Subject: Re: CAP: Security Considerations

From: "John Stracke" <[email-masked]>
Date: Thu, 14 Feb 2002 09:52:51 -0500

>What if I have something in a secure area and don't need to authenticate?

Basic assumption of network security: there are no secure areas.

If, by "secure area", you mean a military base, with a network protected 
by an air gap and men with guns, then you've answered your own question: 
someone who can afford physical security can afford to implement 
DIGEST-MD5.

/========================================================\
|John Stracke                    |Principal Engineer     |
[email-masked]   |Incentive Systems, Inc.|
|http://www.incentivesystems.com |My opinions are my own.|
|========================================================|
|"What a plan! Simple, yet insane!" -- _Monsters, Inc._  |
\========================================================/

---

From: Gary Frederick <[email-masked]>
Date: Thu, 14 Feb 2002 09:32:58 -0600

> Basic assumption of network security: there are no secure areas.

Basic assumption of people working on security: it's necessary.

> someone who can afford physical security can afford to implement 

I was thinking of my wife's calendar and mine. I'm secure with who she 
is and that her calendar and mine should talk.

Forcing EVERYTHING to authenticate is simple, yet insane.

But it's ok if that has to be... sigh

Gary

"Thanks for noticing" Eeyore to Pooh