[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: R41 in draft-ietf-v6ops-cpe-simple-security-07




On 4/08/2009, at 11:40 PM, Rémi Denis-Courmont wrote:

We must live in different planet. Because on my planet, most people

wouldn't know how to authenticate to their firewall. IPv6 is supposed to be

at least as easy to configure as IPv4...

A half dozen years ago, most home network wireless LANs in the US were open.  Market surveys that I saw from that time indicated that a lot of people would prefer that their networks be private.  Today, home wi-fi networks are mostly private, at least in the US.  AFAICT, the vast majority of people who are running their wi-fi networks without privacy do so because that's the way they want to run it.  Last week, I heard that a major US service provider is going to ship a wi-fi CPE with wi-fi privacy turned on by default.  That's progress as most gateway/router vendors don't do that today because it could result in a lot of service calls given that people can be running WEP, WPA or WPA2 on client devices.  I expect to see more providers and vendors ship their wi-fi products with privacy turn on by default, and who therefore expect their customers to authenticate to a wi-fi/router as part of the process.  So I think your statement above is shortsighted for at least this reason.

There is innovation taking place in home network access controls - WPS is one attempt by vendors to provide usable security in an unmanaged environment.  I know of a few other organizations that are designing security into their home networking services and not interpreting "unmanaged" as meaning "insecure".  It would be shortsighted to design a firewall control protocol that does not at least have access control as an option. 

Mark