[aprssig] APRS Mobile 1.0 Released for iPhone/iPad

[Steve Dimse]

On Sep 22, 2014, at 8:43 PM, Javier Henderson <javier at kjsl.org> wrote:

> 
> Do you have a link for the "relevant presentation"?
> 
> Sure: https://www.youtube.com/watch?v=wQxtvvhf4K8
> 
This is a talk about the authentication side only. It does not address the backend (APRS IS) which is wide open. 

So yes, this is a way to authenticate hams. Is it innovative? Of course not. As the talk itself says hams have been using LotW authentication since 2003. The use of SSL authentication goes back much further. But it is ONLY authentication. The computer you are connected to can verify you are a ham, but the rest of the network cannot!

Imagine your bank has the most sophisticated two-factor authentication available. Every time you log on you have to enter a number from a key fob as well as your password. The bank then texts your phone with a random number you have to enter to complete the log in (really, three factor). That is a very secure authentication mechanism. However, if your bank lets anyone call by phone, give just your name and transfer money out of your account, that great authentication is totally wasted. Your money will disappear in no time. If you want something to be secure, it must be secure on all sides, not just from a pretty front facade. 

Here is the important thing I'm trying to get across. AUTHENTICATION JUST DOESN'T MATTER IN THE CURRENT APRS IS. You can have the most foolproof authentication possible, but any way you choose to express that on the APRS IS can be spoofed. So fancy authentication is nothing but a useless toy. If you want to play with it fine, but do not be saying that this in any way makes APRS IS more secure. IT DOES NOT!

The only way to fix this is to start over with a parallel APRS IS. And (to localize to the US which has the largest base of APRS users) if the FCC suddenly reversed 15 years of tolerance and said that IGating via the current APRS IS is illegal, then there would be a strong incentive for the development to take place, and for the user base to switch over. But as things stand no there is simply no incentive driving the creation and use of a separate APRS IS. Until there is back end security this is nothing but a meaningless toy.

Steve K4HG