Subject: Re: [perpass] perpass: what next?

From: Stefan Winter <[email-masked]>
Date: Thu, 09 Jul 2015 09:38:13 +0200

Hello,

> I agree that we do a poor job here, and I think that we should make this kind
> of interaction smoother.  I spent four years working on rfc4332 (OE for IPsec/IKE),
> and version 1 was always going to be on the ISE.
> 
>     > BTW, the current draft is here; as it happens, it expires today, and
>     > honestly I'm wondering if it's worth refreshing it:
> 
>     > https://tools.ietf.org/html/draft-winter-opsawg-eap-metadata-01
> 
> I would say yes. I was going to ask if there were implementations, and you
> clearly have some...

Okay. I've refreshed the draft with minor changes, and am going to try
and hunt down ADs for ISE sponsoring :-)

I'm aiming at either Stephen (as he's on the list and so is informed on
the general topic already; plus he's an eduroam user and sees .1X in
real life every day - now if he is also proud owner of an Android
device, where we've implemented the draft already, he's a role-model AD
for this draft :-) ) or Kathleen (I originally presented this for the
OPS area where Kathleen is now partly involved; but since the topic also
improves end-user security it also has a security AD touch).

I can also present this at saag if a security AD or two see value in this?

In any case, Stephen and Kathleen should prepare to run and hide if they
see me approaching in Prague :-)

The refreshed draft is at

https://www.ietf.org/internet-drafts/draft-winter-opsawg-eap-metadata-02.txt

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

---

From: Stefan Winter <[email-masked]>
Date: Thu, 09 Jul 2015 09:45:16 +0200

Hello,

> Would there be value to deploy this at IETF meeting networks?

There was a very long and for me depessing thread on this question; once
on attendees of a meeting where I reached out to get 1X security done;
once on [email-masked] (thread starting 27 April 2014 "Security for the
IETF wireless network").

It seems like the use case at IETF meetings is so different from normal
corporate use that attendees don't see significant enough value in
security the 1X network properly.

The story goes like this... Since the network uses username+password
=="ietf/ietf" there is no risk to leak personal credentials. So there is
no need to authenticate the network to the user.
My argument that users could fall into a rogue 1X evil clone if they
don't get provisioned proper security settings was waved away with
statements such as that nobody should trust the network anyway, and that
the situation is no different on the open ietf network.

Needless to say that I was extremely unhappy with that way of thinking,
but at some point I gave up (I considered to set up an evil twin myself,
but don't want to be overly nasty).

It's like... everybody should eat our dogfood, except ourselves. :-(

Stefan

Tel: +352 424409 1
Fax: +352 422473

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 09 Jul 2015 09:24:45 +0100

On 09/07/15 08:38, Stefan Winter wrote:
> for this draft :-)

Heh. I'm currently not an android user (using a jolla for
now and quirkily loving it) but it is eduroam season for me
now - TCD expire that password and I only need the system
for exam mark entry. So I'm a partial match:-)

I'm happy to play about with your linux stuff when it's
ready since this seems like a fine thing to standardise to
me - I have seen enough silly web pages with mad EAP setup
instructions that improving on that should be quite doable.

Cheers,
S.

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 14 Jul 2015 11:56:05 -0400

Stefan,

Could you send me a title for your talk on this draft and let me know how
much time you'd like on the SAAG agenda?  We'll need slides soon too,
preferably in PDF format.  It would be good to have the mix of security and
OPS.

Thanks!

On Thu, Jul 9, 2015 at 4:24 AM, Stephen Farrell <[email-masked]>
wrote:

> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass
>
>

-- 

Best regards,
Kathleen