Subject: Re: Limiting the Use of Site-Local

From: Keith Moore <[email-masked]>
Date: Wed, 30 Oct 2002 18:06:11 -0500

> > you don't have to have the source to IOS in order to
> > figure out a way to get a router to tunnel the traffic
> > to a compromised, programmable host of your choosing.
> > just build the attack into a mail virus. then all you
> > need is one client inside the firewall running outlook
> > express...
> 
> You're running out of gas, pal. Control devices on a utility network do
> not have Outlook Express.

if you think that the only place that SLs will be used on 
a utility network, or that people can be relied to put all 
devices that need protecting on a separate network, you're 
living under a rock. 

Keith
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Michel Py" <[email-masked]>
Date: Wed, 30 Oct 2002 15:02:51 -0800

Michel.

---

From: Margaret Wasserman <[email-masked]>
Date: Wed, 30 Oct 2002 18:25:08 -0500

Michel,

You have made a statement that the use of IPv6 site-local
addresses (as opposed to globally-unique addresses) will
increase the security of a private network.  And, I still
don't understand the basis for that claim.

Could you please answer the following question that I
posted earlier?

>Let me turn the question around... You have posited that the
>use of site-local address is somehow more "secure" than using
>a private global address range that is filtered in the router.
>Why? What attacks would work in the latter case that wouldn't
>work in the former case?

Thanks,
Margaret