Subject: [homenet] [SPAM] I have a problem

From: Michael Thomas <[email-masked]>
Date: Sun, 06 May 2012 12:31:57 -0700

I suspect many/most of you do too. Looking through the charter and arch doc, my primary problem
is that I'm probably way off charter, but I'm not sure so I'll ask.

When I'm out and about, there are zillions of wifi opportunities. Who runs them and for what
reason, I haven't the foggiest idea. Some of them are undoubtedly malicious, many more poorly
run. So it's fairly crazy to use them. But like a lot of people, connectivity often trumps sanity.

What I'd really like is to not feel dirty when I do that. The most obvious thing to do is to
use a VPN, but I don't have a corporate mothership these days so I'd have to set all of that
up, and it would most likely have to be through my home linux box since my el cheapo home
router doesn't know about IPsec afaik. Not to mention that even if *I* could move
heaven and earth to protect my posterior, the vast unwashed masses are not so fortunate.

So why did I come to homenet to complain? Well, it's because I can't think of another place
that I'd reasonably place the other end of my VPN but on my home net. As far as I can tell, there
aren't many places to dogleg my traffic to avoid access network fun and games. My ISP doesn't
care about this problem let alone doing anything fancy like running a mobile ip home agent
which would be even better of course. Nor do I see others, so I'm not holding my breath.

Yes, I know the performance would be miserable given the asymmetric nature of cable/dsl. But
it would at least not allow $EVILSHOP to do nasty things with my unencrypted traffic, and
traffic analysis on the rest.

That said, even if this is widely off charter, another aspect may not: if we have lots of new
services in our homes I may very well want to access them remotely. If VPN's are good enough
for corpro, then mightn't the same be true for my home networks too?

Mike

---

From: "Dan Wing" <[email-masked]>
Date: Sun, 6 May 2012 14:24:14 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Michael Thomas
> Sent: Sunday, May 06, 2012 12:32 PM
> To: [email-masked]
> Subject: [homenet] [SPAM] I have a problem
> 

"Understanding Apple's Back to My Mac (BTMM) Service",
http://tools.ietf.org/html/rfc6281 is an interesting read.
Regarding where to terminate the VPN, see its Section 7.3.2 titled
"Discussion: End-to-End Encryption" which lists some disadvantages
to terminating the VPN at the home gateway.

There is also SIP-initiated IPsec, http://tools.ietf.org/html/rfc6193,
which terminates the VPN on the home gateway.

To your point that connectivity trumps sanity, if such VPNs were
commonplace, an active attacker would interfere with attempts to
bring up such VPNs.  And the user's desire for connectivity would 
cause the user to skip setting up their VPN, under the mistaken
assumption that their home network is down or otherwise unavailable.

-d

---

From: Michael Thomas <[email-masked]>
Date: Mon, 07 May 2012 10:25:16 -0700

> to terminating the VPN at the home gateway.

I don't really see that as helpful as the current reality is that
I can't get an ipsec tunnel to anything in my home as a practical
reality.  Yes, if I am sufficiently geekly I can terminate it back at
a PC or Mac or Linux box -- all of which exact their own pound of
flesh for the effort. All would require their own credentials enrollment
too. At least at the home router demark I'd only have to go through
that exercise once, and with maybe with some auto config pixie
dust it might not even be much harder than using wifi which people
manifestly seem to be able to do.

In any case, that sort of tradeoff might be a reason that this is
interesting to this wg, especially if you think of this in terms of
routing within a home -- a vpn is just another interface, right?

> assumption that their home network is down or otherwise unavailable.

Well, people already use vpn's on the road and in evil places now,
it's just that they're doing it through a corpro vpn back at the mothership.
I just want to be able to have the same choice when I'm doing this on
my own dime. As it stands, I can't do that for all intents and purposes.

Mike

>
> -d
>
>
> _______________________________________________
> homenet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/homenet
>
>

---

From: "Dan Wing" <[email-masked]>
Date: Mon, 7 May 2012 11:39:57 -0700

...
> my own dime. As it stands, I can't do that for all intents and

Apple's Back to My Mac, Microsoft's DirectAccess, and the SIP
VPN method all rely on one important thing:  a rendezvous service.
Apple's solution is aimed at consumers and uses Apple's me.com 
domain.  Microsoft's solution is aimed at corporate users and
uses IT-operated servers.  The SIP VPN method uses SIP proxies.
We could imagine someone specifying XMPP for such a thing, too.

But the prototypical "Grandma" does not have access to a 
rendezvous service, unless she participates in the Apple
ecosystem (and uses Apple's me.com as the rendezvous service).

I don't know how to make one of these systems work without a
rendezvous service, and it seems nobody else does, either --
all of them rely on some sort of rendezvous service that is
separate from the service provided by the typical residential
ISP.

-d

---

From: Michael Thomas <[email-masked]>
Date: Mon, 07 May 2012 11:50:43 -0700

> separate from the service provided by the typical residential

Ah, but a lot of that thinking seems to be rooted in the v4
mindset where home ip addresses are ephemeral, right? In a v6
world, why can't I just put a AAAA record in some name server
just like everything else on the net that wants to be reached
by name, since the IP subnet I have at home doesn't have to
change on a regular basis due to the need to recycle v4
addresses?

No nat, no dhcp*, no other hacks simplifies this a lot it seems
to me.

Mike

[*] in the rotating ip address sense, not in the discovery sense.

---

From: Kerry Lynn <[email-masked]>
Date: Mon, 7 May 2012 15:14:33 -0400

On Mon, May 7, 2012 at 2:50 PM, Michael Thomas <[email-masked]> wrote:

>> Is this fundamentally different than the service provided by e.g.
DynDNS - the ability to update a publicly visible FQDN binding?

-K-

> ______________________________**_________________
> homenet mailing list
> [email-masked]
> https://www.ietf.org/mailman/**listinfo/homenet<https://www.ietf.org/mailman/listinfo/homenet>
>

---

From: "Dan Wing" <[email-masked]>
Date: Mon, 7 May 2012 14:20:21 -0700

> From: Michael Thomas [mailto:[email-masked]]
> Sent: Monday, May 07, 2012 11:51 AM
> To: Dan Wing
> Cc: [email-masked]
> Subject: Re: [homenet] I have a problem
> 

If the subscriber's IP address really is static, the subscriber
can avoid DNS entirely, and just put their static IPv6 (or 
IPv4) address into their portable computing device (tablet, 
PC, whatever) and they're done.  That way, the user doesn't
need to know how to edit a zone file or beg their ISP for
a FQDN.

That leaves the user with the complication of configuring a VPN
on their consumer-grade router and on their portable computing
device (table, PC, whatever).  Still pretty hard.

There are small/medium business routers that support VPN,
and could do this already for IPv4.  Many of them probably
lack IPv6 support yet, though.

-d

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 08 May 2012 07:52:17 +0100

Can we either have a problem statement draft or declare this out of scope?

IMHO it's a legitimate topic but probably one for later.

Regards
   Brian

---

From: Michael Richardson <[email-masked]>
Date: Tue, 08 May 2012 08:05:41 -0400

>>>>> "Brian" == Brian E Carpenter <Brian> writes:
    Brian> Can we either have a problem statement draft or declare this
    Brian> out of scope?

    Brian> IMHO it's a legitimate topic but probably one for later.

"for later" +1

<RFC4025/RFC4332 HAT ON>
This problem can be solved once we figure out how DNS works.
</RFC4025/RFC4332 HAT ON>

-- 
]       He who is tired of Weird Al is tired of life!           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
   Kyoto Plus: watch the video <http://www.youtube.com/watch?v=kzx1ycLXQSE>
	               then sign the petition.

---

From: Michael Richardson <[email-masked]>
Date: Tue, 08 May 2012 08:13:36 -0400

>>>>> "Dan" == Dan Wing <[email-masked]> writes:
    Dan> If the subscriber's IP address really is static, the subscriber
    Dan> can avoid DNS entirely, and just put their static IPv6 (or
    Dan> IPv4) address into their portable computing device (tablet, PC,
    Dan> whatever) and they're done.  That way, the user doesn't need to
    Dan> know how to edit a zone file or beg their ISP for a FQDN.

    Dan> That leaves the user with the complication of configuring a VPN
    Dan> on their consumer-grade router and on their portable computing
    Dan> device (table, PC, whatever).  Still pretty hard.

Is the goal communications with the home(net), or is the goal to appear
to still be at home ("MobileIP")?

If the former, then given end-to-end addressing and routing,
transport-mode or /128-tunnel-mode IPsec may be more appropriate. And
one may be able to leverage application layer authentication to do 
channel binding of BTNS-IPsec.

Secondly, half the time I've heard people want "remote access/VPN", it's
not a security issue, it's a reachability and addressing issue.

---

From: Michael Thomas <[email-masked]>
Date: Tue, 08 May 2012 08:08:37 -0700

On 05/08/2012 05:13 AM, Michael Richardson wrote:
>>>>>> "Dan" == Dan Wing<[email-masked]>  writes:

As I said in my original post, the problem I have is that I don't
want to give access to my traffic to unknown and possibly malicious
wifi providers. There may be many ways to get around this, but there
is nothing in widespread use today, modulo piggybacking on corpro vpn's.
I don't want or can't be dependent on corpro vpn's, so now what?

One thing seems pretty certain from the mobile ip experience: ISP's
aren't going to be stepping up to providing HA's anytime soon. Same
goes for VPN termination. So assuming that I want a secure way to
get my bits past $EVILCO coffee shop, what's at the other end of
my bits?

Mike, and pervasive TLS is not a viable answer either since traffic
    analysis is still pretty incrim^H^H^H^H^Hvaluable

---

From: james woodyatt <[email-masked]>
Date: Tue, 08 May 2012 11:25:50 -0700

> separate from the service provided by the typical residential

The "rendezvous[*]" service used by BTMM is the Domain Name System.  There isn't anything particularly magical about BTMM that prevents dyndns.org or anyone else from implementing their own Wide-area Bonjour  domain using DNS servers outside of Apple's control.  Indeed, some folks do exactly that with their home networks using their own DNS servers.  Check out <http://www.dns-sd.org/ClientSetup.html> for more details.

Also, I too think this discussion is off topic for HOMENET.

--
james woodyatt <[email-masked]>
member of technical staff, core os networking

[*] c.f. <http://www.appleinsider.com/articles/05/02/18/apple_to_rename_rendezvous_technology_bonjour.html>

---

From: Ray Bellis <[email-masked]>
Date: Wed, 9 May 2012 07:21:59 +0000

> Also, I too think this discussion is off topic for HOMENET.

<chair hat="on">

+1 (for now)

</chair>

---

From: Michael Thomas <[email-masked]>
Date: Wed, 09 May 2012 13:03:07 -0700

>> Also, I too think this discussion is off topic for HOMENET.

Do you mean the BTMM tangent, or the whole discussion?

Mike

---

From: Ray Bellis <[email-masked]>
Date: Wed, 9 May 2012 20:13:24 +0000

> Do you mean the BTMM tangent, or the whole discussion?

IMHO, the whole discussion, although I didn't get a chance to discuss with my co-chair yet.

We have enough on our plate getting the initial homenet architecture defined.  This topic might be included in future rechartering, though.

Ray