Re: On-path attackers (Was: Re: Diversity and offensive terminology in RFCs)

[Kathleen Moriarty <[e-mail]>]

On Fri, Sep 21, 2018 at 2:12 AM Jari Arkko <[e-mail]> wrote:

> Evan, Carsten, John, Yoav,
>
> > On Thu, Sep 20, 2018 at 09:10:51PM +0200, Carsten Bormann wrote:
> >> The up-to-date term of art is “middleperson attack”
> >
> > Perhaps "on-path attack".
>
>
> I agree.
>
> I have actually preferred the use of the "on-path attacker” for a long
> time, for reasons not associated with this thread. While I have certainly
> used the term man-in-the-middle (and it is a widely understood term), for
> some reason I have found it imprecise. With “on-path” I can be accurate
> about the location of the attacker. It is also IMHO more nicely enhanced
> with additional qualifiers and variations:
>
> on-path attacker
> on-path active attacker
> on-path passive attacker (or eavesdropper)
> off-path attacker
>

This sounds like a good suggestion to me, a direct and to the point
description.

Thanks,
Kathleen

>
> The principle that should apply is the description of something in clearly
> understandable language, using the characteristics of that something. And
> adding gender to those characteristics is just technically wrong, as John
> points out below.
>
> (There may be some other common attacks that deserve a good term. Or maybe
> I just don’t know what the term is. E.g., what is the name of an attack
> where there’s a central server between users, and it is the server that
> misbehaves?)
>
> > As an
> > example, I've always found "man-in-the-middle" terminology
> > problematic, but at least as much because it implies human
> > intervention rather than something more automated as because of
> > gender.
>
> +1
>
> > I don’t think we are promoting inclusiveness by resorting to obscure
> mythology
>
> +1
>
> Jari
>
>

-- 

Best regards,
Kathleen