Re: [secdir] Secdir last call review of draft-ietf-capport-rfc7710bis-04

[Rifaat Shekh-Yusef <[e-mail]>]

Adding Martin.

On Fri, May 15, 2020 at 8:47 AM Rifaat Shekh-Yusef <[e-mail]>
wrote:

> Hi  Martin,
>
> Sorry, I missed this message as I changed email address because some
> spammers have been sending spams with my email address as a sender, and as
> a result I would get angry emails from the spam targets.
>
>
> Here is a quote form the API document:
> "The hostname of the API SHOULD be displayed to the user in order to
> indicate the entity which is providing the API service."
>
> This seems to suggest that the user is expected to inspect the displayed
> name and make sure it is make sense in the context of whoever is providing
> that service.
>
>
> Here is a quote from this document:
> "An attacker with the ability to inject DHCP messages or RAs could
>
>    include an option from this document to force users to contact an
>    address of his choosing.  As an attacker with this capability could
>    simply list himself as the default gateway (and so intercept all the
>    victim's traffic); this does not provide them with significantly more
>    capabilities, *but because this document removes the need for
>    interception, the attacker may have an easier time performing the
>    attack*."
>
>
> Since this would be an easier attack compared to the interception attack,
> and IP address is still permitted, then an attacker might force the use of
> IP address to make it harder for the user to make sense of the displayed
> name.
>
> Regards,
>  Rifaat
>
> [adding back some lists]
>
> -Ben
>
> On Wed, May 06, 2020 at 02:37:39PM +1000, Martin Thomson wrote:
> > What does "extra cautious" mean?  I assume that this is intended to apply to what a human might do, further implying that there is a role for a human decision.
> >
> > None of this architecture requires the involvement of a human in this way. Nor do I think that there is any meaningful distinction between an opaque string of characters (that might include confusables) and an opaque string of digits.
> >
> > I appreciate the sentiment here, but the fundamental problem is that once you decide that this information is not from the network, it is useless. If it is from the network, it is only of limited use. That use cannot depend on the identity of the server, so there is no value in any sort of caution.
> >
> > On Wed, May 6, 2020, at 13:36, Benjamin Kaduk wrote:
> > > [My unicast reminder got a unicast reply; forwarding to someplace at least
> > > vaguely useful.]
> > >
> > > -Ben
> > >
> > > On Tue, May 05, 2020 at 07:57:14PM -0400, Rifaat Shekh-Yusef wrote:
> > > > Thanks for the reminder Ben.
> > > >
> > > > Erik,
> > > >
> > > > Since this document allows the use of IP address to represent the portal
> > > > URI, I think it would important to add some text that explicitly states
> > > > that the user might be presented with an IP address instead of the hostname
> > > > of the API, and in that case the user should be extra cautious when this
> > > > happens.
> > > >
> > > > Regards,
> > > >  Rifaat
>
>
>
>