Subject: Re: [Add] New Threats ID for ADD

From: "Deen, Glenn" <[email-masked]>
Date: Wed, 22 Jul 2020 01:00:32 +0000

On 7/21/20, 2:53 AM, "Stephane Bortzmeyer" <[email-masked]> wrote:

    On Tue, Jul 21, 2020 at 12:40:27AM +0000,
     Deen, Glenn <[email-masked]> wrote
     a message of 102 lines which said:

    > I wanted to bring to your attention a short, very short, draft that
    > I wrote up based on an email thread on the WG list.  It captures a
    > basic framework of Green-Yellow-Red threat and trust relationships
    > the user may have with their network.  The hope is that this can be
    > a basis for focusing discussion of threats and what mitigations
    > maybe needed in different situations.
    >
    > https://urldefense.com/v3/__https://datatracker.ietf.org/doc/html/draft-deen-add-threats-00__;!!CQl3mcHX2A!SmP0z3rxXauBiJCYahflGUwD76xD7pf28ux92VUxLzZ4jlh7VsfH7HzRYR655gJnTw$

    I see no use for this document. It seems to consider only the
    potential risks by outsiders, and not the risks by the operators,
    which are as important. For instance, assessing that the "User's ISP
    network" is safe or not is not just a matter of wether it is properly
    secured: it is also a matter of what they decide to do (an ISP
    resolver which censors Sci-Hub is not safe for me, even if it is
    secured and protected from outside attackers).

    This draft is not a proper threat model for the Internet.

This draft is entirely from the perspective of the user.    While it offers examples of what a user may view as in the Green or Yellow or Red, the placement is not proscriptive and can change for different user's perspectives.

    Also, how was decided the list of examples? "User's own home network"
    is marked as green but it is typically quite unsafe, both because
    typical users do not have the knowledge, inclination and/or time to
    secure it, and also because the danger can be inside (see this
    excellent paper for many examples
    <https://urldefense.com/v3/__https://www.schneier.com/academic/paperfiles/Privacy_Threats_in_Intimate_Relationships.pdf__;!!CQl3mcHX2A!SmP0z3rxXauBiJCYahflGUwD76xD7pf28ux92VUxLzZ4jlh7VsfH7HzRYR4urgn69A$ >)

Again, it's a non-proscriptive list of examples and will change depending on the user's views.  Some may not trust the ISP CPE, current operational practices show that most will.  Some may read Bruce's paper and not trust their significant other to on the same network segment, certainly many of use segment our kids and choose different DNS settings for their devices.   The bottom line is that it's the user's choice and the user's views that determine the choice.   They can choose to do special mitigations to manage perceived threats, and they equally can choose to delegate it to a third party.  Many take whatever settings their ISP offers, and now with browsers providing auto-upgrade to DoH providers many are choosing to delegate to and trust their browser maker.

Also, yes there is a typo in the title of draft.  I wrote it using another as a template and I missed deleting the work "here" from the title.   I will fix it when datatracker opens again.

Regards
Glenn

---

From: Vittorio Bertola <[email-masked]>
Date: Wed, 22 Jul 2020 14:09:41 +0200 (CEST)

> Il 22/07/2020 03:00 Deen, Glenn <[email-masked]> ha scritto:
> 

The idea in the draft is interesting and I think that a user-defined threat model is one of the few workable scenarios, especially for smarter users. However, to lead to proper assessments, the draft should consider all the threats that may hit the user. 

For example, if I turn on a VPN to escape the risk of a yellow network, the final result can be even worse if the VPN is a scam (e.g. like the seven VPN operators here https://www.theregister.com/2020/07/17/ufo_vpn_database/ ).

Same if I use a random open DoH resolver found somewhere on the net (e.g. in a list of "open resolvers you can use" written by who knows who) without knowing who they are: that would be just like using a random open wi-fi network found on the street.

I suspect that we would then end up with a socio-economic model, in which I trust people that I know and/or that I have some kind of contract with, or that have been recommended by someone I know / I trust.

-- 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked] 
Office @ Via Treviso 12, 10144 Torino, Italy