Re: [proxies] [IETF Proxy] Next Steps

Dan Harkins wrote:
>   This political proxy thing concerns me. The only traffic that a AAA proxy
> could inspect, control or modify is AAA traffic.

  I think that's what Stefan meant.

  In the commercial world, proxies do this, too.  A visited network may
not supply information in a form needed by the home network, and vice
versa.  The intermediary proxies are responsible for "fixing" the AAA
information inbound and outbound, so that everyone else doesn't have to
change their systems.

> So what this entity would
> do is glean information about who is using what network where and, in
> some cases, prevent some people somewhere from using some network.

  In Stefan's case, yes.  Some countries have their educational networks
run or coordinated from a central body.  In those countries, the body
*is* responsible, and *can* control the network.  They simply want to
use existing powers on new systems, such as AAA proxies.

  In the commercial world, proxies are contractually forbidden from
interfering with the status of the user.  They can change the contents
of the packets, but not the accept/deny status of the user.

>   These are not things that I think we _have_ to deal with especially in
> a technical forum. These are issues that a customer will require a vendor
> of AAA product to support, in much the same way that "lawful intercept"
> is a political add-on to a technical solution--

  I'd like to see a document making this distinction clear for everyone.

>   I have heard many other reasons why AAA proxies must exist. If a magic
> wand made all those reasons disappear I really hope this political
> justification would not keep them around. (Note: I'm not entertaining the
> notion of getting rid of proxies, just theorizing, so don't attack me).

  Proxies won't be disappearing.  Business politics and efficiencies
mean that it's often easier && cheaper to outsource to a dedicated AAA
proxy.

>   This does highlight threats though. It's not just that proxies can
> listen to AAA exchanges, they can glean information out of AAA exchanges,
> and they can constrain or deny service that should otherwise be
> unconstrained or allowed.

  Absolutely.

  Alan DeKok.
_______________________________________________
Proxies mailing list
Proxies@ietf.org
https://www.ietf.org/mailman/listinfo/proxies