[secdir] Secdir last call review of draft-ietf-capport-rfc7710bis-04

[Rifaat Shekh-Yusef <[e-mail]>]

Hi  Martin,

Sorry, I missed this message as I changed email address because some
spammers have been sending spams with my email address as a sender, and as
a result I would get angry emails from the spam targets.


Here is a quote form the API document:
"The hostname of the API SHOULD be displayed to the user in order to
indicate the entity which is providing the API service."

This seems to suggest that the user is expected to inspect the displayed
name and make sure it is make sense in the context of whoever is providing
that service.


Here is a quote from this document:
"An attacker with the ability to inject DHCP messages or RAs could

   include an option from this document to force users to contact an
   address of his choosing.  As an attacker with this capability could
   simply list himself as the default gateway (and so intercept all the
   victim's traffic); this does not provide them with significantly more
   capabilities, *but because this document removes the need for
   interception, the attacker may have an easier time performing the
   attack*."


Since this would be an easier attack compared to the interception attack,
and IP address is still permitted, then an attacker might force the use of
IP address to make it harder for the user to make sense of the displayed
name.

Regards,
 Rifaat

[adding back some lists]

-Ben

On Wed, May 06, 2020 at 02:37:39PM +1000, Martin Thomson wrote:
> What does "extra cautious" mean?  I assume that this is intended to apply to what a human might do, further implying that there is a role for a human decision.
>
> None of this architecture requires the involvement of a human in this way. Nor do I think that there is any meaningful distinction between an opaque string of characters (that might include confusables) and an opaque string of digits.
>
> I appreciate the sentiment here, but the fundamental problem is that once you decide that this information is not from the network, it is useless. If it is from the network, it is only of limited use. That use cannot depend on the identity of the server, so there is no value in any sort of caution.
>
> On Wed, May 6, 2020, at 13:36, Benjamin Kaduk wrote:
> > [My unicast reminder got a unicast reply; forwarding to someplace at least
> > vaguely useful.]
> >
> > -Ben
> >
> > On Tue, May 05, 2020 at 07:57:14PM -0400, Rifaat Shekh-Yusef wrote:
> > > Thanks for the reminder Ben.
> > >
> > > Erik,
> > >
> > > Since this document allows the use of IP address to represent the portal
> > > URI, I think it would important to add some text that explicitly states
> > > that the user might be presented with an IP address instead of the hostname
> > > of the API, and in that case the user should be extra cautious when this
> > > happens.
> > >
> > > Regards,
> > >  Rifaat