Re: [87attendees] IETF wireless

[Stefan Winter <[e-mail]>]

Hi,

> Scary how many are using the unencrypted wifi.

Don't only count the ietf.1x network. The IETF also provides eduroam,
which is WPA2/AES with 802.1X and - sorry, NOC: actual server
certificate verification, not a "don't verify ours, and we won't verify
yours".

The Max numbers in the NOC report are

the 3 "secure" ones: 25+27+37 = 89
the two "edu" ones: 38 53 = 91

Which makes for a total of 180 max simultaneous encrypted connections.

Sure, compared to approx. 700 on the open networks it's not so really
great, but still quite a significant portion.

> A suggestion for next IETF would be to call the 802.1x wifi "IETF" and
> the open one "IETF_UNENCRYPTED".

Without verifying the server cert of the 802.1x network, you may well
talk to the network encryptedly, but the network might be a MitM who can
decrypt and snoop out your traffic.

The ietf.1x network is just not as good as it could be - maybe more
people would be inclined to use it if it provides the extra benefit of
being able to identify itself as *the genuine* IETF network. Neither the
open network nor the ietf.1x currently do that.

The fix would be surprisingly simple: in the Network Information page,
actually *publish* the CA cert and its fingerprint that signs the auth
server, and also publish the server's subject/subjectAltNames. This
allows every user to check whether he's on the real thing when connecting.

There are also provisioning tools that can install the CA certs and EAP
settings onto client devices. It's not rocket science.

Greetings,

Stefan Winter




-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: [phone]
Fax: [phone]