7 ms·

One wonders if a CDN might advertise, "we promise once your data enters our network at our edge locations outside of the US, it does not traverse any AT&T netwo

One wonders if a CDN might advertise, "we promise once your data enters our network at our edge locations outside of the US, it does not traverse any AT&T networks while reaching your server inside the US". Same with cloud companies' private networks across regions.

dbcurtis 8y ago
Given how peering is implemented among backbone providers, I don't think that is technically possible today.
- kodablah 8y ago
  If peering had more participants, companies could choose their peering agreements for server-to-server data (i.e. non-residential, not-public-internet) on private pipes only with companies who make the similar no-AT&T promise downstream. One way or another, the principled economic squeeze needs to be there instead of waiting on public policy.
ancarda 8y ago
Couldn't the NSA start working with other ISPs than AT&T? I'd really like to see CDNs like CloudFlare start requiring Cloud <--> Origin encryption; e.g. what CloudFlare calls "Full SSL" -- https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-SSL-options-mean- https://support.cloudflare.com/hc/en-us/articles/200170416-W.... Right now, you can do TLS termination ("Flexible SSL"), which end-users aren't aware of -- they see a padlock -- and I'm sure the NSA doesn't mind.
- kodablah 8y ago
  Sure they could, but one might hope the AT&T's eroded trust would serve as caution towards other overly cooperative companies. Or encourage companies to fight in court to be given the transparency allowances they desire to let the rest of us know they are legally compelled to do this and in no way do they agree or are doing anything beyond what's required. Granted, like FB issues and others, we in this community need to realize that most users simply don't care (even many b2b ones) and not get upset when our users don't move their dollars on principle. For us it's a big deal, for many there are real, harmful issues going on in the world and volume collection of data by companies and governments is not one of them. And we can't make it so despite the deluge of articles by a supportive mass media. EDIT: To clarify, you mentioned "other ISPs" but I want to be clear I'm talking about private pipes and not residential internet though I know they are often shared.
  - enos 8y ago
    AT&T's cooperation with NSA has been public since 2004. It doesn't seem to have much of an effect on them.
- hammock 8y ago
  >Couldn't the NSA start working with other ISPs than AT&T? They do. They work with all of them. http://www.businessinsider.com/the-story-of-joseph-nacchio-and-the-nsa-2013-6 http://www.businessinsider.com/the-story-of-joseph-nacchio-a... AT&T just happens to have the oldest relationships and the largest infrastructure.
  - deleted 8y ago
    [deleted]
- syshum 8y ago
  >Right now, you can do TLS termination ("Flexible SSL") Which sane people call Man in the Middle and should not be allowed at all. I have seen people doing this Flexiable SSL with Credit Card data and other PII believing it is "secure" Cloudflare may have started out with security in mind but their new services centered around centralization of key services (dns) and this kind of security breaking product means IMO they are a net negative in the world of Information Security
  - jstarfish 8y ago
    It has its uses though, even if it's misused. It's an easy box to check to pretend to offer HTTPS so you don't get penalized by Google. Before Let's Encrypt there was no free way to get a legit cert for your cat blog. Faking it via Flexible SSL was the next best thing.
    - syshum 8y ago
      This is false, there have always been ways to get a free DV cert, lets encrypt made it easier Furhter before Lets Encrypt you would not have gotten dinged by google, Google only went that path when wide spread DV Certs where freely avaliable Further still, the minor costs per year to get a paid DV cert should be factor when choosing to host your own content versus paying a 3rd party to do it, many of those 3rd parties provided SSL as part of their services. There is zero need for a Man in the Middle for SSL,
  - AgentME 8y ago
    Even Cloudflare's "Full SSL" mode is a man in the middle: Cloudflare is the man in the middle who sees the plaintext of connections going through them.
subway 8y ago
Trouble is, internet exchanges are often flat insecure layer 2 networks that operate on trust. Anyone on that network can suddenly decide to advertise anyone else's address space, and start receiving traffic.
- walrus01 8y ago
  Shitty IXes, maybe. At a proper one a single IP address belonging to the exchange, which will be assigned to the router port of one member, is only allowed to appear from a specific single MAC address, and specific port on the ix switch, which corresponds with a physical fiber cross connect that matches a specific patch panel port.
coldtea 8y ago
>One wonders if a CDN might advertise, Yes, but they could also be lying about it.
- judge2020 8y ago
  Wouldn't it be easy to traceroute between the CDN and your server, or the CDN and your house to see if it hits servers that WHOIS to at&t?
  - jlgaddis 8y ago
    From a network engineering perspective, it's pretty easy not to decrement the TTL (keeping devices from "appearing" in a traceroute). Hell, this is pretty much the norm where MPLS is concerned. Your packet may hop through a dozen routers along its way without showing up in a traceroute -- you just see it go in one side (then it goes through a dozen routers) and you see it come out the other side.
  - coldtea 8y ago
    >Wouldn't it be easy to traceroute between the CDN and your server, or the CDN and your house to see if it hits servers that WHOIS to at&t? Wouldn't be trivial for any other telco (whether foreign or domestic) than at&t to tap the data and lie about it too? And it doesn't have to show up in the traceroute (they could mirror the traffic, etc)
lev99 8y ago
If your communication is encrypted it shouldn't matter if it passes AT&T networks. Either A. Popular and well known encryption algorithms are not broken by the NSA, and your communication is private. B. Popular and well known encryption algorithms are broken by the NSA, but the fact that it's broken is top secret and the state will not do any actions that revel the secret. Your communications are not safe, and while what you communicate might make you the target of an investigation (if you're an appealing enough target), the communications will not be directly used against you in court. EDIT: There is a third option, that your communication is being stored until the encryption algorithm is broken or computation reaches a point where brute force is possible (quantum computers). Long term storage of encrypted communication is only economically feasible for a small subset of all encrypted communication, so it's only a concern for targeted individuals where the communication will be relevant to the state decades from now.
- 394549 8y ago
  > If your communication is encrypted it shouldn't matter if it passes AT&T networks. IIRC, the signals intelligence agencies like the NSA learn almost as much from traffic analysis (e.g. who's talking to who and when) and metadata than from actual message content. Mere encryption itself often doesn't protect much from that.
  - imglorp 8y ago
    I'd argue that metadata is more important than content. It enables suspicion-by-association lines of inquiry. Once you know whos' involved in a conversation, it's much easier to target them for closer attention, such as hacking their machine or rubber-hose cryptography, both of which nullify any crypto you might have used.
    - JumpCrisscross 8y ago
      > I'd argue that metadata is more important than content Isn't metadata, practically speaking, a subset of content? (If you have the latter, you almost certainly also have the former?) Metadata is more useful than content if you're capacity constrained, technologically or legally, in collection and/or analysis.
saas_co_de 8y ago
Every country in the world does this. The German's at least are open and honest about it. "It said the BND, a partner of the US National Security Agency (NSA), has placed so-called Y-piece prisms into its data-carrying fibre optic cables that give it an unfiltered and complete copy of the data flow." https://www.thelocal.de/20180531/german-spies-can-keep-monitoring-internet-hubs-court-rules https://www.thelocal.de/20180531/german-spies-can-keep-monit...
thrillgore 8y ago
OVH already markets its data centers as operating "outside of any reach of US infrastructure."
notadoc 8y ago
I would be surprised if it was not every network, in every country, so trying to avoid a single network is unlikely to do much.
chrissnell 8y ago
I'd rather go up against the US Government over illegal monitoring, where at least you have some form of due process, than many other countries.
IncRnd 8y ago
Unfortunately, traffic patterns are not straightforward, which can be seen by performing a traceroute to an arbitrary destination. How would a cdn enforce such traversal restrictions, when att is much of the internet?

dbcurtis 8y ago

Given how peering is implemented among backbone providers, I don't think that is technically possible today.

kodablah 8y ago
If peering had more participants, companies could choose their peering agreements for server-to-server data (i.e. non-residential, not-public-internet) on private pipes only with companies who make the similar no-AT&T promise downstream. One way or another, the principled economic squeeze needs to be there instead of waiting on public policy.

ancarda 8y ago

Couldn't the NSA start working with other ISPs than AT&T? I'd really like to see CDNs like CloudFlare start requiring Cloud <--> Origin encryption; e.g. what CloudFlare calls "Full SSL" -- https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-SSL-options-mean- https://support.cloudflare.com/hc/en-us/articles/200170416-W.... Right now, you can do TLS termination ("Flexible SSL"), which end-users aren't aware of -- they see a padlock -- and I'm sure the NSA doesn't mind.

kodablah 8y ago
Sure they could, but one might hope the AT&T's eroded trust would serve as caution towards other overly cooperative companies. Or encourage companies to fight in court to be given the transparency allowances they desire to let the rest of us know they are legally compelled to do this and in no way do they agree or are doing anything beyond what's required. Granted, like FB issues and others, we in this community need to realize that most users simply don't care (even many b2b ones) and not get upset when our users don't move their dollars on principle. For us it's a big deal, for many there are real, harmful issues going on in the world and volume collection of data by companies and governments is not one of them. And we can't make it so despite the deluge of articles by a supportive mass media. EDIT: To clarify, you mentioned "other ISPs" but I want to be clear I'm talking about private pipes and not residential internet though I know they are often shared.
- enos 8y ago
  AT&T's cooperation with NSA has been public since 2004. It doesn't seem to have much of an effect on them.
hammock 8y ago
>Couldn't the NSA start working with other ISPs than AT&T? They do. They work with all of them. http://www.businessinsider.com/the-story-of-joseph-nacchio-and-the-nsa-2013-6 http://www.businessinsider.com/the-story-of-joseph-nacchio-a... AT&T just happens to have the oldest relationships and the largest infrastructure.
- deleted 8y ago
  [deleted]
syshum 8y ago
>Right now, you can do TLS termination ("Flexible SSL") Which sane people call Man in the Middle and should not be allowed at all. I have seen people doing this Flexiable SSL with Credit Card data and other PII believing it is "secure" Cloudflare may have started out with security in mind but their new services centered around centralization of key services (dns) and this kind of security breaking product means IMO they are a net negative in the world of Information Security
- jstarfish 8y ago
  It has its uses though, even if it's misused. It's an easy box to check to pretend to offer HTTPS so you don't get penalized by Google. Before Let's Encrypt there was no free way to get a legit cert for your cat blog. Faking it via Flexible SSL was the next best thing.
  - syshum 8y ago
    This is false, there have always been ways to get a free DV cert, lets encrypt made it easier Furhter before Lets Encrypt you would not have gotten dinged by google, Google only went that path when wide spread DV Certs where freely avaliable Further still, the minor costs per year to get a paid DV cert should be factor when choosing to host your own content versus paying a 3rd party to do it, many of those 3rd parties provided SSL as part of their services. There is zero need for a Man in the Middle for SSL,
- AgentME 8y ago
  Even Cloudflare's "Full SSL" mode is a man in the middle: Cloudflare is the man in the middle who sees the plaintext of connections going through them.

subway 8y ago

Trouble is, internet exchanges are often flat insecure layer 2 networks that operate on trust. Anyone on that network can suddenly decide to advertise anyone else's address space, and start receiving traffic.

walrus01 8y ago
Shitty IXes, maybe. At a proper one a single IP address belonging to the exchange, which will be assigned to the router port of one member, is only allowed to appear from a specific single MAC address, and specific port on the ix switch, which corresponds with a physical fiber cross connect that matches a specific patch panel port.

coldtea 8y ago

>One wonders if a CDN might advertise, Yes, but they could also be lying about it.

judge2020 8y ago
Wouldn't it be easy to traceroute between the CDN and your server, or the CDN and your house to see if it hits servers that WHOIS to at&t?
- jlgaddis 8y ago
  From a network engineering perspective, it's pretty easy not to decrement the TTL (keeping devices from "appearing" in a traceroute). Hell, this is pretty much the norm where MPLS is concerned. Your packet may hop through a dozen routers along its way without showing up in a traceroute -- you just see it go in one side (then it goes through a dozen routers) and you see it come out the other side.
- coldtea 8y ago
  >Wouldn't it be easy to traceroute between the CDN and your server, or the CDN and your house to see if it hits servers that WHOIS to at&t? Wouldn't be trivial for any other telco (whether foreign or domestic) than at&t to tap the data and lie about it too? And it doesn't have to show up in the traceroute (they could mirror the traffic, etc)

lev99 8y ago

If your communication is encrypted it shouldn't matter if it passes AT&T networks. Either A. Popular and well known encryption algorithms are not broken by the NSA, and your communication is private. B. Popular and well known encryption algorithms are broken by the NSA, but the fact that it's broken is top secret and the state will not do any actions that revel the secret. Your communications are not safe, and while what you communicate might make you the target of an investigation (if you're an appealing enough target), the communications will not be directly used against you in court. EDIT: There is a third option, that your communication is being stored until the encryption algorithm is broken or computation reaches a point where brute force is possible (quantum computers). Long term storage of encrypted communication is only economically feasible for a small subset of all encrypted communication, so it's only a concern for targeted individuals where the communication will be relevant to the state decades from now.

394549 8y ago
> If your communication is encrypted it shouldn't matter if it passes AT&T networks. IIRC, the signals intelligence agencies like the NSA learn almost as much from traffic analysis (e.g. who's talking to who and when) and metadata than from actual message content. Mere encryption itself often doesn't protect much from that.
- imglorp 8y ago
  I'd argue that metadata is more important than content. It enables suspicion-by-association lines of inquiry. Once you know whos' involved in a conversation, it's much easier to target them for closer attention, such as hacking their machine or rubber-hose cryptography, both of which nullify any crypto you might have used.
  - JumpCrisscross 8y ago
    > I'd argue that metadata is more important than content Isn't metadata, practically speaking, a subset of content? (If you have the latter, you almost certainly also have the former?) Metadata is more useful than content if you're capacity constrained, technologically or legally, in collection and/or analysis.

saas_co_de 8y ago

Every country in the world does this. The German's at least are open and honest about it. "It said the BND, a partner of the US National Security Agency (NSA), has placed so-called Y-piece prisms into its data-carrying fibre optic cables that give it an unfiltered and complete copy of the data flow." https://www.thelocal.de/20180531/german-spies-can-keep-monitoring-internet-hubs-court-rules https://www.thelocal.de/20180531/german-spies-can-keep-monit...

thrillgore 8y ago

OVH already markets its data centers as operating "outside of any reach of US infrastructure."

notadoc 8y ago

I would be surprised if it was not every network, in every country, so trying to avoid a single network is unlikely to do much.

chrissnell 8y ago

I'd rather go up against the US Government over illegal monitoring, where at least you have some form of due process, than many other countries.

IncRnd 8y ago

Unfortunately, traffic patterns are not straightforward, which can be seen by performing a traceroute to an arbitrary destination. How would a cdn enforce such traversal restrictions, when att is much of the internet?