13 ms·
The secret message hidden in every HTTP/2 connection
- awjr 11y agoI can see pretty much why FUBAR was switched to -----. I'm more curious as to what ----- stands for. [Edit removed the secret message to keep the suspense ;)]
- mrb 11y ago"PRISM" is obviously a reference to the surveillance program. HTTP/2.0 developers were well aware and worried about it. For example see this mail from PHK on the httpbis mailing list: http://www.ietf.org/mail-archive/web/httpbisa/current/msg14288.html http://www.ietf.org/mail-archive/web/httpbisa/current/msg142...
- noselasd 11y agoThe HTTP/2 spec is done on https://github.com/http2/http2-spec https://github.com/http2/http2-spec, this particular change seem to be quietly introduced here: commit ac468f3fab9f7092a430eedfd69ee1fb2e23c944 Author: Martin Thomson <martin.thomson@gmail.com> Date: Fri Jun 14 13:14:02 2013 -0700 Exercising editorial discretion regarding magic. diff --git a/draft-ietf-httpbis-http2.xml b/draft-ietf-httpbis-http2.xml index 58bbc27..f1e570d 100644 --- a/draft-ietf-httpbis-http2.xml +++ b/draft-ietf-httpbis-http2.xml @@ -385,9 +385,9 @@ Upgrade: HTTP/2.0 The client connection header is a sequence of 24 octets (in hex notation) </t> <figure><artwork type="inline"> -535441202a20485454502f322e300d0a0d0a52540d0a0d0a</artwork></figure> +505249202a20485454502f322e300d0a0d0a534d0d0a0d0a</artwork></figure> <t> - (the string <spanx style="verb">STA * HTTP/2.0\r\n\r\nRT\r\n\r\n</spanx>) followed by a + (the string <spanx style="verb">PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n</spanx>) followed by a <xref target="SETTINGS">SETTINGS frame</xref>. The client sends the client connection header immediately upon receipt of a 101 Switching Protocols response (indicating a successful upgrade), or after receiving a TLS Finished message from the server. If starting an
- mkjaer 11y agoThe commit on GitHub, for anyone interested: https://github.com/http2/http2-spec/commit/ac468f3fab9f7092a430eedfd69ee1fb2e23c944 https://github.com/http2/http2-spec/commit/ac468f3fab9f7092a...
- djsumdog 11y agoYea, looks like an inside joke / silent protest.
- fpp 11y agoThe date (14-Jun-2013) would fit. "... The disclosures were published by The Guardian and The Washington Post on June 6, 2013. Subsequent documents have demonstrated a financial arrangement between ... " [https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%29 https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...]
- aquassaut 11y agoNot too important but the article misses the FOO-BAR to FOO-BA to STA-RT transition, and the related issue (https://github.com/http2/http2-spec/issues/101 https://github.com/http2/http2-spec/issues/101)
- jacquesm 11y agoIn the communist days the writers of letters (in sealed envelopes) would routinely greet the censor or wish them merry Christmas and stuff like that.
- schoen 11y agoI wrote someone in prison a letter and included a greeting to the prison warden. It's very tempting somehow.
- digi_owl 11y agoYou also had that with military radio coms during the cold war, both sides would include messages to the other in their "internal" communications.
- jacquesm 11y agoThat's interesting, it's a pity none of those will likely ever see the light of day. And that in turn reminds me of this: http://www.wjpbr.com/wwixmas.html http://www.wjpbr.com/wwixmas.html Pity they didn't just pack up and go home after that.
- sevensor 11y ago> Pity they didn't just pack up and go home after that. Indeed. The public radio station in my town (in the U.S.) airs a special on the Christmas Truce every year around Christmastime. It's supposed to be uplifting, but I find it almost unbearably sad. The Europe out of which that spirit came was demolished during the war.
- digi_owl 11y agoI suspect those messages were never official, but more the local operators making the best of being posted during holidays. Thus they were likely never recorded anywhere.
- gvb 11y agoFeynman's version of messing with the censors: https://books.google.com/books?id=7papZR4oVssC&pg=PA114#v=onepage&q&f=false https://books.google.com/books?id=7papZR4oVssC&pg=PA114#v=on...
- mulle_nat 11y agohttps://en.wikipedia.org/wiki/Known-plaintext_attack https://en.wikipedia.org/wiki/Known-plaintext_attack
- hodwik 11y agoCare to explain the relevance?
- stickac 11y agoWhen you have an encrypted file (or a stream for that matter) and you know the first N bytes of the decrypted data, it might be easier to compute the encryption key if algorithm uses blocks smaller than N.
- pilsetnieks 11y agoThe relevance is that this text could ostensibly be used as the known plaintext to aid in breaking encryption, however, it's not going help much anyway. For example, with HTTP 1.1, it is pretty much likely that an HTTP response would start with HTTP/1.1 200 OK, or that it would contain strings such as "Content-Type" or "Content-Length". 24 more known bytes won't make it much worse.
- admax88q 11y agoAny strong cipher should be resistant to a known plaintext attack. If your encryption is vulnerable to known plaintext you should upgrade.
- deleted 11y ago[deleted]
- deleted 11y ago[deleted]
- tptacek 11y agoThat's extraordinarily silly, because HTTP is already loaded up with much more useful runs of known plaintext.
- kcorbitt 11y agoThe author isn't implying that the NSA intentionally injected the word "PRISM" into the header of every HTTP/2 connection. Rather, that the members of the IETF that collaborated on the standard chose to change the existing dummy text to match those initials once the existence of the program was leaked to the public, presumably as a sort of inside joke/protest. ^ I figure I'd clarify that in case anyone else gets as confused as I did about what possible political or technical objectives the NSA might achieve by including a reference to a top-secret spy program in every HTTP/2 message (although it does seem like the sort of thing a comic-book evil intelligence organization would do :P).
- platz 11y agoIt seems like the thing an immature boy would do, but hey it just HTTP/2 protocol, no harm done!
- antimagic 11y agoI downvoted you, but I thought I'd explain why - I don't think it's reasonable to characterise this as childish. Government surveillance is something which our industry is the best positioned to speak out against. This type of thing seems to be clearly political speech, and not a prank.
- eevilspock 11y agoApparently Feynman is pretty "childish" too: https://news.ycombinator.com/item?id=10650175 https://news.ycombinator.com/item?id=10650175
- smrq 11y agoI don't think Feynman would have disagreed with that.
- Lawtonfogle 11y agoIt also is something that really hurts our industry, perhaps more so than any other industry out there. Edit: To be clear, I mean the spying hurts our industry.
- wiredfool 11y agoNext up: a FOIA request for documents relating to the NSA's MOZILLA program in the mid 1990s.
- zwischenzug 11y agoI blogged on the usefulness of reading RFCs more only the other day: https://zwischenzugs.wordpress.com/2015/11/26/the-it-crowd-was-right-what-i-learned-by-reading-a-lot-of-rfcs/ https://zwischenzugs.wordpress.com/2015/11/26/the-it-crowd-w... Personally, I trust the elders of the internet implicitly.
- pdkl95 11y agoFor wisdom from the "elders", I recommend reading RFC 1925. https://news.ycombinator.com/item?id=9045533 https://news.ycombinator.com/item?id=9045533 (footnote [2])
- platz 11y agohere's the github profile of the guy who made the commit to change the text. https://github.com/martinthomson https://github.com/martinthomson. nice avatar.
- simoncion 11y ago...okay. If you're attempting to slyly suggest something, everyone would be much better off if you'd just come out and say it. Please don't waste people's time with innuendo.
- striking 11y agoAnd why are you commenting on someone's avatar? Would you appreciate it if someone judged yours?
- anon4 11y agoThat's so unprofessional, my bow-tie came off! He should be hanged! You do still have hangings in the colonies, right? Nothing gets the rabble in line like a good hanging, I always say. Oh, I'm late for my croquet game. Toodles.
- mnot 11y agoHeh. Ironically, the HTTP WG (including Martin) went through a period where many of us wore bow ties, etc. to meetings. Trying to raise the sartorial standards of the IETF (under the guidance of the ever-well-turned-out Hasan).
- nmc 11y agoNice avatar indeed. Are you suggesting this is an immature boy's avatar? This guy is actually a Principal Engineer at Mozilla, working on WebRTC.
- cuckcuckspruce 11y agoWee woo wee woo wee woo, let's call the tone police! I thought hackers were for meritocracy, and not nitpicking silly things like avatars.
- deleted 11y ago[deleted]
- gregory144 11y agoI named my hobby HTTP2 server after that string in the connection header: https://github.com/gregory144/prism-web-server https://github.com/gregory144/prism-web-server (obviously haven't had much time to work on it lately).
- mrdrozdov 11y agoThe real gold is Ilya Grigorik's comment on the commit. https://github.com/http2/http2-spec/commit/ac468f3fab9f7092a430eedfd69ee1fb2e23c944#commitcomment-3430120 https://github.com/http2/http2-spec/commit/ac468f3fab9f7092a...
- delibes 11y agoI had the pleasure of briefly working with Martin at LMAX. He definitely knows how to get performance out of a system, and although it's not been updated recently I'd recommend his old blog for those that haven't seen it yet and are interested in where the nanoseconds go : http://mechanical-sympathy.blogspot.co.uk/ http://mechanical-sympathy.blogspot.co.uk/
- wsargent 11y agoYou're thinking of mjpt777.
- georgedrummond 11y agoThis change was committed on Jun 14th 2013, about a week after the PRISM programme had been leaked by Edward Snowden. It is a clear reference to the programme but by this point it was already public knowledge. I don't know the exact date that Snowden leaked PRISM but it was already being talked about as early as June 6th 2013 in the Washington Post http://www.washingtonpost.com/wp-srv/special/politics/prism-collection-documents/ http://www.washingtonpost.com/wp-srv/special/politics/prism-...
- swayvil 11y agoIt's a Pink Floyd reference, obviously.
- icanhackit 11y agoCareful with that deep packet inspection, Eugene.
- JoshTriplett 11y agoLeaving the specific letters aside, I wonder about this comment in https://github.com/http2/http2-spec/issues/101 https://github.com/http2/http2-spec/issues/101: "And the experimental data we have (what there is of it) suggests that we need to make this look like an unknown HTTP/1.1 method (or two)." Anyone know what experimental data this refers to, and why this helps? This gets encapsulated inside TLS; nothing should know about it except the endpoints, both of which need to understand HTTP/2.
- cesarb 11y agoHTTP/2 is not TLS-only, even though major browsers will only use it over TLS. And even when over TLS, the TLS connection might terminate in a separate machine, it going cleartext the rest of the way.
- JoshTriplett 11y ago> HTTP/2 is not TLS-only, even though major browsers will only use it over TLS. Which in practice will (hopefully) make it TLS-only. As I recall, one of the original motivations to require TLS, and one of the reasons browsers plan to mandate TLS (apart from the obvious), was specifically to avoid broken "transparent" proxies. > And even when over TLS, the TLS connection might terminate in a separate machine, it going cleartext the rest of the way. If the server uses a TLS frontend device and passes cleartext to a backend, then apart from that being a really bad idea from a security perspective, they should know better than to allow that to pass through a broken transparent proxy.
- mnot 11y agoSee: https://lists.w3.org/Archives/Public/ietf-http-wg/2013JanMar/0910.html https://lists.w3.org/Archives/Public/ietf-http-wg/2013JanMar...
- sandworm101 11y agoA funny joke, but a telling statement. Words so commonly used reflect attitudes and history. For instance most of the English-speaking world says Goobye ("God be with you") while the French use the more neutral AuRevoir (until we see again). Web browsers now greet websites with "PRISM", the equivalent of "the walls have ears".
- spb 11y agoGreat, so now all HTTP/2 traffic forever is going to start with a reference to an NSA program that was topical for about a week in 2013. Maybe we could have waited a year and made the magic THE * HTTP/2.0 DRESS Or if this change had been made a year earlier: KO * HTTP/2.0 NY
- bonestamp2 11y agoWhile both "the dress" and prism appeared in the news, lets not forget some news is actually newsworthy and some is forgettable mind candy. Prism needs to be remembered and including it in the protocol message ensures it will be discussed for much longer than the dress -- as it should be.
- thwarted 11y agoThis is a pretty good way to remind ourselves ("Never Forget") why some things are the way they are. It stands out and is perhaps unexpected, giving a chance to have a discussion around the things we want to avoid or combat. That it shows up in the protocol gives relevance to a FAQ entry on the topic, vs just being a by-the-way FAQ entry that is easier to ignore. It could just as well have been ECHELON [0], however PRISM has more recent, and documented, meaning and more mindshare specifically around/related to domestic spying. [0] https://en.wikipedia.org/wiki/ECHELON https://en.wikipedia.org/wiki/ECHELON
- brbsix 11y agoLooking over https://www.ietf.org/mail-archive/web/httpbisa/current/msg14288.html https://www.ietf.org/mail-archive/web/httpbisa/current/msg14..., I'm not sure whether I'm reading this correctly. In light of PRISM, the author posed a few options: 1) We can try to add more encryption to fight back. 2) We can recognize that there needs to be hooks for duly authorized access. 3) We can change or at least influence the political objectives Personally, I'd have assumed option one is the obvious answer, in addition to increasing adoption of encryption in other areas (though that may be outside the scope of their project). Unfortunately the author seems to conclude that there need to be (presumable CALEA-style) hooks for "duly authorized access". This is almost unbelievable that they are openly suggesting implementing backdoors in communications protocols. I expect this from LE and politicians, but I don't expect this from FreeBSD commiters.
- victorbojica 11y agohttp://gizmodo.com/what-is-prism-511875267 http://gizmodo.com/what-is-prism-511875267 Maybe this ?