Re: [Secauth] Closing SecAuth list

Hello Kathleen,

Le 13/01/2015 14:40, Kathleen Moriarty a écrit :
> As an observer, I see that people are not coming together to solve a
>  problem in which there will be support by the community responsible
>  for the technology (wifi hotspots).

The hurdle to connect to wifi hotspots is a real problem.  Sometimes
it's impossible to connect, other times the only way to connect is an
insecure way[*].

The community responsible for the technology used in these hotspots is
divided in two: those who offer heavy web portal authentication and
those who gave up and afford no security at all.  A 3rd category of
those who offer Radius/DIAMETER-kinds of authentication exists, but has
more limited tract.

Each of these categories needs to listen to what the end user needs, not
to what the current access control technology has to offer.

To that one may add these trends:
- new GUI-less small devices come on the market - how will they connect
   to web portal hotspots where one has to fill forms in?
- new methods of authenticating with one different password token per
   device are non-scalable.

[*] : examples of insecure ways to connect to WiFi hotspots: (1)
one particular large airport wifi hotspot has no link-layer and no web
portal security; (2) during last Winter Games the password to connect to
a wifi hotspot was shown in clear on TV to world audience.

> I am also seeing disconnected threads that bring in SDN and NFV in
> the mix for device authentication without thought of how this might
> be used or connected into infrastructure and resistance to
> suggestions on how to accomplish that (if it is even needed).

If by SDN/NFV we mean OpenFlow and YANG, and knowing that any new
protocol or protocol enhancement must have a MIB feature in it, then it
does make sense to have SDN/NFV.

> I've also noticed the sporadic question, "What is SecAuth?" after
> all of the time spent and discussions, which shows others are
> confused on the goal and problem or set of problems being worked on.

Certainly.  SecAuth acronym per se is difficult to pronounce and too
generic.  But I wouldn't care for the time being.

> I appreciate the messages asking why the list is being closed.  I
> would like to see a clearly defined problem statement with agreed
> upon goals and I am not sure we will get there as it stands now since
> the conversation goes in circles and mixes the sets of problems even
> within a single response.

I agree.

> We have a few people that are actively participating, but I don't
> think they all support the work. I have noticed several  advising the
> list, pointing to other solutions in play to raise awareness of
> existing options.  I've also gotten some private notes thanking me
> for closing the list, so views are mixed here.

I agree.

I think there is need and effort ready from a particular equipment 
manufacturer, and I think there is this wifi hotspot problem; but maybe 
I am wrong, I dont know.

Alex

> We would be happy to set up a list on a defined scope with willing
> participants, but I do think people have to come to agreement on a
> narrowed goal or sets of goals.
>
> Thank you, Kathleen
>
> On Tue, Jan 13, 2015 at 6:21 AM, Yoav Nir <synp71@live.com> wrote:
>> Hi, Kathleen
>>
>> That's a strange decision IMO. I agree that the scope has not been
>>  narrowed enough to justify a BoF just yet, but the list does have
>>  some activity on it, and there does seem to be a problem in there
>>  and some people who want that problem solved.
>>
>> Closing the list sends people to either the main IETF list, the
>> SAAG list, or to form their own Google group, none of which is IMO
>>  better than the status quo ante.
>>
>> I believe that the mailing list at least should remain open for
>> now.
>>
>> Yoav
>>
>> -----Original Message----- From: Secauth
>> [mailto:secauth-bounces@ietf.org] On Behalf Of Kathleen Moriarty
>> Sent: Tuesday, January 13, 2015 1:21 AM To: secauth@ietf.org
>> Subject: [Secauth] Closing SecAuth list
>>
>> Hello,
>>
>> The SecAuth list will be closing.  Those interested to continue to
>>  identify and narrow the scope of work should get together
>> off-list. If a clear problem statement has been defined and has
>> support from the necessary communities to do the work, you can
>> check with the Security ADs to request a new list, Bof, etc.
>>
>> --
>>
>> Best regards, Kathleen
>>
>> _______________________________________________ Secauth mailing
>> list Secauth@ietf.org
>> https://www.ietf.org/mailman/listinfo/secauth
>>
>
>
>