Subject: Re: Chatroom feedback in a WG session?

From: Bill Fenner <[email-masked]>
Date: Sun, 29 Sep 2002 18:19:58 -0700

>I don't know the 
>details but I would be concerned about revealing plain text passwords 
>on a shared media.

Eh, enough people send plain text passwords on the wireless network at
IETF meetings that another vector isn't going to change much.  It seems
that pragmatism (like "pop works fine to get my mail") is much more
important to most attendees than security.  (Not that I would encourage
this attitude, but there doesn't seem to be much to do about it.)

(a half-hearted attemt at running dsniff on the wireless at the March
IETF yielded 289 cleartext passwords.  [154 in July; I didn't run
dsniff as much so the reduced number doesn't really reflect anything].
A quick glance shows that the majority look more like passwords than
like throwaway tokens.)

  Bill

---

From: Claudio Allocchio <[email-masked]>
Date: Mon, 30 Sep 2002 10:24:36 +0100

> A quick glance shows that the majority look more like passwords than

... shouldn't we "at least" include into the registration documentation a 
leaflet stating "You are STRONGLY suggested to use encryption while 
connecting using passwords to remote services (SSH or SSL tunnels)"

I can guess suggesting some "strong methods" like just blocking telnet 
and lettingg only ssh go out of the IETF LAN could still cause too many 
problems to some people, but maybe that's the (long) way to go...

Claudio

---

From: Randy Bush <[email-masked]>
Date: Mon, 30 Sep 2002 04:54:23 -0700

> connecting using passwords to remote services (SSH or SSL tunnels)"

i suspect the majority of the leakers had their laptops set up by
their IT departments and would not know their password or encryption
if it bit them on the butt.

randy