Slashdot Mirror

← Back to Stories (view on slashdot.org)

Security Top Concern for New IETF Chair

Posted by CowboyNeal on from the into-the-hot-seat dept.

BobB writes "New IETF chair Russ Housley speaks out about bolting security on after the fact, the prospects for IPv6 and a new security technology called Hokey that could help safeguard wireless and wired networks."

40 of 54 comments (clear)

  1. chair? by HalifaxRage · · Score: 1, Funny

    I would think legs, cushion, and some sort of drink holder would be the primary concerns for any new chair...

    --
    bomb the us up set someone
    1. Re:chair? by Anonymous Coward · · Score: 2, Funny

      How about throwability? You never now when you have to fucking kill somebody.

    2. Re:chair? by sokkalf · · Score: 1

      Not to mention Steve Ballmer..

    3. Re:chair? by markov_chain · · Score: 1

      This is getting OT, but Pope Joan, the alleged woman pope, prompted the Vatican to create a chair with an opening. The examining cleric would feel through the opening to make sure the Pope was a man. Talk about a security hole!

      --
      Tsunami -- You can't bring a good wave down!
    4. Re:chair? by davester666 · · Score: 1

      Nope, I'm sure he's mostly concerned with...JOB security!

      --
      Sleep your way to a whiter smile...date a dentist!
  2. Because... by chris_eineke · · Score: 1

    a new security technology called Hokey


    poop-flinging monkeys haven't been enough!
    --
    "All you have to do is be fragile and grateful. So stay the underdog." Chuck Palahniuk, Choke
    1. Re:Because... by chris_eineke · · Score: 1

      He dies.

      --
      "All you have to do is be fragile and grateful. So stay the underdog." Chuck Palahniuk, Choke
  3. Huh? by khasim · · Score: 3, Insightful

    Do IETF participants have the will to go back and fix insecure parts of the Internet? For example, everyone knows about the lack of security in HTTP, but there seems little will within the IETF to fix the HTTP authentication problem.

    That's because in the case of HTTP, and I suspect in many others, there's little agreement about what's the most important security feature to add. When you say that we'll just fix the most egregious things, then you get into an argument about where to draw the line. In the case of HTTP, the biggest concern is authentication and that is primarily solved by [Transport Layer Security]. Why not mandate TLS? That's a very good question.

    Why "mandate" anything? People who want to run a site with encrypted communications CAN run a site with encrypted communications. Come on people! HTTPS.

    Pretty much a fluff piece. It seems that the interviewer only had some buzzwords and a vague feeling that something was somehow insecure.
    1. Re:Huh? by caluml · · Score: 4, Insightful

      I think a large part of why more people don't use HTTPS is because a:, the certificate problem, and b:, the fact you can't use named based virtual hosts if you do.

      --
      Get your own free personal location tracker
    2. Re:Huh? by InsaneGeek · · Score: 1

      Actually he *is* talking about HTTPS, TLS is the successor to SSL it came about because the MD5 & SHA-1 algorithms have been "technically" compromised.

    3. Re:Huh? by TheRaven64 · · Score: 2, Informative

      the fact you can't use named based virtual hosts if you do. By the way, there is an RFC describing a STARTTLS-like extension for HTTP. You first connect, then you specify the hostname of the server you want, and complete the TLS handshake. This is the same system used for XMPP, SMTP, and IMAP for virtual hosts.
      --
      I am TheRaven on Soylent News
    4. Re:Huh? by _Knots · · Score: 1

      There are in fact several mechanisms, which is part of the problem. There's a TLS extension, Server Name Identification (http://www.ietf.org/rfc/rfc4366.txt), and an HTTP Upgrade: header approach (http://www.ietf.org/rfc/rfc2817.txt). I think consensus is moving towards SNI, and a reasonable chunk of the browsers seem to support it (though OpenSSL does not yet until 0.9.9 comes around). The Apache project is also dragging its feet, waiting for a clear consensus towards one or the other, AFAICT.

      --
      Anarchy$ dd if=/dev/random of=~/.signature bs=120 count=1
    5. Re:Huh? by Zeinfeld · · Score: 3, Informative
      Actually he *is* talking about HTTPS, TLS is the successor to SSL it came about because the MD5 & SHA-1 algorithms have been "technically" compromised.

      TLS is the successor to SSL but that is not the reason that the spec came about. The MD5 compromise came after the work was already started.

      The work started when Microsoft sumbitted their Transport Layer Security protocol to the IETF as a standards proposal. Up to that point Netscape had attempted to keep SSL as a proprietary specification under their control. Which was not too popular with those of us who had broken SSL 1.0 without any difficulty and then been completely ignored in the design of SSL 2.0, which was also botched.

      Sometime after the group began to start up Netscape came out with SSL 3.0 which had been extensively reworked by Paul Kocher and Netscape offered to release change control to the IETF. Microsoft agreed since that is all they had actually wanted all along. The only thing that was really changed in the end was the name and the ciphersuite options.

      BTW its not surprising that Russ thinks security is the major challenge, he was until recently the security area director. Before that he was chair of the S/MIME working group.

      --
      Looking for an Information Security student project suggestion?
      Try http://dotcrimeManifesto.com/
    6. Re:Huh? by Skapare · · Score: 1

      What certificate problem? They they cost money?

      You have to be able to prove you are not the man in the middle. Otherwise encryption doesn't mean much.

      --
      now we need to go OSS in diesel cars
    7. Re:Huh? by kestasjk · · Score: 1

      I think a large part of why more people don't use HTTPS is because a:, the certificate problem, and b:, the fact you can't use named based virtual hosts if you do. It's totally crazy that encryption isn't a default part of all network communications. Screw creating new encrypted protocols for HTTP, FTP, MSN, Skype, IRC, RSH, RCP, POP, SMTP, etc, etc, etc, all with their own faults and issues. This should definitely be tackled at whatever layer is most pervasive, and that's IP.
      --
      // MD_Update(&m,buf,j);
    8. Re:Huh? by slamb · · Score: 1

      here's a TLS extension, Server Name Identification (http://www.ietf.org/rfc/rfc4366.txt), and an HTTP Upgrade: header approach (http://www.ietf.org/rfc/rfc2817.txt).

      I'd say there's a clear winner there. I don't think anyone thought RFC 2817 through. It suggests (though does not require) sending the initial request in plaintext (ugh), and there's no good mechanism to advertise the server support without penalty on first hit to a https URL (i.e., advertise in the URL or DNS records). Since no existing servers support it, this means for browsers to take advantage of it, they'd have to connect to existing servers on the http port, discover the lack of support, then fall back to normal https. So all sessions to existing https sites would be slowed down by at least two round trips (c->s SYN, s->c SYN/ACK, c->s request, s->c failure), or say 150 ms. I'll pass.

      RFC 4366 is much better. No speed penalty - there's no need to advertise server support - the client can always send the option. The server ignores it if it doesn't understand, so without server support the status quo is maintained - the server admins shouldn't put more than one vhost on the same IP until they upgrade. When the client and server both support it, everything works fine. When the client doesn't support it, there's a security warning - about as good a failure mode as you're going to get with a protocol upgrade like this. And the client support is already there in the latest versions of Internet Explorer, Firefox, Safari, and Opera.

      I think consensus is moving towards SNI, and a reasonable chunk of the browsers seem to support it (though OpenSSL does not yet until 0.9.9 comes around). The Apache project is also dragging its feet, waiting for a clear consensus towards one or the other, AFAICT.

      I think the Apache people are waiting on OpenSSL 0.9.9. bug 34607 (copy'n'paste the URL; don't follow the referral from slashdot) has a patch with support, but it is not effective without OpenSSL 0.9.9. I'm looking forward to it myself...tempted to install a development build just to have this feature, but probably not a good idea to use untested security software.

    9. Re:Huh? by mrsteveman1 · · Score: 1

      I think you could do without the cost and use other means to link a certificate to an entity.

      Theres a project right now for openly available certificates, they are free but you have to prove you own the domain you want a cert for, and of course the CA root has to be in browsers and it isnt right now (though will be soon).

  4. hokey security? by socsoc · · Score: 1

    Do the hokey pokey and you turn yourself around. And thats what it all about.

  5. In related news by Anonymous Coward · · Score: 1, Funny

    I bet Microsoft employees can't wait to implement this secure chair protocol as soon as the RFC is released. Anything that helps protect them from Steve Ballmer is more than welcome.

  6. Security Top Concern for IETF chair? by Graywolf · · Score: 3, Funny

    Where can I get one of these secure chairs?

    1. Re:Security Top Concern for IETF chair? by Anonymous Coward · · Score: 1, Funny
      Where can I get one of these secure chairs?


      Steve B. had one, but I heard he threw it away.

  7. Re:How about the IETF concern themselves by iamdrscience · · Score: 1

    LOL! IMHO the IETF WGs and the ISOC need to STFU and GTFO. The IETF is AOK without those SOBS. YMMV.

  8. IPv6 by Ang31us · · Score: 1

    Q. Can you give me three specific goals? A. Rollout of IPv6 is clearly one of them. IPv6 is on by default in most OSes and the autoconfiguration feature assures that once the routers enable IPv6, their new IPv6 addresses will be Internet-routable without stateful firewalling, which would break things like VOIP.

    1. Re:IPv6 by Wesley+Felter · · Score: 1

      Too bad the IETF turned around and said that all home routers (like Apple's AirPort) should include deny-by-default stateful IPv6 firewalling. They spent so much effort making IPv6 "just work", and now they're undoing it.

    2. Re:IPv6 by FuzzyFox · · Score: 1

      Are you saying that you want every device on the entire internet to be able to speak to your system directly, without hindrance, by default?

      You want everyone else's systems to be able to be contacted, directly, without hindrance, by default?

      You do realize that the internet used to be like that, right? Do you remember what happened as a result? Do you know why firewalls were invented in the first place?

      --
      splunge (n) -- A good idea.. but it could be lousy... and I'm not being indecisive!
    3. Re:IPv6 by Wesley+Felter · · Score: 1

      Ah, I do so appreciate the patronizing. In a home environment I think host-based firewalls are easier to configure and diagnose than network-based ones, and thus I would prefer that network equipment not deny any traffic by default.

  9. The best of Verisign AND the NSA!! by Anonymous Coward · · Score: 1, Insightful

    Housley: "VeriSign is giving me a check a month, and the National Security Agency is paying my travel costs. "

    What could go wrong here?

  10. Obscure groups' acronyms by Gertlex · · Score: 1

    It would be nice if more articles mentioned the full name of whatever acronym makes the tagline. You know... so I don't have to think about it too hard... or even look it up.

    1. Re:Obscure groups' acronyms by TechyImmigrant · · Score: 1

      HOKEY = Hand Over Keying

      Rekeying security protocols when handover mobile devices from one AP or BS to another takes time and disrupts communications. So fix it. That's what HOKEY does.

      --
      Evil people are out to get you.
  11. HTTP security problems by Zarhan · · Score: 1

    Watched the presentation at Chicago earlier this week. HTTPBis BOF basically dealt with these:

    http://www3.ietf.org/proceedings/07jul/slides/http bis-2.ppt - Chair's Slides
    http://www3.ietf.org/proceedings/07jul/slides/http bis-1.pdf - Cookies & Caching
    http://www3.ietf.org/proceedings/07jul/slides/http bis-0.pdf - Etags

    The "Chair's slides" basically deal with HTTP Auth issues. Take a look - the presentations were rather interesting, altough it seemed at the time that a WG may not be formed out of these.

    1. Re:HTTP security problems by Zarhan · · Score: 1

      Hmmh, apparently the presentation about auth cited in the Agenda slide is not online yet. Sorry - apparently exactly the on-topic presentation is still pending publication :)

  12. Why mandate it? by khasim · · Score: 1

    Adding encryption to the communication channel is an additional level to troubleshoot.

    Is your certificate current?
    Do you have enough entropy?
    etc

    We already have it available. Without the mandate. Go to your bank's website and look for the HTTPS. Most other sites (like /.) run regular HTTP because the additional layer and expense of encryption would not gain them anything.

  13. Pfff... by CRX588 · · Score: 1

    IPv6 is soooo 1996

    1. Re:Pfff... by LongestPrefix · · Score: 1

      IPv4 is sooooooo 1984.

  14. Security Top Concern for New IETF Chair by caluml · · Score: 2, Funny

    Security Top Concern for New IETF Chair

    It suddenly collapses when sat on?

    --
    Get your own free personal location tracker
  15. Bingo by mpapet · · Score: 1

    I'm not say _this_ guy in particular is the trojan horse for the end of an anonymous Internet, but it's one step closer.

    At this point in the game, it's assumed all traffic is being monitored through the Telco's. http://www.salon.com/news/feature/2006/06/21/att_n sa/index_np.html

    Having an NSA friendly agent running the IETF will make their jobs much easier. I boldly predict next to nothing will be done publicly by this guy. I have a feeling he will be **very** busy not as chair, but as an NSA rep who just happens to chair the IETF. Very subtle but important distinction similar to using RNC email accounts at the whitehouse.

    --
    http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
  16. Please stop with the cutesy names! by pongo000 · · Score: 2, Interesting

    Gimp...Pidgin...and now...

    Hokey?

    Hokey?

    I don't know about the rest of the world, but here in the US "hokey" is used to refer to something artificial, contrived, fake. I certainly don't want to trust the security of my systems to something that's contrived.

    Geez, more proof that intelligence and common sense aren't necessarily bed partners...

  17. IPv6 and IPsec by Skapare · · Score: 2, Informative

    IPsec works over IPv4. IPv4 works without IPsec. I haven't found anyone (yet) that has gotten IPsec over IPv6 (I'm not talking about IPv6 tunneled over IPsec protected IPv4) to actually work on Linux or BSD. Surely someone has. But Google turns up a number of reports of problems that go unresolved and unanswered (except in one case people reporting they also cannot get it to work). I've only been spending a couple weeks trying to get it to at least establish a security association between 2 machines.

    Which protocol to scrap and start over? Or is it just bad implementation? If we can at least get this working, IPv6 might be considered ready to go.

    --
    now we need to go OSS in diesel cars
  18. Rough consensus, and running code. by ZWithaPGGB · · Score: 1

    You're already seeing it with anti-Spam blacklists. People are blocking who they think don't behave well. Soon it will change to only allowing those they feel are. Like it or not, security in protocol enhancement is coming. If the OSS community resists it, then the only alternative will be the TCG/TPM, and we will have a network that forks, despite shared network layer protocols.
    Just as the Linux community seems to have learned nothing from the way the tower of babel effect hamstrung unix, so it seems that IPV4 minimalists will cause the Internet to fork.

  19. What else did you expect? by (Score.5,+Interestin · · Score: 1

    Russ is a security guy. I'd be rather surprised if his top priority was something other than... security.