Re: [Captive-portals] Requirements for "captive portal closed" notifications

[David Bird <[e-mail]>]

If we hammer in that the feature allows "you to reach all government
websites for free, where everything else is paid" and focus on that, we can
get more consensus. ;-)


On Tue, Mar 20, 2018 at 9:07 AM David Bird <[e-mail]> wrote:

> On Tue, Mar 20, 2018 at 9:01 AM, Lorenzo Colitti <[e-mail]>
> wrote:
>
>> On Tue, Mar 20, 2018 at 3:44 PM, David Bird <[e-mail]> wrote:
>>
>>>
>>>>    - An ICMP message by itself is not secure. For example, it's
>>>>    trivial for an off-path attacker to generate ICMP messages for sessions
>>>>    from legitimate UEs to <popularwebsite>:443. Getting a UE to trust such a
>>>>    message only requires getting the ephemeral port right, and many OSes have
>>>>    a quite limited range of ephemeral ports.
>>>>
>>>>
>>> Is there any data that shows ICMP (and its insecurity) being used for
>>> off-path attacks like this today? Networks (as they do today) may just
>>> filter out ICMP they don't support from the edge.
>>>
>>
>> Regardless of whether this is happening today, it seems unwise to propose
>> something with an obvious security hole like this. The risk is that we do a
>> bunch of work and then security review tells us "?REDO FROM START".
>>
>>
>>> 3. The notification should not be on a per-destination basis. A hint
>>>> that conveys the information "you can reach facebook, but to reach CNN you
>>>> need to upgrade to another service plan" is not technically infeasible but
>>>> is unlikely ever to reach WG and IETF consensus and therefore I think we
>>>> should not spend our time talking about it.
>>>>
>>>
>>> Can't a network have this policy irrespective of how we implement ICMP?
>>> Can't they even today just use existing ICMP messages? I cringe when we
>>> start dictating how PUBLIC ACCESS networks manage their walled garden and
>>> businesses.
>>>
>>
>> My point was that there's no use in having that discussion, because we
>> know there are strong opinions on both sides and thus we're not likely to
>> get consensus.
>>
>
>
> My point is that you are the one *making* this a discussion not likely to
> get consensus by loading the question with statements like "you can reach
> facebook, but to reach CNN you need to upgrade to another service plan"
> ...  which isn't a problem with ICMP per se, rather how you don't like how
> some public access networks operate...
>
>