RE: R41 in draft-ietf-v6ops-cpe-simple-security-07

[Rémi Denis-Courmont <remi@remlab.net>]

On Wed, 5 Aug 2009 01:03:55 +0300, Yaron Sheffer <yaronf@checkpoint.com>

wrote:

> Hi Mark,

> 

> My security reflexes tell me that authenticated is better than un-, and I

> agree that the protocol MUST support such a mode. But in practice, this

> protocol will be used by applications, which most likely will store the

> auth

> credentials somewhere. Malware can subvert the applications and/or get

> directly at the credentials. At which point I'm not sure this is so

secure

> any more.



Supporting authenticated mode, sure. But by definition, this won't work in

an unmanaged network... As for more controlled networks, it is questionable

whether hosts should be allowed to modify the firewall configuration at

all, anyway.



-- 

Rémi Denis-Courmont