Re: [proxies] [IETF Proxy] Next Steps

Stefan Winter <> Tue, 06 May 2008 06:53 UTC

Return-Path: <>
Received: from (localhost []) by (Postfix) with ESMTP id 6A8AE3A6B7E; Mon, 5 May 2008 23:53:33 -0700 (PDT)
Received: from localhost (localhost []) by (Postfix) with ESMTP id D64643A6F69 for <>; Mon, 5 May 2008 23:53:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -0.185
X-Spam-Status: No, score=-0.185 tagged_above=-999 required=5 tests=[BAYES_40=-0.185]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 5Kxz3kdE1rFI for <>; Mon, 5 May 2008 23:52:59 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 369393A6F4C for <>; Mon, 5 May 2008 23:52:22 -0700 (PDT)
Received: from (localhost []) by (Postfix) with ESMTP id C497A30276C0; Tue, 6 May 2008 08:52:20 +0200 (CEST)
Received: from [] ( []) by (Postfix) with ESMTP id B4B5E3027248; Tue, 6 May 2008 08:52:20 +0200 (CEST)
Message-ID: <>
Date: Tue, 06 May 2008 08:52:20 +0200
From: Stefan Winter <>
User-Agent: Thunderbird (X11/20080226)
MIME-Version: 1.0
To: Dan Harkins <>
References: <> <> <>
In-Reply-To: <>
X-Enigmail-Version: 0.95.6
X-Virus-Scanned: ClamAV using ClamSMTP
Subject: Re: [proxies] [IETF Proxy] Next Steps
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Discussion list for ad hoc group interested in security and proxies <>
List-Unsubscribe: <>, <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

Hash: SHA1

Hi dan, all,

|   It has been pointed out to me that I may be misunderstanding Stefan's
| intent by latching on the word "political" and running with it.

Well, I wondered myself if my choice of word was good. In fact, I was
not refering to political as in: laws, jurisdiction, courts, prime
ministers, presidents... but as in non-technical, managerial,
financial-driven, contractual-driven etc.

|   I do not mean to attack any valid uses of proxies that may fall under
| the "political" rubric but I do believe there are threats that should
| be enumerated for proxies that can do things like compile databases of
| information gleaned from AAA traffic that goes through them, or locate
| and track people. And the mention of "political" requirements brought
| that up (in my mind at least).

To elaborate on what my notion "political" in our scenario concretely
means, here an example: the eduroam community is primarily intended for
higher education and research, which excludes secondary school pupils.
Some countries however deploy eduroam in such schools, and hand out
accounts which work internationally for their teachers, but only
nationally valid accounts for the pupils in order not violate
international peering agreements but still give service to the pupils.

That is perfectly fine with eduroam international, as long as these
countries can make sure these local accounts stay local. The means to
enforce this is in practice by using a national proxy which knows which
realms belong to pupil database backends and which not. That is IIRC the
main reason for the one country that insists on having everything go
through its national proxy.

We recently have overcome this by loosening the peering agreement so
that everyone considered a valid user in one country is also valid for
roaming in all others, but this now re-opens the age verification
problem at a larger scale :-/


Version: GnuPG v2.0.4-svn0 (GNU/Linux)
Comment: Using GnuPG with SUSE -

Proxies mailing list