Re: [homenet] security work items - what do we want to do?

2018-01-24 Thread Stephen Farrell
Hiya, On 24/01/18 19:21, Michael Richardson wrote: > > Stephen Farrell wrote: > > On 24/01/18 15:36, Ted Lemon wrote: > >> Yes, enrollment is the process by which trust is established. Google > >> home has an example, but it's rickety. It's actually not too bad for > >> actual G

Re: [homenet] security work items - what do we want to do?

2018-01-24 Thread Michael Richardson
Stephen Farrell wrote: > On 24/01/18 15:36, Ted Lemon wrote: >> Yes, enrollment is the process by which trust is established. Google >> home has an example, but it's rickety. It's actually not too bad for >> actual Google devices, but the third party enrollment process could >

Re: [homenet] security work items - what do we want to do?

2018-01-24 Thread Michael Richardson
Ted Lemon wrote: > I don't know what unmanaged enrollment really looks like, but sure. > We've mostly been talking about models for managed enrollment, and > that seems to be the way the market has been going (with remarkable > suck-itude, if the Google Home enrollment process is

Re: [homenet] security work items - what do we want to do?

2018-01-24 Thread Juliusz Chroboczek
> I do agree we'd need to know e.g. whether Babel implementations would > plan to support what flavours of DTLS (e.g. pre-shared keys vs. bare > public keys vs. certs if they do plan to use DTLS), I'm not worried about Babel. I am worried about HNCP, since I fear there's nobody who's both able a

Re: [homenet] security work items - what do we want to do?

2018-01-24 Thread Ted Lemon
On Jan 24, 2018, at 10:39 AM, Stephen Farrell wrote: > While I don't disagree with you, I do still wonder if we'd > not be better off using another term for cases where maybe > all that are involved are a couple of routers in the home, > and where there's no external party, such as google in the >

Re: [homenet] security work items - what do we want to do?

2018-01-24 Thread Stephen Farrell
Hiya, On 24/01/18 15:36, Ted Lemon wrote: > Yes, enrollment is the process by which trust is established. Google > home has an example, but it's rickety. It's actually not too bad for > actual Google devices, but the third party enrollment process could > really benefit from some open standards (

Re: [homenet] security work items - what do we want to do?

2018-01-24 Thread Ted Lemon
Yes, enrollment is the process by which trust is established. Google home has an example, but it's rickety. It's actually not too bad for actual Google devices, but the third party enrollment process could really benefit from some open standards (imho). > On Jan 24, 2018, at 10:03 AM, Stephen

Re: [homenet] security work items - what do we want to do?

2018-01-24 Thread Stephen Farrell
Hiya, On 24/01/18 14:55, Ted Lemon wrote: > I don't know what unmanaged enrollment really looks like, but sure. > We've mostly been talking about models for managed enrollment, and > that seems to be the way the market has been going (with remarkable > suck-itude, if the Google Home enrollment pr

Re: [homenet] security work items - what do we want to do?

2018-01-24 Thread Ted Lemon
I don't know what unmanaged enrollment really looks like, but sure. We've mostly been talking about models for managed enrollment, and that seems to be the way the market has been going (with remarkable suck-itude, if the Google Home enrollment process is typical). I think it might be worth

Re: [homenet] security work items - what do we want to do?

2018-01-24 Thread Stephen Farrell
Hiya, On 24/01/18 13:32, Michael Richardson wrote: > > Stephen Farrell wrote: > > On 24/01/18 02:48, Michael Richardson wrote: > >> > >> Stephen Farrell wrote: > - Does this sound > >> roughly right or off the wall? > >> > >> It sounds right. I think that bootstrap of

Re: [homenet] security work items - what do we want to do?

2018-01-24 Thread Michael Richardson
Stephen Farrell wrote: > On 24/01/18 02:48, Michael Richardson wrote: >> >> Stephen Farrell wrote: > - Does this sound >> roughly right or off the wall? >> >> It sounds right. I think that bootstrap of security should become an >> recharter item in the future. Some

Re: [homenet] security work items - what do we want to do?

2018-01-24 Thread Stephen Farrell
Hiya, On 24/01/18 02:48, Michael Richardson wrote: > > Stephen Farrell wrote: > > - Does this sound roughly right or off the wall? > > It sounds right. > I think that bootstrap of security should become an recharter item in the > future. Some kind of BCP on interactions with MUD, SUIT, et