Subject: RE: Turning off link-locals?

From: "Christian Huitema" <[email-masked]>
Date: Mon, 20 Jan 2003 14:53:58 -0800

> Oh, we're plenty clever. But we also don't allow any fool with a
wireless
> card to get a DHCP address and become part of the network without
> registering the MAC address. 

Protecting a network by registering the MAC addresses is both cumbersome
and weak. In a secure environment, you would want to something like
802.1X for controlling network access, and then check some real security
credentials before granting network access. Indeed, once you do that,
you can just as well assume a DHCP server; there is hardly any reason to
use zeroconf.

-- Christian Huitema

---

From: "s. goswami" <[email-masked]>
Date: Mon, 20 Jan 2003 18:03:38 -0500 (EST)

I would think zeroconf adds value to networks that do not
want or need infrastrcuture support such as DHCP. As for 802.1x -
its security is weak too ( the 802.1x server is not authenticated).
Secondly, a more philosophical question - do we need to have a
seperate authentication protocol for each layer of the network ?

Subrata

---

From: Keith Moore <[email-masked]>
Date: Mon, 20 Jan 2003 18:04:42 -0500

On Mon, 20 Jan 2003 14:53:58 -0800
"Christian Huitema" <[email-masked]> wrote:

> > Oh, we're plenty clever. But we also don't allow any fool with a wireless
> and weak.

It depends on what you're trying to accomplish - are you trying to completely
prevent network access by unauthorized users, or are you trying to marginalize
them enough that they can be detected, or are you just trying to raise the bar
a bit to make attacks harder than they would otherwise be?

There's a saying that the purpose of locks on houses is to keep honest people
honest.  Most houses aren't terribly difficult to enter even if the doors are
locked.  But locked doors means that prospective trespassers have to work a
bit harder, so they're useful for keeping out those who aren't so highly
motivated.

For similar reasons, less-than-perfect access controls on networks can also
be useful.

Keith

---

From: "John C. Welch" <[email-masked]>
Date: Mon, 20 Jan 2003 18:11:28 -0500

> you can just as well assume a DHCP server; there is hardly any reason to

I agree, but you ever try to get a University to change *anything*? They're
really bad at it.

Secondly, again, why grant institute-wide access when it isn't required. If
I just want to get a file from laptop a to laptop b (which isn't
registered), or print a file, then why go through all that, when LL gives
you that ability, and is what it's *designed* for.

john

-- 
John C. Welch
Consultant III
Administrative Computing
(617) 253 - 1368 work
(508) 579 - 7380 cell
bynkii2          AIM