12:05:08 RRSAgent has joined #wot-sec 12:05:08 logging to https://www.w3.org/2021/11/01-wot-sec-irc 12:05:39 present+ Kaz_Ashimura, Michael_McCool, Philipp_Blum, Tomoaki_Mizushima 12:06:06 chair: McCool 12:09:23 topic: Minutes review 12:09:30 mm: Oct 18 12:09:35 ... also IETF meeting 12:10:16 -> https://www.w3.org/2021/10/20-wot-sec-minutes.html 12:10:21 -> https://www.w3.org/2021/10/28-wot-minutes.html 12:11:05 s/IETF/joint meeting with IRTF T2TRG and DID/ 12:11:28 s| https://www.w3.org/2021/10/28-wot-minutes.html| https://www.w3.org/2021/10/28-wot-minutes.html Oct 28| 12:11:55 s|https://www.w3.org/2021/10/20-wot-sec-minutes.html|https://www.w3.org/2021/10/20-wot-sec-minutes.html Oct 8| 12:12:02 rrsagent, make log public 12:12:06 rrsagent, draft mintues 12:12:06 I'm logging. I don't understand 'draft mintues', kaz. Try /msg RRSAgent help 12:12:24 mm: (goes through the minutes from Oct 28 meeting) 12:20:16 kaz: (fixes typos, etc.) 12:34:23 (some discussion on IDs within local environment) 12:34:36 mm: (adds a comment to the GitHub Issue) 12:35:03 -> https://github.com/w3c/wot-security-best-practices/issues/14 wot-security-best-practices issue 14 - TD Signatures, Key Management, and Object Security 12:36:11 mm: suggested actions 12:36:55 ... 1. best WoT practice should be to use TLS for all WoT Things when using HTTP. Otherwise almost all other security measures are broken. 12:37:20 pb: TLS works well without your own key management system 12:37:36 mm: (adds clarification) 12:38:05 ... TLS does work locally, as long as an identity can be confirmed for an endpoint 12:38:18 ... regular DNS is fine 12:39:15 ... a public URL (using DNS, which avoids duplicate registrations) does this but a hardware key and a derived ID could also be used on a LAN 12:39:47 ... mDNS (e.g., .local names) do not sine they can be easily spoofed. 12:41:03 ... To do: check BREWSKI; there might be a means to combine mDNS, hardware keys, and encryption to generate unspoofable names 12:42:11 -> https://datatracker.ietf.org/doc/html/rfc8995 RFC8995 - Bootstrapping Remote Secure Key Infrastructure (BRSKI) 12:42:59 pb: not only for HTTP but also CoAP? 12:43:59 mm: (adds DTLS for CoAP/UDP in addition to HTTP/TCP) 12:44:09 ... suggested action 2 12:44:58 ... for non-browsers operating on a LAN, e.g., hubs talking to devices, they can use an onboarding process or some other mechanism to establish device identities and set up secure connections. 12:45:22 ... To Do: consider some specific recommendations for this case, e.g., BRSKI 12:46:24 ... suggested action 3 12:46:41 ... for browser access, they will (currently) have to use a public URL 12:47:43 ... e.g., via a clod proxy or a URL exposed thourhg the ISP and firewall using STUN/TURN and/or DyDNS. 12:48:14 ... ohwever this should be limited to a small number of "remote access points", e.g., to a hub dashboard. 12:48:45 pb: we should have some recommendation 12:49:04 ... but should not limit the possible methods to it 12:49:23 mm: we should clarify best practices 12:49:25 pb: ok 12:50:14 mm: suggested action 4 12:50:28 ... add a recommendation that the number of public URLs should be minimized. 12:50:52 q? 12:50:55 q+ 12:52:20 ack k 12:53:53 kaz: technically, we should say "for systems that don't support secure local access, e.g., browsers currently" instead of "browsers have to..." 12:54:03 mm: (adds the modification) 12:55:50 ... my question here is that regular IoT devices don't be regularly updated 12:56:47 pb: update is a good point 12:57:33 mm: should have a best practice to have mechanism to support secure updates. To Do: look at SUIT. 12:58:19 q? 12:58:22 q+ 12:58:52 ack k 13:00:31 mm: regarding the minutes for item 6 from vF2F Day 5 13:00:43 ... and item 7 13:00:58 ... item 6 and 7 to be merged, I think 13:01:20 ... objections to approve those sections? 13:01:24 (none) 13:01:28 (approved) 13:02:34 i|regarding|-> https://github.com/w3c/wot-security-best-practices/issues/14#issuecomment-956210818 McCool's comments for Issue 14 based on the discussion today| 13:03:26 i|regarding|-> https://github.com/w3c/wot-security-best-practices/issues/13#issuecomment-956212304 added one line comment to see the above comments to Issue 13 as well| 13:03:32 [adjourned] 13:03:38 rrsagent, make log public 13:03:42 rrsagent, draft minutes 13:03:42 I have made the request to generate https://www.w3.org/2021/11/01-wot-sec-minutes.html kaz 15:00:20 Zakim has left #wot-sec 19:07:36 zkis has joined #wot-sec 20:33:06 zkis has joined #wot-sec 20:49:35 zkis has joined #wot-sec 23:51:00 kaz has joined #wot-sec