🚀 go-pugleaf

John D Loop <loop@snt.bst.bls.com> writes:
> Thanks for your comments, James.
> You would probably get an argument about DHCP and bridging in a WAN
> environment.  I believe almost all the ADSL providers started off that way
> (including BellSouth), but they got away from it as fast as they could.  DHCP
> works well, as long as you are in a trusted environment.  Stolen IPs,
> broadcast traffic, rogue DHCP servers, using MAC address as "authentication"
> proved very troublesome.

PPPoE has absolutely no security whatsoever.  It's in worse shape than
DHCP, since at least with DHCP, there's ongoing effort to add
security.

>  The Redbacks (which BellSouth [and the rest of the
> known universe] switched to) were added by the providers who would do almost
> anything to go to a more familiar PPP implementation (!), where authentication
> is via username/password, traffic isolated to the ppp connection, nobody can
> steal IPs.  In short, it "looks" like dialup.

Looks can be deceiving.  It's trivial to forge packets on PPPoE, and
use these forged packets to highjack user sessions or snipe them out
of existence as long as you have bridging at the Ethernet layer.

Security through obscurity is no security at all.

> They (Redback) had to invent a ppp-like implementation over ethernet to pull
> this off for all the ethernet NICs and ethernet bridging modems out there.

I strongly disagree.  It wasn't necessary at all.  Treat each ADSL
link as a separate Ethernet segment, and you're in business.  There's
no reason on earth to be bridging among separate ADSL links

I think you're confusing implementation with protocol design.

> I understand your concerns about pppoE, especially that it is a proprietary
> non standards track implementation, but I think the ADSL providers had little
> choice [other than to go away].  The Telcos have always been big proponents of
> standards [they want all this equipment to interoperate..], but market forces
> forced their hand.
> Also, I believe since the pppoE runs on a customer-specific PVC, the potential
> for the abuse is less.

If you can do that with PPPoE, you can do it with DHCP.

> Still trying to learn ppp, and now l2tp.  Grief. I thot I had it under control
> when I learned IP!
> ...I don't think I want to know about HURL and MOTM....

OK; I won't tell you.

-- 
James Carlson, Internet Engineering       <james.d.carlson@east.sun.com>
SUN Microsystems / 1 Network Drive         71.234W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.497N   Fax +1 781 442 1677
Second Edition now available - http://people.ne.mediaone.net/carlson/ppp