"waste of time"

Mon Mar 15 03:02:26 UTC 2004

On Sun, 14 Mar 2004 23:00:01 +0700, "Dr. Jeffrey Race" <jrace at attglobal.net>  said:
> 
> On Sun, 14 Mar 2004 08:55:09 -0700 (MST), guy wrote:
> >I can think of one university who requires students to login through a web
> >> portal before giving them a routable address.  This is such a waste of
> >> time for both parties.
> 
> Translation:
> 
>  "It is too much trouble for us to keep the kids from throwing trash
>   out the dorm windows, so we'll just let the public pay for cleaning
>   up our mess every morning."

No - go back and re-read what he said.  He specifically stated that since we
already *know* what port of what switch the user is on, and we know that the
other end of the wire is in a specific dorm room, there's no real additional
gain in making them authenticate.  So a better analogy is "We don't need
to go knock on every door on the floor, because we already know the trash
is coming out the 3rd window from the end...."

If it's not a waste of time in that case, it's not a waste of time to do the
same thing for *every* user, even if we "already know" what office the cable
terminates in.

Just out of curiosity, does your site policy require you to authenticate on
your office port before you can get out to the rest of the world?  (I don't
know about your wiring, but our average dorm room wiring is more physically
secure (being inside walls and all that) than the cat5 that runs to the docking
station I'm on - at least the last 40 feet or so is semi-exposed and easily
accessible in the cabling chase at the bottom of the cubicle walls)...

(For the record, our general policy is that if we already know where the other end
of the wire is, we don't require authentication, but things like the modem
pool require a userid/password, and the wireless won't DCHP unless you've
registered your MAC address.  Yes, I know they're spoofable. Yes, we recognize
the issues.. :)

Now re-run the whole cost-benefit ratio, and consider that the *biggest* issue
for security is *legitimate users* who happen to have acquired some sort of
malware on their machine......
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20040314/5d300811/attachment.sig>