Re: [radext] Fwd: RE: Fwd: RE: Fwd: RE: Mail reguarding draft-ietf-radext-dynamic-discovery

[Alan DeKok <[e-mail]>]

Stefan Winter wrote:
> It also just occured to me that your attack is too complex to be useful
> for an attacker; it would require actual humans lured into trying to log
> into realmA in masses, so that their login attempts overload proxy B. It
> would require hundreds or thousands of humans trying to log in per
> second so that proxy B feels the load.

  I suppose there are no companies with 10M customers, and imperfect
administrators?

> If realmA really wants to DoS proxy B, they would take note of proxy B's
> IP address and port, and hire a cheap botnet. The botnet would simply
> not care whether there is a reverse IP to check.

  I'm not trying to make perfect security.  I'm trying to make it
cheaper to catch mistakes.

> In short... once your server is up in the open, it can be contacted by
> anyone, like it or not. An implementation needs to cope with that.

  Yes.  There's no question there.

  I would like to discover *misconfiguration* quickly.  A reverse IP
check is cheap.  It's more expensive to have 100K customers hit your
proxy because an admin mis-configured something.

  Alan DeKok.