Martin Fowler's Gothic Hotel Model – How It Should Be Done | Hacker News Reader

Martin Fowler's Gothic Hotel Model – How It Should Be Done

analysisdesignmatrix.com

71 pointsUltraDark27 comments

Who gave it such a ridiculous name? Trust Fowler to take something that's been around for thirty years and give it a name that doesn't invoke any sense of what it actually is.

This has been around since at least the 90s, but back then it was called port knocking. I remember seeing an implementation in the 90s that required different ICMP echo packet sizes (say 56, 64, 64, then 56 bytes) sent in order for the system to unfirewall a particular service port for that incoming IP.

Although I kind of share your anger at giving weird names to stuff that's been there for decades[0], port knocking could be considered as just one specific case of this pattern and not the general case.

What if we don't use different ports? Your example uses ICMP packages with different sizes, not ports. What if you use something at the application layer that doesn't require ports, maybe a sequence of (invalid) calls to separate end-points?

Personally, I don't care how it's called as long as everyone agrees on what it is and here, again, I agree with you in that "Gothic Hotel" might not be the best name.

[0] Just the other day I heard a plain-old FTP server described as "cloud-based storage service".

Agree on the naming bit. Haskell - named after a famous logician; LISP - LISt Processor; APL - A Programming Language...Fortran, Ada, all have sensible names, or easy to reason about or guess. Now, 'kitten', Rust, Lua, Joy, Python, well, I like them, but you get the point. Don't even mention startup company names!

Can anyone dumb this down just a little?

Simplified example: to open up access to a database server port, you’d have to send specific packets in a specific sequence on specific ports. It’s kinda like doing a secret knock on a series of doors in a neighborhood before an entirely new door opens up in the side of a building.

And if you knock blindly on a few doors, the system knows you’re an intruder, and no soup for you even if you stumble into the right knock sequence.

>>to open up access to a database server port, you’d have to send specific packets in a specific sequence on specific ports

AKA port knocking[1], minus the special twist at the end where an intrusion/network detection system (IDS or NDS) automagically detects failed port knocks and responds accordingly.

[1] https://en.wikipedia.org/wiki/Port_knocking

I used to use portsentry in a similar way, but this looks interesting as a preset sequence of port knocks, rather than shitcanning any client that steps on a landmine port.

Why not just a password? (you can also lock out after X incorrect attempts) I don't see benefits except for additional security through obscurity factor, which crypto wisdom dictates should not be relied upon.

Security through obscurity is a very misunderstood concept. It should never be used at the expense of proper security (i.e. rolling your own crypto), and you should always act under the assumption that targeted attackers can see through your obscurity, but it can be a valuable part of defense in depth: especially against unskilled attackers.

Consider an 0day for example. When the 0day is published, attackers are going to mass-scan the internet for vulnerable applications. Your WAFs, etc won't yet block the attack, and if you have a vulnerable application that must be externally facing, you may get hit by this mass-scan. If your applications are protected with port knocking, however, you'll have that extra window of time to apply patches and protect yourself before you're directly targeted.

Well, but if port knocking was a great effective security tool, everyone would be using it, which defeats the obscurity advantage and would bring it back on par with good old passwords.

It might be a decent extra tool for very delicate situations, but I find it reasonably clear that it's largely self-defeating and not to be relied upon. It can also introduce further bugs.

I can see it could have an appeal as a proper password system though (not an obscurity device), since it's really the first step in interacting with a server. With password protocols, you usually have a more complicated interaction that can open a greater surface area. It seems good practice to authenticate absolutely as soon as possible.

The benefit of port knocking is that it essentially gives you a channel to transmit a password over, without revealing the existence of the system that's being authenticated for. A traditional password, on the other hand, requires some sort of socket that leaks the presence of a listening server.

Even if everybody were to use port knocking, knowing that fact doesn't give you any knowledge about whether a given IP hosts zero, one, or some arbitrary number of possibly vulnerable services.

"If this was good everyone would be doing it" is... shaky logic, at best.

I think the intent is an argument that basically says "if everyone were doing it, it wouldn't be good" which is less shaky (though see ShaneWilton's comment as to why this isn't so).

One clear downside: you've now created an easy low-bandwidth way for anyone to deny you from opening connections there, since others can easily interfere with your port knocking sequence.

to me it sounds like a typical safe lock - 2 turns left, 3 and half right, ...

>to send specific packets in a specific sequence on specific ports.

like Gothic Motel model itself it looks like an unnecessary complication. I think we can get pretty much the same effect if typical password (its hash) was sent in a sequence of say 10 packets instead of 1.

Guys, try reading the linked article first? This is just an example on a state machine and the linked article is on how to model them. It has nothing at all to do with port knocking.

Having not heard of this Analysis Design Matrix thing before, it was not clear to me what the linked article was going on about. From the home page, I read that "Matrix is a fundamentally new conceptual framework for thinking about Software Engineering and Model Compiler development", though at first sight, it looks very 1990s / CASE - like. It is perhaps unfortunate that the introduction page contains a 45-line "hello world" program, as this presumably does not show its intended purpose.

What you're reading here is the second example model based on Martin Fowler's original model. It's one of a series of demo models that shows off the Matrix modeling language.

A theme of the site is to push the idea generating code from models by using Model Compilers to continuously improve and optimise future Model Compilers as shown graphically in the Analysis Design Matrix Diagram.

Maybe I am missing something, but wouldn't this be vulnerable to a man in the middle attack?

not if the sequence changes based on some predetermined pattern

Hmmmm. I don't know if I buy that. If the pattern is not cryptographically secure, then you're still vulnerable to man in the middle, and if it is cryptographically secure, wouldn't you get roughly the same security by just doing standard SSH key based auth?

Isn't the point to have some defense in depth, so if there is a zero-day exploit found for your SSH authentication, you are not wide open? In a way like the grooves on a key for a pin-tumbler lock.

That would cover a replay attack, but not a man in the middle attack (as the mitm would just intercept the new port knock pattern.)

Only in the case of naive port knocking. You can always generate the knocking sequence with something like TOTP to avoid replay attacks, while also detecting attempts at replaying a previous knock.

Edit: Sorry I misread your comment as talking about replay attacks, not MITM'ing. I'm not an expert, but I believe MITM attacks are typically mitigated by performing the knock out of band over a covert channel (DNS, etc). AFAIK, there isn't really a way to prevent them entirely.

Yes, relying on port-knocking as your only authentication layer is not recommended; it's useful as a "front gate" to some other system.

The main point is that it's far better to model a system by thinking about the things which already exist in that system than it is to fit all the functionality into a single state machine implementation.

People are discussing this in a security context, but that's not what its about. This article is about modelling and analysis and the 'gothic hotel' model is just an interesting imaginary situation to try and analyse. And its a very useful example because its a state machine.

Reply on news.ycombinator.com