User: Password:
|
|
Subscribe / Log in / New account

Schaller: The long journey towards good free video conferencing

Schaller: The long journey towards good free video conferencing

Posted Oct 15, 2012 21:44 UTC (Mon) by dlang (subscriber, #313)
In reply to: Schaller: The long journey towards good free video conferencing by Cyberax
Parent article: Schaller: The long journey towards good free video conferencing

you may loath the 'soft center, hard permieter' model, but as long as it works, there's really no incentive for it to change.

defining how to setup IPv6 IPSec on your TV, DVR, Washing Machine, Fridge, etc is not trivial (for that matter, setting it up securely on your full blown computers is not trivial, even for experienced admins)

As long as devices can be shipped and 'just work' without some complicated setup, manufacturers will continue to have that as the default.

Any completely automated IPSec setup process is not going to be any more secure, as the rogue equipment will be able to automate joining the network just like any legitimate equipment.

Now that you have a 'soft center', the only remaining question is if you opt to expose this out to the Internet, or if you try to get some protection by putting a 'hard shell' around it.

and arguments for ubiquitous IPSec or SSL can actually reduce the overall security if they make it impossible for the devices at the edge of the network to protect devices inside the network.


(Log in to post comments)

Schaller: The long journey towards good free video conferencing

Posted Oct 15, 2012 21:57 UTC (Mon) by Cyberax (✭ supporter ✭, #52523) [Link]

Right now "soft center" doesn't work, it only pretends to do it. Admins of large companies are already feeling the heat with all those CEOs' iPhones that just MUST be connected to the internal network.

>Any completely automated IPSec setup process is not going to be any more secure, as the rogue equipment will be able to automate joining the network just like any legitimate equipment.

Right now IPSec is impossible to use, but that's because nobody has yet started to "humanize" it.

Schaller: The long journey towards good free video conferencing

Posted Oct 15, 2012 22:05 UTC (Mon) by raven667 (subscriber, #5198) [Link]

> Right now IPSec is impossible to use, but that's because nobody has yet started to "humanize" it.

True and unfortunate. There should be no need for SSL because IPSec should cover that use case but Opportunistic Encryption just didn't work well enough in the real world and ESP doesn't work well with NAT. IPSec represents the bad kind of multi-vendor consensus design that tries to be everything and ends up being nothing.

Schaller: The long journey towards good free video conferencing

Posted Oct 15, 2012 22:29 UTC (Mon) by dlang (subscriber, #313) [Link]

> Right now "soft center" doesn't work, it only pretends to do it.

right now nothing 'works' (for some definition of 'works')

Every large organization that has tried to get rid of the hard shell and harden everything has been broken into. But at the same time, every large organization that has tried to have a 'hard shell' and a free-for all inside has also been broken into.

'hard shell' by itself only works if you can control the communication out of the network

'harden everything' only works if you actually control every device on your network and have a sane way of administering the result.

The 'current' model of allowing everyone to have their own personally owned equipment that the company has no control over, and letting them connect it to the network (either directly, or via USB to the company computers) is a situation that gives you no control over your external communication, and no control over anything running inside.

Schaller: The long journey towards good free video conferencing

Posted Oct 16, 2012 22:31 UTC (Tue) by sorpigal (subscriber, #36106) [Link]

> 'harden everything' only works if you actually control every device on your network and have a sane way of administering the result.
I'll go one further: Harden everything only works if it's 99.99% automatic. Once you increase the number of devices hardening becomes so insanely time consuming that it just won't be done. The only sane way for one man to secure just 1000 devices is for him not to have to; in the ipv6 future 1000 will be a number that's easy for an individual to hit.

My prediction is that security through "the thieves haven't broken in to my house YET" will be the rule of the day. We're almost there now, but it will just get worse. Those users who notice that their toasters have been rooted, are stealing credit card numbers and forwarding them overseas will simply throw the toasters out and buy new ones, not attempt to secure them.

Schaller: The long journey towards good free video conferencing

Posted Oct 16, 2012 23:38 UTC (Tue) by Cyberax (✭ supporter ✭, #52523) [Link]

Hardening doesn't need to be complicated. Just imagine that you touch your phone to your refrigerator and it is automatically authorized to connect to your logical home network (by enrolling it into IPSec overlay).

Schaller: The long journey towards good free video conferencing

Posted Oct 16, 2012 23:51 UTC (Tue) by dlang (subscriber, #313) [Link]

sure, then you have a party and a guest bumps up against the fridge with a phone in their pocket (or backpack) and now your fridge in connected to their network.

even assuming that someone takes the time to engineer your solution, and all the different manufacturers manage to agree on a common spec for how it would work, and going even further, manage to implement it in a compatible way.

Schaller: The long journey towards good free video conferencing

Posted Oct 17, 2012 0:20 UTC (Wed) by Cyberax (✭ supporter ✭, #52523) [Link]

You'll need to add some interaction, like a simple "Confirm" button on fridge's touchscreen.

And most of components are already here. NFC is available on most phones and NFC readers are dirt-cheap.

Schaller: The long journey towards good free video conferencing

Posted Oct 17, 2012 0:22 UTC (Wed) by dlang (subscriber, #313) [Link]

> NFC is available on most phones

with the notable exception of Apple devices. how many companies are going to make a fridge that cannot be configured by any Apple customers?

Schaller: The long journey towards good free video conferencing

Posted Oct 17, 2012 0:28 UTC (Wed) by Cyberax (✭ supporter ✭, #52523) [Link]

You assume that it's a permanent situation. iPhones will probably get NFC as soon as Apple feels like inventing it.

Schaller: The long journey towards good free video conferencing

Posted Oct 17, 2012 15:33 UTC (Wed) by sorpigal (subscriber, #36106) [Link]

If you could achieve this I think it's fair to say that this is approaching 99% automatic.


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds