Subject: [anonsec] Automatic detection of BTNS capability

From: yogesh.swami at acm.org (Yogesh Prem Swami)
Date: Wed, 16 Mar 2005 09:45:18 -0800 (PST)

> 
> While I don't think the charter should contain solution for Zombies, I do
> think
> that BTNS should provide what it promises: "Better than no security." If
> having
> BTNS means easier ways to do zombie DoS attacks (and I guess Joe and I have
> discussed this before on the TCPM mailing list), then,  in my opinion BTNS is
> not better than no security, (it's only trading one form of DoS attacks with
> another form, like moving back door lock to front door). And yes, you can do

Just to be clear, I am not opposed to the idea of BTNS, but I would prefer to
have a treaoffs document also so that people can decide for themselves.

Yogesh

---

From: touch at ISI.EDU (Joe Touch)
Date: Wed, 16 Mar 2005 11:49:21 -0800

> have a treaoffs document also so that people can decide for themselves.

That would be appropriate for the applicability statement, and certainly 
zombies are worth mentioning - i.e., that BTNS is still better than 
nothing when the zombies attack by simple packets, but is at least no 
worse than nothing when zombies do full requests.

Note that even CA checks aren't going to solve attacks by full requests; 
the only solution there are SPDs that limit access to known 
non-attackers. That requires CAs or preshared keys, since access is 
based on out-of-band identity.

Joe
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 254 bytes
Desc: OpenPGP digital signature
Url : http://www.postel.org/pipermail/anonsec/attachments/20050316/2a8518bd/signature.bin