<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; ">Some comments:<DIV><BR class="khtml-block-placeholder"></DIV><DIV>1) this is likely to be an involved and confusing process for most normal people, since they'll look at you and say "I want to get phone access, and I don't own a Mac". Asking for people to enter in their MAC address is like asking them to enter the serial number for the engine block in their car.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>2) Great idea, though if we could enter the server whitelist via DNS names, and have the wifidog auth update the IP automatically, that would be even better</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>3) Even better idea. If someone is going to be smart enough to tunnel traffic like this, then its likely that they're smart enough to spoof a mac address or do something else to get around any security. Plus I don't think there's a significant risk for this, and our goal should be to make the hotspot as easy to use as possible. This is the only way that people can just pull out their VOIP phone and use it without a problem.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>4) I don't think this will work for VOIP phones, who can't even click through the splash page. Unless I'm missing something.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>5) This is also a good idea, though we'll constantly be playing catch up with the network device providers, and this will be lots of overhead work for the network operators. If we go this route, WifiDog should publish a list of MAC addresses and their device category, and allow network operators to click a button that says "Allow all VOIP phones to use this network without authenticating", which will cause the auth server to suck down a constantly updated list of MAC address ranges for VOIP phones. Same is true for PSP and DS, and possibly other device classes as well.</DIV><DIV><DIV> <SPAN class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Lucida Grande; font-size: 10px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><SPAN class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Lucida Grande; font-size: 10px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><DIV><BR></DIV><DIV>Dana Spiegel</DIV><DIV><SPAN class="Apple-style-span"><FONT class="Apple-style-span" color="#000000">Executive</FONT><SPAN class="Apple-converted-space"> </SPAN>Director</SPAN></DIV><DIV>NYCwireless</DIV><DIV><A href="mailto:dana@NYCwireless.net">dana@NYCwireless.net</A></DIV><DIV>www.NYCwireless.net</DIV><DIV>+1 917 402 0422</DIV><BR class="Apple-interchange-newline"><DIV>Read the Wireless Community blog: <A href="http://www.wirelesscommunity.info">http://www.wirelesscommunity.info</A></DIV><BR class="Apple-interchange-newline"></SPAN></SPAN> </DIV><BR><DIV><DIV>On Feb 1, 2006, at 12:05 AM, Benoit Grégoire wrote:</DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite"><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">On January 31, 2006 11:37 pm, Jason Potter wrote:</DIV> <BLOCKQUOTE type="cite"><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Hi All,</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Just an extension to the discussion below, what are the approaches to</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">giving free wifi to devices in a venue that don't have a browser.</DIV> </BLOCKQUOTE><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">1-Tie MAC adress(es) to a single user account who vouches for it<SPAN class="Apple-converted-space"> </SPAN></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">(<A href="http://dev.wifidog.org/ticket/19">http://dev.wifidog.org/ticket/19</A>).<SPAN class="Apple-converted-space"> </SPAN>Only slightly more insecure than normal<SPAN class="Apple-converted-space"> </SPAN></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">captive portal operation.</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">2-Whitelist specific servers ("perfectly" secure, allows the group to ask<SPAN class="Apple-converted-space"> </SPAN></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">money from their operators for the priviledge since they run a business on<SPAN class="Apple-converted-space"> </SPAN></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">your network).<SPAN class="Apple-converted-space"> </SPAN>Good for the DS and VOIP operators, doesn't work for allowing<SPAN class="Apple-converted-space"> </SPAN></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">you to connect to you own asterisk server for example.</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">3-Whitelist specific ports (such as SIP).<SPAN class="Apple-converted-space"> </SPAN>Once you do that, anyone can tunnel<SPAN class="Apple-converted-space"> </SPAN></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">any kind of traffic trough them.</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">4-Don't run any authentication at all.<SPAN class="Apple-converted-space"> </SPAN>Works fine for those who only run a<SPAN class="Apple-converted-space"> </SPAN></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">portal to display a splash page and terms of service.</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">I hadn't tought of Pete's solution:</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">5-Whitelist a range of MAC adresses by manufacturer.<SPAN class="Apple-converted-space"> </SPAN>Only works when the<SPAN class="Apple-converted-space"> </SPAN></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">manufacturer and the service to be whitelisted are the same, so it would work<SPAN class="Apple-converted-space"> </SPAN></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">for the DS, but not for a wifi phone).<SPAN class="Apple-converted-space"> </SPAN>Also, once the users know whose<SPAN class="Apple-converted-space"> </SPAN></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">device is whitelisted, they no longuer have to guess of find a MAC adress to<SPAN class="Apple-converted-space"> </SPAN></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">spoof.</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">If anyone has other ideas, please speak up.<SPAN class="Apple-converted-space"> </SPAN>So far there is no perfect<SPAN class="Apple-converted-space"> </SPAN></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">solution.</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">--<SPAN class="Apple-converted-space"> </SPAN></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Benoit Grégoire, <A href="http://benoitg.coeus.ca">http://benoitg.coeus.ca</A>/</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">_______________________________________________</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">WiFiDog mailing list</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><A href="mailto:WiFiDog@listes.ilesansfil.org">WiFiDog@listes.ilesansfil.org</A></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><A href="http://listes.ilesansfil.org/cgi-bin/mailman/listinfo/wifidog">http://listes.ilesansfil.org/cgi-bin/mailman/listinfo/wifidog</A></DIV> </BLOCKQUOTE></DIV><BR></DIV></BODY></HTML>