3 ms·
How many engineers have spent how many hours trying to hack solutions for exactly this problem for their corporate/academic network over, and over, and...? And
by zaroth 9y ago
How many engineers have spent how many hours trying to hack solutions for exactly this problem for their corporate/academic network over, and over, and...?
And when they hit 4096 user accounts?
It's actually depressing how hard they had to work to enable a basic BYOD network-layer authentication use case. Particularly since network-level device authentication is basically "securing your network 101" which any network in the world practicing good security hygiene should be implementing.
- NationOfJoe 9y agoI know very little about network-layer security, is there a best practice here? Do people try so hard because they do not like it or is there one per vendor type of thing, nothing open and "standard" Is this problem not actually solved and your just pointing out how depressing that something seemingly so essential is not solved?
- maruhan2 9y agocurious as well. I first understood it as "how could they struggle with something so basic"
- jon-wood 9y agoTypically wired 802.1x is used in an enterprise setting, where devices are under control of the IT staff. In that case provisioning devices with a certificate can be done easily and it all works pretty smoothly. Likewise enterprise settings want to put all users on the same (or a small number of) VLAN(s). Any devices outside of IT’s control, such as employee phones and tablets, will be restricted to a guest network with no access to anything beyond the internet connection. In this case neither is true - they have no control over devices being connected so can’t rely on SSL certs, and they explicitly want to isolate each user on their own VLAN. Given those constraints this is a much harder problem to solve.