Re: Scripting attacks [was Next step for draft-ietf-6man-rfc6874bis]

[Fernando Gont <[e-mail]>]

Hi, Brian,

On 30/6/22 01:40, Brian E Carpenter wrote:
> On 30-Jun-22 12:30, Ted Lemon wrote:
>> Depends what they are doing for those 3500 ms. They're definitely 
>> consuming a lot of local resources, in any case. Should a browser 
>> allow 1000 outgoing connections from a single javascript app?
> 
> I don't know. I'd have to learn more Javascript to find out ;-).
> 
> For the present draft, one thing my small experiment shows is that we 
> won't make things worse by adding zone identifiers to URLs. They too 
> have to be guessed by the attacker, and in modern Linux they are things 
> like "enxb813ebc170a4" out of the box. That makes the attacker's job 
> significantly harder.

FWIW, when testing the subnet anycast router address, one would have to 
guess the zone ID, but not the address (fe80:: or PREFIX::).

Curiously enough, ping6 works for both o them here, but telnet to port 
80 only works for PREFIX:: (feature or bug? :-) ).

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492