Re: [dtn-security] How do you feel about Bonjour/Avahi?

[Peter Lovell <[e-mail]>]

On Thu, Jul 9, 2009, Graham Keellings (Leonix Solutions Pte Ltd)
<[e-mail]> wrote:

> From a security standpoint?
>
>How secure is it to have all of my nodes blaring "here I am, bad guys,
>come and try to connect to me"?
>
>Would I be safer just using hard coded IP address?
>
>Thanks in advance for any opinions.
>
>~graham();


Hi Graham,

it depends.

Mostly it depends upon the definition you have in mind for "security".

In typical discussions, security encompasses integrity, confidentiality
and availability. Various organizations will prioritize those differently.

Many commercial transactions will place integrity uppermost, although
those containing sensitive personally-identifying data may have
confidentiality above all. Thinking about a personal stock trade account
as an example - my purchase instruction for a thousand shares of some
company is not very secret but the brokerage really does want to know
that it is accurate and came from me.

If I'm the exclusive retailer for a top-selling low-priced widget, I'll
probably tolerate some fraudulent transactions but I *really* need my
web site to be up all the time, taking orders.

If I'm part of law enforcement, I'll probably value confidentiality most
highly (although the courts may emphasize integrity and chain-of-custody
for evidence).

Bonjour is just a service discovery protocol, not a part of a security
system. And it's localized so that only your neighbours know. It
shouldn't make any difference to integrity or confidentiality as those
should be handled by the defenses you have deployed. At a stretch, it
might make adversaries aware of your system but if they see Bonjour
advertisements then they're close to you already and can see your
network traffic.

Bonjour and static IP addresses are solutions to different problems. An
IP address allows a system to send something to you. Bonjour allows a
nearby system to find you if it doesn't know your address.

If you are sensitive about denial-of-service attacks then I would
suggest strongly that you do not use a hard-coded IP address, but
specify a dns address instead.

Regards.....Peter