24 ms·

The forest, dude, the forest. Think about the masses behind home NAT routers and P2P. From my comments on reddit http://www.reddit.com/r/programming/comments/b

by alecco 17y ago

The forest, dude, the forest. Think about the masses behind home NAT routers and P2P. From my comments on reddit http://www.reddit.com/r/programming/comments/bjc0g/pwnat_serverless_nat_to_nat_udp_hole_punching_for/c0n2kpp?context=3 http://www.reddit.com/r/programming/comments/bjc0g/pwnat_ser... Server publishes it's NAT external IP and a hash of its (RSA) public key. [ICMP] Client MAC(client public key + server public key hash) -> Server (Server checks the key hash the client got is valid) [UDP] Server MAC(server public key + hash of client public key) -> Client (Client checks the public key hash matches the server's public key) ... The publishing first step could be just an URI like: pwnat://<server external ip>/pubkey_hash:<pub key hash> The hash could be base64 encoded in just 24 chars. Of course this is thinking out loud. There are protocols for this already. Thats of course drafty and not really checked, but you can get the idea and improve on it. It looks very doable. Also think about P2P and privacy, so far the middle men (e.g. Skype) would know who is talking to who. This is a major step. And there's plenty of space on the spoofed ICMP reply to put anything relevant to start a conversation (randomized ports, hashes, keys, nonce).

tptacek 17y ago
You're right. It's a big deal. It's just not a big deal for corporate networks.
- alecco 17y ago
  Yeah, it's not for corporate networks. But, for example, corporate network (and security) could benefit from this, too. Virtual P2P meetings could be done this way without a third party central server or the need to install a special server software. The meeting initiator can send an email with an URI and everyone else just clicks on it running the relevant client software. Much better security-wise than most scenarios nowadays. Cross-continent meetings are a major pain when it's over VPN or centralized.
  - latitude 17y ago
    > Much better security-wise than most scenarios nowadays. Can you elaborate on this?
    - alecco 17y ago
      Note I'm kind of thinking out loud, and in this idea was about P2P conferencing, so it's not for local network or well connected offices. More like a very typical scenario of several people connecting from different locations (e.g. working from home plus remote offices.) Using a VPN (centralized) adds a lot of latency and degrades the experience. Using a third party service (MS, WebEx, Lotus) often adds trusting them with your dearest corporate secrets and allows them (and the authorities on their respective countries) to spy on the conference or even simply detect your users's IPs to direct attacks to their more vulnerable home computers full of interesting data. With some service set up like this the users can just have an "initiator" "server", who's software just checks its NAT external IP (thousands of existing free services and web pages give you this) and creates a meeting URI. They send it by some secure channel (e.g. email over vpn) to the other parties. The rest conenct to the initiator "server" and discover each other's IP. If the protocol is carefully designed the clients and server can have a shared secret on the URI to avoid Man-in-the-middle. Voilà! This can easily be an open source product with zero server costs (unlike WebEx, Skype, MS.) Of course, this works only for clients with NAT access and others should connect in other ways (e.g. HTTPS and/or UPnP.) My point was that even the corporate network and security teams can benefit from this in some way. It's not just to set up quake servers on college networks.
  - gcb 17y ago
    basically you are trying to hack a solution for one thing that can be solved with your wallet. And i dont mean to pay for the most expensive option becausw that's what you isp wants. I'm talking about hiring a smaller isp that does not goes extra lengths to block your connections

by alecco 17y ago

tptacek 17y ago

You're right. It's a big deal. It's just not a big deal for corporate networks.

alecco 17y ago
Yeah, it's not for corporate networks. But, for example, corporate network (and security) could benefit from this, too. Virtual P2P meetings could be done this way without a third party central server or the need to install a special server software. The meeting initiator can send an email with an URI and everyone else just clicks on it running the relevant client software. Much better security-wise than most scenarios nowadays. Cross-continent meetings are a major pain when it's over VPN or centralized.
- latitude 17y ago
  > Much better security-wise than most scenarios nowadays. Can you elaborate on this?
  - alecco 17y ago
    Note I'm kind of thinking out loud, and in this idea was about P2P conferencing, so it's not for local network or well connected offices. More like a very typical scenario of several people connecting from different locations (e.g. working from home plus remote offices.) Using a VPN (centralized) adds a lot of latency and degrades the experience. Using a third party service (MS, WebEx, Lotus) often adds trusting them with your dearest corporate secrets and allows them (and the authorities on their respective countries) to spy on the conference or even simply detect your users's IPs to direct attacks to their more vulnerable home computers full of interesting data. With some service set up like this the users can just have an "initiator" "server", who's software just checks its NAT external IP (thousands of existing free services and web pages give you this) and creates a meeting URI. They send it by some secure channel (e.g. email over vpn) to the other parties. The rest conenct to the initiator "server" and discover each other's IP. If the protocol is carefully designed the clients and server can have a shared secret on the URI to avoid Man-in-the-middle. Voilà! This can easily be an open source product with zero server costs (unlike WebEx, Skype, MS.) Of course, this works only for clients with NAT access and others should connect in other ways (e.g. HTTPS and/or UPnP.) My point was that even the corporate network and security teams can benefit from this in some way. It's not just to set up quake servers on college networks.
- gcb 17y ago
  basically you are trying to hack a solution for one thing that can be solved with your wallet. And i dont mean to pay for the most expensive option becausw that's what you isp wants. I'm talking about hiring a smaller isp that does not goes extra lengths to block your connections