Re: [dnssd] Security through Obscurity

["Albrecht, Harald" <[e-mail]>]

Hello,

could it be, per chance, that there are different views on what "publishing" a device's IP address to DNS means? Maybe about what to publish where?

I have problems understanding what publishing a devices " IPv6 public address" (cit) really means? I have learnt that there are GUAs, ULA, LLAs, but what are public addresses? One could argue that publishing an address in itself constitutes public addresses, but that's most probably not helping either. I don't see that publishing an address also automatically constitute its accessibility. To me, a RR dictionary does not constitute security either. If it would, then something would be severely broken.

> -----Ursprüngliche Nachricht-----
> Von: Douglas Otis [mailto:[e-mail]]
> Gesendet: Dienstag, 29. Juli 2014 02:02
> An: Kennedy, Smith (Wireless Architect)
> Cc: Douglas Otis; Albrecht, Harald; [e-mail]; Michael Richardson
> Betreff: Re: [dnssd] Security through Obscurity
> 
> Agreed.  For example, most printers do not offer user specific security
> measures for their basic operation.  Such user specific secure printing is
> normally done indirectly by accessing shared OS resources offered by a
> server able to establish TLS connections.  The indirectly accessed devices do
> not themselves authenticate for scanning, printing, or faxing in most cases.
> This means publishing their IPv6 public addresses will invite abuse.

Are you talking about abuse by internal users, the users that are connected to the same network? If yes, then this is not even remotely an issue of DNS-SD, this is a network design problem. Either the devices are not suitable for the requirements of safety or the network design is not suitable to cope for end-device misdesign. Either way, DNS-SD and global addresses are wrong trees to bark up.

 >  This is
> only one example of devices never intended to be directly accessible on the
> Internet, and which may be subject to abuse when DNS-SD is used
> indiscriminately.
This is mixing things. Having a global address does not imply global accessability! What does you make believing so? As I'm typing this, my computer has its very own global IPv4 address (ups, shame on me!), yet you won't be ever able to reach it. Yes, I use a unique global IPv4 address ... inside the company intranet. And it's not a private address. So there clearly are secure setups that use global addresses and use DNS-SD and no one drops dead.

> Insecurely assigned prefixes and randomly assigned Interface-IDs never
> being publicly published still offers weak security.  Multiple off-the-shelf
> home routers should be expected to use dynamically assigned prefixes, since
> some insist dynamic prefix assignment improves privacy.  (Some providers
> bind prefix assignments with the MACs used by the modem where any MAC
> change necessitates an approval process.)  Without use of ULA overlay
> addressing in such a home network, firewalls will remain susceptible when
> unable to recognize internal IP addresses, and hence unable to block
> externally initiated sessions.

You are mixing different things here, so it's difficult to understand what your point actually is. First, what are insecurely assigned prefixes?? And yes, IIDs are not for security ... they have one clear purpose: to identify a particular IPv6 interface in a given subnet. So this is as obvious as saying that assigning your subnet routers IPv4 addresses that don't end in .1 or .254 improves security.

ULA addresses are not for security, please show me the RFC that does claim so. Over time, people have come to understand that ULAs offer stable intranet addressing. But what does stable addressing has to do with security? I can't understand why you are mixing up all these different things, it's really hard to understand for me.

> On the other hand, enterprise networks likely have statically assigned
> prefixes.  While static assignment or known router prefix assignment
> information allows greater use of GUA addressing, exploits may still defeat
> stateful src/dst firewall protections.

Should I read this as a plea to move to end-to-end transport security and authentification? If you are arguing for this, then yes, this offers better security. But from your current wording I'm really not clear about what you are trying to argue for. But again, please don't kill the GUAs for something they didn't do.

LG, Harald