From: Michael Richardson <mcr+ietf@sandelman.ca>
To: Erik Kline <ek.ietf@gmail.com>
In-Reply-To: 
 <CAMGpriVjrRX7dA8g-NuPtF46=56=ehEPEgOqbvofZAK_LQAebQ@mail.gmail.com>
References: <11335.1751223139@obiwan.sandelman.ca>
 <C651FAFC-8884-46FA-B0B4-0D0E2330863D@apple.com>
 <27508.1751321240@obiwan.sandelman.ca>
 <CAMGpriVjrRX7dA8g-NuPtF46=56=ehEPEgOqbvofZAK_LQAebQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha512; protocol="application/pgp-signature"
Date: Wed, 02 Jul 2025 16:13:02 -0400
Message-ID: <22006.1751487182@obiwan.sandelman.ca>
Message-ID-Hash: UUF5FRHAAPG5NCWOLMLJGDFCAFEYKXKH
CC: Tommy Pauly <tpauly@apple.com>, captive-portals@ietf.org
Precedence: list
Subject: =?utf-8?q?=5BCaptive-portals=5D_Re=3A_seeking_review_comments_on_revised_CAP?=
	=?utf-8?q?PORT_considerations_in_brski-cloud?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/captive-portals/s4O9XFoekNBPQWwXgJdeSmQdZhE>

--=-=-=
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


Erik Kline <ek.ietf@gmail.com> wrote:
    >> I saw that too when editing, and I thought I changed it already.
    >> Nope. Fixed now.
    >>
    >> Any other thoughts?  Forced redirect of TLS by portals usually is
    >> detected by a certificate validation failure.  But, in 8995, we defer
    >> the verification until later on.  What I want to know is whether this
    >> explanation is reasonably communicated.
    >>

    > What are the security implications of any information leaked via the
    > voucher request?  Is it just "oooh look, here's a node that's doing
    > BRSKI" or is there some more traceable client information in there?

The voucher request is signed by the IDevID, which is included.
Both the VR and the IDevID will have device identifying information.
(They have to).  Whether that's *PII* or "just" device identity depends upon
the device.
However, at the point when this occurs, it hasn't really been personalized =
yet.

So the negative situation of disclosing the voucher request to the on-path
activev attacker (aka captive portal admin) is probably relative severe from
a privacy point of view.   Thus, getting this concern clearly articulated is
important.

    > (Clearly I haven't gone looking to refresh any ANIMA/BRSKI
    > semantics/mechanics).

The 4m screen cast got good reviews from other ADs.
Hoping Disney will pick it up for the Skeleton Crew 2nd season/Donald-Duck
cross-over.

=2D-
Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 I=C3=B8T consulti=
ng )
           Sandelman Software Works Inc, Ottawa and Worldwide

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQFKBAEBCgA0FiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmhlks4WHG1jcitpZXRm
QHNhbmRlbG1hbi5jYQAKCRCAi3D73dDdZbRJCACyue1+TWK3sg5+OReCxiw9gIyW
F5lSeJs8gVGji+wXaAbmy1jRB0A6VwEfg4IM3J51+VQcbYAVzNJCboD35SVK+sws
SxsI6U0BMfKHZIJf9/M5rQHp4I6U2sl14U0Dk2FRsRqaXS9xNm5MLwN2nPamypTv
pJ61sEVydeMUbUabKtiZuU7ADoyR5s1NUAA865pyuL/UfJXDX+UpCl4E3AttaFlb
x2Jnj1RoFN1egEEfOIcj+mUJBlFVfvFLrTwREOej6ge+RvRf6i7yMsv74vwrS2Mz
e/NGOnPsoMEUqsLAiFNjPX4R7UOb+8ih6CeqE43z2J74xKu+L1drTuKerRF2
=97rX
-----END PGP SIGNATURE-----
--=-=-=--