Re: [dnssd] I-D Action: draft-rafiee-dnssd-mdns-threatmodel-03.txt

[Douglas Otis <[e-mail]>]

On 6/1/15 12:18 AM, Hosnieh Rafiee wrote:
> There's also a htmlized version available at:
> > https://tools.ietf.org/html/draft-rafiee-dnssd-mdns-threatmodel-03
Dear Hosnieh,

This review misses a concern called out in the CERT notice
for dnssd at

https://www.kb.cert.org/vuls/id/550620

See Section 1 of
https://tools.ietf.org/html/draft-otis-dnssd-mdns-xlink-06

The threat model also overlooks data leakage beyond a local
link and DNS amplification concerns resulting from the
browse-ability offered by resource structures as explained
in the introduction and the CERT notice.

Appendix A gives an example of data leakage exploited in
Appendix B.

A mitigation practice to overcome these risks remains
unclear unless some means is made available to limit results.

Regards,
Douglas Otis