like) Client/Connection Reputation, instead of IP Reputation?

Obviously, I want to completely decouple IP addresses and reputation, and I'd like to work towards realizing the ideal solution you described at the end of the intro.

The Terminology section defines:
Identity: Any identifying information about an end-user or service, be it a client or server, including IP addresses.

But the only place I see identity referenced is in:
A reputation signal MUST NOT be linkable to any identifying information for which the signal corresponds.

Should/Can Identity be used more concretely? Does that require another entity that derives a reputation from an Identity and other parameters?

IP reputation harms more users than those who use Tor. While Tor is a prime example of why an IP address is not (and should not be) associated with a specific user, VPN users face a similar problem. The introduction could become a little more motivating if it is less Tor-specific, and focuses on the general proxying case (regardless of Tor, commercial VPN, CGNAT, etc.).

PrivacyPass provides a nice example of this, where it was originally designed for the Tor Browser use case, it is now used by 100k+ VPN users.