Subject: rare reply to one of John Welch's messages

From: Keith Moore <[email-masked]>
Date: Wed, 11 Dec 2002 16:58:21 -0500

I'm taking an exception to reply to one of John Welch's messages,
because I believe he's echoing a common misconception:

> Um...in home networks and ad hoc networks that only need to exist for a few
> minutes, there is no authentication needed. 

that is demonstrably untrue; there are threats that are *specific* to
ad hoc networks.  if hosts in ad hoc networks don't require authentication
you can be sure that there will be attackers on ad hoc networks.
(just as there are those that attack IP addresses that are known to be
assigned to dialup lines, those who run ssh mitm attacks at IETF's, etc.)

as for home and small business networks, if there are resources to 
protect, there is still a need for authentication.   some may trust
their firewalls to provide sufficient protection, but that's like
saying "I live in a gated community so I don't need to lock my doors"

(it's one thing if people are naive enough to assume that a firewall
gives them security; it's even worse if the gated community insists 
that none of the houses within need to have locks on their doors).

Keith

---

From: "John C. Welch" <[email-masked]>
Date: Wed, 11 Dec 2002 17:55:41 -0500

> because I believe he's echoing a common misconception:

I'm whelmed...more under than over, but definitely whelmed.

> assigned to dialup lines, those who run ssh mitm attacks at IETF's, etc.)

If you are going to interpret what I say, do it right. I never said there
are NO threats to ad hoc networks. But, in an airport, two laptops that are
using a FireWire/USB/Crossover ethernet cable to transfer a file aren't
going to have to deal with many attacks.

The same goes for any network that comes up and goes down in less than a
half - hour. For an attack to work, there has to be adequate opportunity and
time, and many ad hoc networks provide neither. Trying to attack such a
network,  is not going to be worth the effort in most cases.

Now, if we are talking about an ad hoc network that is up for a number of
hours or longer, then you have the time. But again, you have to find the
network, determine that they are using Zeroconf to set it up, and insert
yourself on the network. That does not take zero time.

For example, at the upcoming MacWorld Expo in January, between 5 January and
10 January 2003, I will probably participate in around 50 different ad hoc
networks. The theoretical chance to crack them is 100%, the real-world
chance to crack them approaches zero.

> that none of the houses within need to have locks on their doors).

Maybe. A properly configured firewall can be quite secure. In addition, in a
business consisting of ten computers, the need for authentication beyond
basic firewall and login security may be quite small indeed. If you live in
an area with a near zero crime rate, and a well-armed populace, you may not
ever need to lock your doors.

In any case, to say that you will always need authentication, or even close
to that as you did:

" the set of devices that can practically be used with zero configuration is
approximately the null set.  for instance, almost any networked device needs
some kind of authentication, and this inevitably requires some sort of
configuration - either in the device itself, or the clients that are
authorized to use that device, or both."

Is simply not correct in the real world, with regard to Zeroconf.

john

-- 
John C. Welch
Consultant III
Administrative Computing
(617) 253 - 1368 work
(508) 579 - 7380 cell
bynkii2          AIM