Re: [Captive-portals] CAPPORT meeting at IETF95 in Buenos Aires.

Subject: Re: [Captive-portals] CAPPORT meeting at IETF95 in Buenos Aires.

From: David Illsley <[email protected]>

Date: Tue, 16 Feb 2016 16:59:32 +0000

Archived-at: <http://mailarchive.ietf.org/arch/msg/captive-portals/8XR6x0Bc1FYqllYIEva74Io-Kdw>

Cc: "[email protected]" <[email protected]>, Warren Kumari <[email protected]>

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=Dqwp8h8cTSkffIGN96sOg/p14QTkgaAYqrgg2LlNjEM=; b=FnsuDbwSP9FCu/9qM4J5oyeJE+1cpzj81bOxTYI5JTFGoVptrjKVJpxRTO40d1lkDN m7HwcgtW9NqH/rFySSbpEB1pfXN6Ba8zX4s5UPIQW3mLgejX7fVlYat2q/bge9cUEuF8 QHdhwEhumonrcjX/8nOCZkrkFFv618ZnX0XTZ63FbkGT/glBpHTxbVYQQqJx6rCmIHFy Ry08+WDgCXz3abjLhso2tdBdb3x2rMUOFh323XGjg6ry2Hs72kZ+Bmigos3/UB9TCO/Z dG0GP+HYL/qhPN1NqXlADlvu+0xwD5iaU8OFkD11I+zpT8eRrEFaUakGeelyRaU1AFTK Hfvg==

In-reply-to: <[email protected]>

List-archive: <https://mailarchive.ietf.org/arch/browse/captive-portals/>

List-help: <mailto:[email protected]?subject=help>

List-id: Discussion of issues related to captive portals <captive-portals.ietf.org>

List-post: <mailto:[email protected]>

List-subscribe: <https://www.ietf.org/mailman/listinfo/captive-portals>, <mailto:[email protected]?subject=subscribe>

List-unsubscribe: <https://www.ietf.org/mailman/options/captive-portals>, <mailto:[email protected]?subject=unsubscribe>

References: <CAHw9_iJbQbkmGRcjn8A_agvtQqxK97FJy2caX_AceDn729y_0Q@mail.gmail.com> <[email protected]>

I'm interested in the Sandboxing point in section 4. I understand these to be designed as a pro-user security feature. In general I don't trust random network devices in hotels so I'll use a VPN. That leaves me open to malware attacks from the captive portal [1]. Deciding to put captive portals into a more-restrictive-than-usual sandbox then seems reasonable to me.

Can you explain the problems caused by sandboxing (I don't think I've ever experienced them)?

David

[1] http://www.wired.com/2014/11/darkhotel-malware/

On Mon, Feb 15, 2016 at 11:24 PM, Mark Nottingham <[email protected]> wrote:

> On 16 Feb 2016, at 4:46 AM, Warren Kumari <[email protected]> wrote:
>
> Mark Nottingham is already working on a "problem statement" type draft with outlines some of this, but we'd like more viewpoints/ discussions.

Please!

> His initial submission is here: "Before You Log In, Here's A Brief Message From Our Sponsors!" - draft-nottingham-capport-problem (https://datatracker.ietf.org/doc/draft-nottingham-capport-problem/)

... and that's really just a regurgitation of what we previously put together at <https://github.com/httpwg/wiki/wiki/Captive-Portals>. If people have suggestions, corrections, pull requests, etc. I'm all ears.

Cheers,

--
Mark Nottingham https://www.mnot.net/

_______________________________________________
Captive-portals mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/captive-portals