Re: [dnssd] Security through Obscurity

[Tim Chown <[e-mail]>]

On 24 Jul 2014, at 02:27, Douglas Otis <[e-mail]> wrote:

> 
> On Jul 23, 2014, at 4:51 PM, RJ Atkinson <[e-mail]> wrote:
> 
>> 
>> (NOTE WELL: I am not a WG Chair, IESG member, IAB member,
>> or authorised spokesperson for anyone other than myself.)
>> 
>> 
>> Earlier Doug Otis wrote:
>>> It is not safe to advertise such addresses in DNS, 
>>> especially when security depends on address obscurity.
>> 
>> 
>> I believe that the the vast majority of security folks
>> would object to the notion that obscurity is a mechanism 
>> capable of providing any meaningful security.
>> 
>> If a client were to ask me for advice on protecting their
>> interior services or interior devices from the global Internet, 
>> I would suggest at least a firewall (ranging from router ACLs 
>> to an air-gap: depending upon their local needs and threat model) 
>> and possibly also other measures (again, depending upon local
>> needs and threat model).  Operational security is not 
>> one-size-fits-all, in my experience, but relying upon 
>> security-through-obscurity seems unwise to me.
> 
> I agree with that statement, but at the same time some of these devices are assigned routable addresses by the vendors.  When assigned out of a 48 bit space, it might be possible to guess the device based on common manufacturers.  When randomly assigned by the owner, it is highly unlikely such an address will ever be guessed.  Add rate limiting, and this unknown should work well at mitigating attack.  But as I said, I agree with your statement and why I think mDNS should be working with ULAs.

Doug, if you mean a 48-bit MAC address being embedded in the IPv6 address, see http://tools.ietf.org/html/rfc7217.

I agree with Tom’s comments. A question to discuss in your slot today is when a device has a LL, ULA and GUA, which of those should be advertised via the SD protocol and whether/how that choice can/should be influenced. 

Tim