Re: [secdir] secdir review of draft-ietf-dhc-access-network-identifier-08

["Bernie Volz (volz)" <[e-mail]>]

I am not aware of such data. My guess is that most SPs place this kind of traffic in what they hope to be an isolated network (i.e., behind firewalls, ...).

Also, much of this data is pretty easy to find anyway ... SSIDs are mostly broadcast (or easy to snoop for), which mobile operator you use is probably discoverable in seconds (heck I bet you’d answer if I asked, or if I had your number a google query would probably tell me ...). So, I'm not really sure how critical this information tends to be. But, yet protecting it is better than not protecting it. But I think steps should have been taken for the other data in DHCP (relay to server).

- Bernie

-----Original Message-----
From: Stephen Farrell [mailto:[e-mail]] 
Sent: Friday, July 10, 2015 1:28 PM
To: Bernie Volz (volz); Sri Gundavelli (sgundave)
Cc: [e-mail]; [e-mail]; [e-mail]
Subject: Re: [secdir] secdir review of draft-ietf-dhc-access-network-identifier-08


Hiya,

On 10/07/15 17:27, Bernie Volz (volz) wrote:
> IPsec should also hide this information from pervasive monitoring 
> (though how much IPsec is in use is an open question). Note also that 
> as this is relay to server (or relay to relay) communication, one 
> would hope that most SPs have taken measures to 'secure' this traffic 
> either by using IPsec or VPNs.

Do we have any data as to whether or not such protection does get deployed? I'd not be surprised if there's not much public, but if there were it'd be good to know.

I also believe we have had reported cases where pieces of the network infrastructure of various kinds of operator have been targeted for PM purposes, so while yes, it is really strange that someone would want to do that, it seems to be a real, and not notional, threat.

Ta,
S.