Re: [Madinas] identities for legitimate devices

[Michael Richardson <[e-mail]>]

Stephen Farrell <[e-mail]> wrote:
    > On 04/11/2020 19:20, Michael Richardson wrote:
    >> Is your objection based upon privacy implications of a device doing
    >> EAP-TLS with a home router?

    > I didn't make an "objection" - I noted that in many cases authorisation
    > without identification is possible and sufficient. I do think that, in
    > general, we ought be far slower than we are to try create new
    > identifiers or identifications, if those aren't needed. Indeed, MAC
    > address randomisation is an example of removing a long-lived hard-coded
    > hard-to-change identifier that no user even knows exists, and that's
    > one non-trivial reason to like MAC address randomisation.

Thank you.
And your skepticism is noted.

    > On 04/11/2020 18:03, [e-mail] wrote:
    >> I'm afraid that more is needed for the home network. Think about all
    >> the CPEs that display the map of connected devices (and that a user
    >> can manage), assign a static IP address for specific machines, program
    >> time slots when connectivity access is allowed for some devices,

    > I don't have any data on how many such CPEs are deployed, but
    > especially not on how much such features are used.  Data on that could
    > be a useful input to the discussion. I don't believe usage is common
    > for ISPs with which I'm familiar, but that could vary from place to
    > place and/or I could be wrong.

I think that that many of us techies are isolated from this kind of thing
because we deal with ISPs that don't force this on us.
These CPE features are becoming more common among ISPs that have a more
captive market, and it is because they can push things on relucant users.
Sometimes it's for their benefit, sometimes not.

    > On 04/11/2020 18:03, [e-mail] wrote:
    >> or future deployments where a specific DoH URI Template can be
    >> returned to one child PCs, etc.

    > I'm just making a wild guess here - but I'd say this BoF might be
    > easier if we avoid the third rail of DoH deployment arguments and leave
    > discussion of those to the ADD WG:-)

Yes, we don't have to discuss the plus or negative of a specific policy, but
we do need to agree that we need a hook on which to hang per-device policy.

I have regularly banned my child's devices by MAC address at certain times of
the evening ("school nights") to enforce no-screen-after-supper (But, he can
watch "TV" with us).
I have stopped this for three reasons:
  0) does bedtime have any meaning in a pandemic?
  1) I can not ban youtube while enabling google docs for school
  2) his phone has a data-SIM card, and the damn LTE provider won't give me
     a time-of-day-use-restriction
  3) nobody else knows how to override it on a single-use case basis
     [see #1]

I sure wish that there was a standard API for this.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide