Re: [Secauth] Closing SecAuth list

Hi Alex,

Thanks, response in-line.

On Tue, Jan 13, 2015 at 11:16 AM, Alexandre Petrescu
<alexandre.petrescu@gmail.com> wrote:
> Hello Kathleen,
>
> Le 13/01/2015 14:40, Kathleen Moriarty a écrit :
>>
>> As an observer, I see that people are not coming together to solve a
>>  problem in which there will be support by the community responsible
>>  for the technology (wifi hotspots).
>
>
> The hurdle to connect to wifi hotspots is a real problem.  Sometimes
> it's impossible to connect, other times the only way to connect is an
> insecure way[*].
>
> The community responsible for the technology used in these hotspots is
> divided in two: those who offer heavy web portal authentication and
> those who gave up and afford no security at all.  A 3rd category of
> those who offer Radius/DIAMETER-kinds of authentication exists, but has
> more limited tract.
>
> Each of these categories needs to listen to what the end user needs, not
> to what the current access control technology has to offer.
>
> To that one may add these trends:
> - new GUI-less small devices come on the market - how will they connect
>   to web portal hotspots where one has to fill forms in?
> - new methods of authenticating with one different password token per
>   device are non-scalable.
>
> [*] : examples of insecure ways to connect to WiFi hotspots: (1)
> one particular large airport wifi hotspot has no link-layer and no web
> portal security; (2) during last Winter Games the password to connect to
> a wifi hotspot was shown in clear on TV to world audience.
>
>> I am also seeing disconnected threads that bring in SDN and NFV in
>> the mix for device authentication without thought of how this might
>> be used or connected into infrastructure and resistance to
>> suggestions on how to accomplish that (if it is even needed).
>
>
> If by SDN/NFV we mean OpenFlow and YANG, and knowing that any new
> protocol or protocol enhancement must have a MIB feature in it, then it
> does make sense to have SDN/NFV.
>
>> I've also noticed the sporadic question, "What is SecAuth?" after
>> all of the time spent and discussions, which shows others are
>> confused on the goal and problem or set of problems being worked on.
>
>
> Certainly.  SecAuth acronym per se is difficult to pronounce and too
> generic.  But I wouldn't care for the time being.
>
>> I appreciate the messages asking why the list is being closed.  I
>> would like to see a clearly defined problem statement with agreed
>> upon goals and I am not sure we will get there as it stands now since
>> the conversation goes in circles and mixes the sets of problems even
>> within a single response.
>
>
> I agree.
>
>> We have a few people that are actively participating, but I don't
>> think they all support the work. I have noticed several  advising the
>> list, pointing to other solutions in play to raise awareness of
>> existing options.  I've also gotten some private notes thanking me
>> for closing the list, so views are mixed here.
>
>
> I agree.
>
> I think there is need and effort ready from a particular equipment
> manufacturer, and I think there is this wifi hotspot problem; but maybe I am
> wrong, I dont know.

This is only one of the three problems being discussed and there isn't
enough to go forward on yet.  I'm asking that those interested go back
and collect thoughts to devise feasible options.  If this is the
problem selected, I would also need to see support from those who can
make the change (organizations running the wifi hotspots).  I don't
see the motivation for them to switch from using a captive portal,
especially since they charge for use of the infrastructure they
host/provide.  I understand this is an issue for users, but also see
that the problem is bigger and involves providers of the service (who
have not been participating in the discussion).

Is it worth it for those interested to get together on a single
problem and come back with a more clearly defined scope?  If so, it
would be great to see that happen and to see some of the concerns
addressed by getting involvement/support of service providers.

Thank you.

>
> Alex
>
>
>> We would be happy to set up a list on a defined scope with willing
>> participants, but I do think people have to come to agreement on a
>> narrowed goal or sets of goals.
>>
>> Thank you, Kathleen
>>
>> On Tue, Jan 13, 2015 at 6:21 AM, Yoav Nir <synp71@live.com> wrote:
>>>
>>> Hi, Kathleen
>>>
>>> That's a strange decision IMO. I agree that the scope has not been
>>>  narrowed enough to justify a BoF just yet, but the list does have
>>>  some activity on it, and there does seem to be a problem in there
>>>  and some people who want that problem solved.
>>>
>>> Closing the list sends people to either the main IETF list, the
>>> SAAG list, or to form their own Google group, none of which is IMO
>>>  better than the status quo ante.
>>>
>>> I believe that the mailing list at least should remain open for
>>> now.
>>>
>>> Yoav
>>>
>>> -----Original Message----- From: Secauth
>>> [mailto:secauth-bounces@ietf.org] On Behalf Of Kathleen Moriarty
>>> Sent: Tuesday, January 13, 2015 1:21 AM To: secauth@ietf.org
>>> Subject: [Secauth] Closing SecAuth list
>>>
>>> Hello,
>>>
>>> The SecAuth list will be closing.  Those interested to continue to
>>>  identify and narrow the scope of work should get together
>>> off-list. If a clear problem statement has been defined and has
>>> support from the necessary communities to do the work, you can
>>> check with the Security ADs to request a new list, Bof, etc.
>>>
>>> --
>>>
>>> Best regards, Kathleen
>>>
>>> _______________________________________________ Secauth mailing
>>> list Secauth@ietf.org
>>> https://www.ietf.org/mailman/listinfo/secauth
>>>
>>
>>
>>
>
>
> _______________________________________________
> Secauth mailing list
> Secauth@ietf.org
> https://www.ietf.org/mailman/listinfo/secauth

-- 

Best regards,
Kathleen