Re: [44net] GRE tunnels

I never said it was "strong authentication", I said it "should suffice". I've been doing IT and security work for a long time so I chose my words carefully. For the actual threat posed to an amateur radio IPIP or GRE tunnel, the effort to deploy, maintain and troubleshoot complex technologies like IPSEC - especially by those who are not networking experts - is not justified by the actual threat posed to the connection. Could an adversary work out a man-in-the-middle attack, misroute your traffic, and spoof one end of your IPIP/GRE tunnel? Sure. Is it in any way likely to happen? Not in in the least. If you've attracted the attention of a malicious actor who is capable and willing to do that against your connection, then doing a 44Net connection to begin with is probably the wrong strategy for whatever the workload is and you have bigger problems. Increased security brings increased complexity. Yes, I can make a super-secure tunneled connection with PKI authentication, ephemeral keying, and all sorts of other things. But it's complex and largely unnecessary for the threat posed to some links used to cart around some digital voice traffic. Is an authenticated and private (encrypted) tunnel better? Sure. Is it necessary? That's a harder question. Jason -----Original Message----- From: 44Net <44net-bounces+jason=mfamily.org(a)mailman.ampr.org> On Behalf Of Iain R. Learmonth via 44Net Sent: Friday, December 4, 2020 4:11 PM To: 44net(a)mailman.ampr.org Cc: Iain R. Learmonth <irl(a)hambsd.org> Subject: Re: [44net] GRE tunnels Hi, I would have thought that this community more than others would understand that BGP (especially for AMPR resources) is not all that secure, and IP addresses are not strong authentication. It depends what you want to do though. If it's just for leisure and experimentation, then fine, you do not need encryption. If there are issues of abuse later, you can sort them out when they occur. For emergency communications, and also I guess because I come at amateur radio from a computing science background and not from a radio background, I prefer something a little more pro-active. I don't want to be finding that things have been randomly attacked (you don't need to be targeted to be attacked, look at ransomware it will just attack everything it can) mid-incident where you're trying to respond to some emergency and then your "resilient" communications turn out to be not so resilient. There is no right or wrong answer, it depends on your threat model, but you should give it some critical thought. There's a reason that most roles in large enterprises will have training on IT security even if the role isn't even remotely IT related. Thanks, Iain. On 04/12/2020 20:58, Jason McCormick via 44Net wrote: -- https://hambsd.org/ _________________________________________ 44Net mailing list 44Net(a)mailman.ampr.org https://mailman.ampr.org/mailman/listinfo/44net