Subject: Re: PILC IETF-51 discussion on LINK Security Considerations

From: Dan Grossman <[email-masked]>
Date: Mon, 20 Aug 2001 14:05:55 -0400

<[email-masked]> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
--------
> 
> 
> Dan Grossman wrote:
> > 
> > Joe Touch wrote:
> > 
> > > Further, link security isn't the only way to provide this privacy.
> > > IP addresses on a single hop or even multiple hops can be hidden
> > > using tunnels (IPsec tunnel mode or, IMO preferably, IPIP encapsulation on
> > > an IPsec transport mode association).
> >
> > Sure, and how many commercial web sites use IPsec tunnel mode or IPIP
> > encapsulation on IPsec transport mode?
> 
> Presumably you're hinting that they _do_ use SSL?
Not as much as one might like.  As an experiment go to your browser and:

IE: Tools->Internet Options->Advanced
   Check "Warn if changing between secure and not secure mode"
(I think my version at home also has "Warn if submitting forms in not secure 
mode")

Netscape: Communicator-> Security Info -> Navigator
   Check the boxes under "Show warning before:" 
      "Entering an encrypted site"
      " Leaving and encrypted site"
      "Viewing a page with an encrypted/unencrypted mix"
      "Sending unencrypted information to a site"
Disclaimers:  different versions of the browsers configure these things 
differently, so YMMV.  Sorry, these are the two that happen to be handy.  
Opera and Mozilla users are on their own.

Then visit your favorite sites, including ones to which you have password 
access, or which have personal information about you, or which you might not 
want your next door neighbor to know you visited (don't do this from the 
office!).  You'll be unpleasantly surprised.  

In fact, I did this experiment last night (not purposely) and found yet 
another site that I use which sends username and password in the clear and has 
some mildly sensitive personal information.  I'm gonna give the webmaster a 
hard time about that. 

> 
> Whether a commercial website uses link encryption or IPsec tunnels
> is a link (or, in the case of tunnels, pseudo-link) issue, and cannot
> be determined E2E. Some use such encryption to get to a trusted core 
> provider using a series of insecure intermediate 1st and 2nd tier ISPs,
> where, for whatever reason, they don't want their traffic analyze by the
> intermediate ISPs (snoop for advertisements, etc.)
I've never heard of this practice.  Is it even supported in consumer desktop 
OSes?
> 
> This is useful even where (or especially where) the website doesn't
> want or need SSL to the end user, but still wants to keep its content
> and statistics private from snooping ISPs on its end.
> 
> > So what's at stake here is the credibility of the Links draft.  If we say that
> > link encryption is absolutely useless, then we lose the opportunity to urge
> > good design and our audience will simply ignore that recommendation anyway
> > (and possibly be more sceptical of the remaining recommendations).  If we say
> > that link encryption in itself is insufficient to protect high valued assets,
> > and outline steps for good security design, we will have provided a useful
> > service to the link design community.
> 
> Link encryption provides no NEW capability, e.g., compared with tunnel
> encryption. That is NOT to say that either is useless, just that neither
> is unique.
Uniqueness is not in the function itself, but rather in how it's distributed 
and who's in control.  Link encryption provides protection to an especially 
vulnerable subnet, under the control of the owner of that subnet and requiring 
no explicit cooperation from any other party.
> 
> I was going for clarification of the bathwater, not tossing it out.
Agree.
> Joe