Subject: [Secauth] Closing SecAuth list

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 12 Jan 2015 18:21:17 -0500

Hello,

The SecAuth list will be closing.  Those interested to continue to
identify and narrow the scope of work should get together off-list.
If a clear problem statement has been defined and has support from the
necessary communities to do the work, you can check with the Security
ADs to request a new list, Bof, etc.

-- 

Best regards,
Kathleen

---

From: Alexandre Petrescu <[email-masked]>
Date: Tue, 13 Jan 2015 11:49:42 +0100

> ADs to request a new list, Bof, etc.

Hello Kathleen,

Thank you for the message.

The stimulus seems high to get this going, although 2 or 3 very 
different problems are being discussed.  It is hard in my oppinion to 
make them converge - it requires much effort from participants to 
understand each other.  I guess requesting a new mailing list would be 
an additional burden.

As a side note, may I express surprise of this decision.  The list gets 
closed as if something wrong happened on it, or as when you get 
electricity cut because not paid the bills.  Is it this?

This is my two cents worth.

Alex

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 13 Jan 2015 08:40:08 -0500

Thank you for your messages Yoav and Alexandre.

I have been monitoring this list and the outcomes from each meeting as
well as talking to attendees.  As an observer, I see that people are
not coming together to solve a problem in which there will be support
by the community responsible for the technology (wifi hotspots).  I'm
also seeing resistance to using existing technology and explanations
of what is already being done in the operator community (radius,
etc.).  I am also seeing disconnected threads that bring in SDN and
NFV in the mix for device authentication without thought of how this
might be used or connected into infrastructure and resistance to
suggestions on how to accomplish that (if it is even needed).  The
last problem is very separate from the first in the list, but all gets
mixed up as a term (SecAuth) was put on the collection of things
discussed and confuses things further.  I've also noticed the sporadic
question, "What is SecAuth?" after all of the time spent and
discussions, which shows others are confused on the goal and problem
or set of problems being worked on.

I appreciate the messages asking why the list is being closed.  I
would like to see a clearly defined problem statement with agreed upon
goals and I am not sure we will get there as it stands now since the
conversation goes in circles and mixes the sets of problems even
within a single response.  We have a few people that are actively
participating, but I don't think they all support the work.  I have
noticed several  advising the list, pointing to other solutions in
play to raise awareness of existing options.  I've also gotten some
private notes thanking me for closing the list, so views are mixed
here.

We would be happy to set up a list on a defined scope with willing
participants, but I do think people have to come to agreement on a
narrowed goal or sets of goals.

Thank you,
Kathleen

On Tue, Jan 13, 2015 at 6:21 AM, Yoav Nir <[email-masked]> wrote:
> Hi, Kathleen
>
> That's a strange decision IMO. I agree that the scope has not been narrowed
> enough to justify a BoF just yet, but the list does have some activity on
> it, and there does seem to be a problem in there and some people who want
> that problem solved.
>
> Closing the list sends people to either the main IETF list, the SAAG list,
> or to form their own Google group, none of which is IMO better than the
> status quo ante.
>
> I believe that the mailing list at least should remain open for now.
>
> Yoav
>
> -----Original Message-----
> From: Secauth [mailto:[email-masked]] On Behalf Of Kathleen
> Moriarty
> Sent: Tuesday, January 13, 2015 1:21 AM
> To: [email-masked]
> Subject: [Secauth] Closing SecAuth list
>
> Hello,
>
> The SecAuth list will be closing.  Those interested to continue to identify
> and narrow the scope of work should get together off-list.
> necessary communities to do the work, you can check with the Security ADs to
> request a new list, Bof, etc.
>
> --
>
> Best regards,
> Kathleen
>
> _______________________________________________
> Secauth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secauth
>

-- 

Best regards,
Kathleen

---

From: Alexandre Petrescu <[email-masked]>
Date: Tue, 13 Jan 2015 17:16:27 +0100

Hello Kathleen,

Le 13/01/2015 14:40, Kathleen Moriarty a écrit :
> As an observer, I see that people are not coming together to solve a
>  problem in which there will be support by the community responsible
>  for the technology (wifi hotspots).

The hurdle to connect to wifi hotspots is a real problem.  Sometimes
it's impossible to connect, other times the only way to connect is an
insecure way[*].

The community responsible for the technology used in these hotspots is
divided in two: those who offer heavy web portal authentication and
those who gave up and afford no security at all.  A 3rd category of
those who offer Radius/DIAMETER-kinds of authentication exists, but has
more limited tract.

Each of these categories needs to listen to what the end user needs, not
to what the current access control technology has to offer.

To that one may add these trends:
- new GUI-less small devices come on the market - how will they connect
   to web portal hotspots where one has to fill forms in?
- new methods of authenticating with one different password token per
   device are non-scalable.

[*] : examples of insecure ways to connect to WiFi hotspots: (1)
one particular large airport wifi hotspot has no link-layer and no web
portal security; (2) during last Winter Games the password to connect to
a wifi hotspot was shown in clear on TV to world audience.

> I am also seeing disconnected threads that bring in SDN and NFV in
> the mix for device authentication without thought of how this might
> be used or connected into infrastructure and resistance to
> suggestions on how to accomplish that (if it is even needed).

If by SDN/NFV we mean OpenFlow and YANG, and knowing that any new
protocol or protocol enhancement must have a MIB feature in it, then it
does make sense to have SDN/NFV.

> I've also noticed the sporadic question, "What is SecAuth?" after
> all of the time spent and discussions, which shows others are
> confused on the goal and problem or set of problems being worked on.

Certainly.  SecAuth acronym per se is difficult to pronounce and too
generic.  But I wouldn't care for the time being.

> would like to see a clearly defined problem statement with agreed
> upon goals and I am not sure we will get there as it stands now since
> the conversation goes in circles and mixes the sets of problems even
> within a single response.

I agree.

> We have a few people that are actively participating, but I don't
> think they all support the work. I have noticed several  advising the
> list, pointing to other solutions in play to raise awareness of
> existing options.  I've also gotten some private notes thanking me
> for closing the list, so views are mixed here.

I agree.

I think there is need and effort ready from a particular equipment 
manufacturer, and I think there is this wifi hotspot problem; but maybe 
I am wrong, I dont know.

Alex

> Thank you, Kathleen
>> That's a strange decision IMO. I agree that the scope has not been
>>  narrowed enough to justify a BoF just yet, but the list does have
>>  some activity on it, and there does seem to be a problem in there
>>  and some people who want that problem solved.
>>
>> Closing the list sends people to either the main IETF list, the
>> SAAG list, or to form their own Google group, none of which is IMO
>>  better than the status quo ante.
>>
>> -----Original Message----- From: Secauth
>> [mailto:[email-masked]] On Behalf Of Kathleen Moriarty
>> Sent: Tuesday, January 13, 2015 1:21 AM To: [email-masked]
>>  identify and narrow the scope of work should get together
>> off-list. If a clear problem statement has been defined and has
>> support from the necessary communities to do the work, you can
>> check with the Security ADs to request a new list, Bof, etc.
>>
>> --
>>
>> Best regards, Kathleen
>>
>> _______________________________________________ Secauth mailing
>> list [email-masked]

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 13 Jan 2015 11:30:02 -0500

Hi Alex,

Thanks, response in-line.

On Tue, Jan 13, 2015 at 11:16 AM, Alexandre Petrescu
<[email-masked]> wrote:
> manufacturer, and I think there is this wifi hotspot problem; but maybe I am
> wrong, I dont know.

This is only one of the three problems being discussed and there isn't
enough to go forward on yet.  I'm asking that those interested go back
and collect thoughts to devise feasible options.  If this is the
problem selected, I would also need to see support from those who can
make the change (organizations running the wifi hotspots).  I don't
see the motivation for them to switch from using a captive portal,
especially since they charge for use of the infrastructure they
host/provide.  I understand this is an issue for users, but also see
that the problem is bigger and involves providers of the service (who
have not been participating in the discussion).

Is it worth it for those interested to get together on a single
problem and come back with a more clearly defined scope?  If so, it
would be great to see that happen and to see some of the concerns
addressed by getting involvement/support of service providers.

Thank you.

-- 

Best regards,
Kathleen

---

From: Alan DeKok <[email-masked]>
Date: Tue, 13 Jan 2015 11:41:02 -0500

On Jan 13, 2015, at 11:30 AM, Kathleen Moriarty <[email-masked]> wrote:
> host/provide.

  I’ve worked with hotspots && providers for a long time.  Many have ads on their captive portal.  That being said, they make their money off of traffic, not landing pages.  They don’t care *how* people log in.  The WiFi alliance has worked on ways for people to automatically log in to hotspots.

  But I don’t understand how secauth helps them.  The problem statements are unclear.  The solutions are vast and vague.

>  I understand this is an issue for users, but also see

  It will be hard to get hotspot providers to get involved in the IETF.  They’re working with the WiFi alliance, and even then very few of them are involved.

  This is a larger problem with the IETF.  Getting *production* people involved is hard.

  I agree.

  Alan DeKok.

---

From: Paul Lambert <[email-masked]>
Date: Tue, 13 Jan 2015 13:47:38 -0800

> On Jan 13, 2015, at 8:41 AM, Alan DeKok <[email-masked]> wrote:
> 
Yes.  I helped on some of the Passport 2 certificate details, testing and deployment.

Much work in industry avoids the IETF because of focus mismatch.  The IETF clearly ‘owns’ solutions changing IETF protocols, but it is a less productive forum for industry specific solutions.

However, good solutions for authentication/identity should not be industry specific.
>  But I don’t understand how secauth helps them.  The problem statements are unclear.  The solutions are vast and vague.

Some of the topics on this list have been interesting … but as noted it’s hard to contribute if the target output is unclear.

>> addressed by getting involvement/support of service providers.
If done, perhaps a new list could be created with a 
new clearly focused topic.

Paul