Re: [Captive-portals] Fwd: [Last-Call] Secdir last call review of draft-ietf-capport-rfc7710bis-04

Benjamin Kaduk <kaduk@mit.edu> Mon, 11 May 2020 04:52 UTC

Return-Path: <kaduk@mit.edu>
X-Original-To: captive-portals@ietfa.amsl.com
Delivered-To: captive-portals@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44C883A07AC; Sun, 10 May 2020 21:52:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.413
X-Spam-Level:
X-Spam-Status: No, score=-0.413 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FAKE_REPLY_C=1.486, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1pi6zS7GCjvv; Sun, 10 May 2020 21:51:57 -0700 (PDT)
Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CCD563A07A9; Sun, 10 May 2020 21:51:56 -0700 (PDT)
Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 04B4ppGc009041 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 11 May 2020 00:51:53 -0400
Date: Sun, 10 May 2020 21:51:50 -0700
From: Benjamin Kaduk <kaduk@mit.edu>
To: Martin Thomson <mt@lowentropy.net>, Rifaat Shekh-Yusef <rifaat.ietf@gmail.com>
Cc: Erik Kline <ek@loon.com>, draft-ietf-capport-rfc7710bis.all@ietf.org, captive-portals@ietf.org, secdir@ietf.org
Message-ID: <20200511045150.GI27494@kduck.mit.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <85873c75-0d4d-4ec5-91a1-a28b92378ec3@www.fastmail.com>
User-Agent: Mutt/1.12.1 (2019-06-15)
Archived-At: <https://mailarchive.ietf.org/arch/msg/captive-portals/1_0pxC4qgPqBKcopF-1CzT6C3Sc>
Subject: Re: [Captive-portals] Fwd: [Last-Call] Secdir last call review of draft-ietf-capport-rfc7710bis-04
X-BeenThere: captive-portals@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Discussion of issues related to captive portals <captive-portals.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/captive-portals>, <mailto:captive-portals-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/captive-portals/>
List-Post: <mailto:captive-portals@ietf.org>
List-Help: <mailto:captive-portals-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/captive-portals>, <mailto:captive-portals-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 11 May 2020 04:52:01 -0000

[adding back some lists]

-Ben

On Wed, May 06, 2020 at 02:37:39PM +1000, Martin Thomson wrote:
> What does "extra cautious" mean?  I assume that this is intended to apply to what a human might do, further implying that there is a role for a human decision. 
> 
> None of this architecture requires the involvement of a human in this way. Nor do I think that there is any meaningful distinction between an opaque string of characters (that might include confusables) and an opaque string of digits.
> 
> I appreciate the sentiment here, but the fundamental problem is that once you decide that this information is not from the network, it is useless. If it is from the network, it is only of limited use. That use cannot depend on the identity of the server, so there is no value in any sort of caution.
> 
> On Wed, May 6, 2020, at 13:36, Benjamin Kaduk wrote:
> > [My unicast reminder got a unicast reply; forwarding to someplace at least
> > vaguely useful.]
> > 
> > -Ben
> > 
> > On Tue, May 05, 2020 at 07:57:14PM -0400, Rifaat Shekh-Yusef wrote:
> > > Thanks for the reminder Ben.
> > > 
> > > Erik,
> > > 
> > > Since this document allows the use of IP address to represent the portal
> > > URI, I think it would important to add some text that explicitly states
> > > that the user might be presented with an IP address instead of the hostname
> > > of the API, and in that case the user should be extra cautious when this
> > > happens.
> > > 
> > > Regards,
> > >  Rifaat
> > > 
> > > 
> > > 
> > > 
> > > On Tue, May 5, 2020 at 7:30 PM Benjamin Kaduk <kaduk@mit.edu> wrote:
> > > 
> > > > Hi Rifaat,
> > > >
> > > > I just wanted to follow-up and check that you had received Erik's question.
> > > >
> > > > Thanks,
> > > >
> > > > Ben
> > > >
> > > > On Sun, May 03, 2020 at 02:58:29PM -0700, Erik Kline wrote:
> > > > > Rifaat,
> > > > >
> > > > > Thanks for your reading of the document.
> > > > >
> > > > > The security section has a paragraph that begins:
> > > > >
> > > > > """
> > > > >    An attacker with the ability to inject DHCP messages or RAs could
> > > > >    include an option from this document to force users to contact an
> > > > >    address of his choosing.  As an attacker with this capability could
> > > > >    simply list himself as the default gateway (and so intercept all the
> > > > >    victim's traffic); this does not provide them with significantly more
> > > > >    capabilities, but because this document removes the need for
> > > > >    interception, the attacker may have an easier time performing the
> > > > >    attack...
> > > > > """
> > > > >
> > > > > Do you have any specific ideas for what text might be added to clarify
> > > > vis.
> > > > > your concern?  Would a sentence that captures your "the use of TLS and
> > > > > presenting the identity in the certificate might not be of much help"
> > > > > observation suffice?
> > > > >
> > > > > Thanks,
> > > > > -Erik
> > > > >
> > > > > On Fri, 1 May 2020 at 05:10, Rifaat Shekh-Yusef via Datatracker <
> > > > > noreply@ietf.org> wrote:
> > > > >
> > > > > > Reviewer: Rifaat Shekh-Yusef
> > > > > > Review result: Has Issues
> > > > > >
> > > > > > Since the use of IP address literal is not forbidden by this document,
> > > > > > what if
> > > > > > an attacker with the ability to inject DHCP messages or RAs uses this
> > > > > > option
> > > > > > to force the user to contact an IP address of his choosing? In this
> > > > case,
> > > > > > the use
> > > > > > of TLS and presenting the identity in the certificate might not be of
> > > > much
> > > > > > help.
> > > > > >
> > > > > > I think this case should be discussed in the security consideration
> > > > > > section.
> > > > > >
> > > > > >
> > > > > >
> > > >
> > > > > --
> > > > > last-call mailing list
> > > > > last-call@ietf.org
> > > > > https://www.ietf.org/mailman/listinfo/last-call
> > > >
> > > >
> >