8 ms·

Here's the problem: other companies ruined it for the good ISPs. They destroyed their trust by screwing with end user transfers, tampering with TLS, tampering w

by dylz 8y ago

Here's the problem: other companies ruined it for the good ISPs. They destroyed their trust by screwing with end user transfers, tampering with TLS, tampering with connections, modifying resources in transit, MITMing in horrific fashion, invading privacy, and breaking protocols for profit. Arguably there would be a lot less insane push to make everything a blackbox if companies didn't keep doing dumb crap for an extra buck. See also the TLSv1.3 middlebox arguments. I certainly enjoy the fact that when using an AT&T hotspot I can't reach certain websites over TLS, with Verizon they would append advertising tracking headers to requests on their end, on Sprint if I wget the same image multiple times it'll be in a different quality and not match md5-wise each time, all of the above do DPI and negatively degrade web traffic no matter what port it runs on, TCP connections fail if I try to run non-web traffic over port 80 randomly, TCP connections are randomly killed if long lived.

CobrastanJorji 8y ago
Exactly. Would the Internet be way easier to design and use if we could assume that everybody is a good actor? Heck yeah! It'd be great. There are some really useful things you can do when you're allowed to intercept the conversations between two people. Caching, debugging, fixing spelling errors, etc. But we can't assume that the folks between me and you are good, and sharing anything at all with them is a bad idea. Does that mean a whole bunch of really useful techniques are harder or straight up impossible now? Yes, absolutely, and we should plan ahead and make sure to come up with ways to debug issues like this. But stepping back on security and privacy because it makes it harder to benevolently spy? Screw that noise.
caf 8y ago
Here's the problem: other companies ruined it for the good ISPs. There's a phrase for that situation: "Poisoning the Well".
- TeMPOraL 8y ago
  How's it called when some companies are run by good humans, and other by evil reptilians, and the reptilians poison the well with something they can drink, but humans can't?
  - felipemnoa 8y ago
    terraforming
xyzzy123 8y ago
The problem I have with TLS 1.3 proposal is it’s gonna stop me having control over the things that go out of my own network :( Realise that this is a multifaceted debate but it’s going to destroy the utility of anything I can’t install a certificate on, and also force me to install certs on everything I own before I can comfortably let those things on the network. It’s gonna screw a lot of enterprise use cases as well. I’m not sure people fully get that the privacy extended to say “dissidents in Syria” is also going to apply to HP printers on their own networks trying to figure out whether to show “toner low” dialogs. Personally I don’t think the “hey the dissidents” value is worth it since those people are pretty screwed anyway - filtering at scale can still work out what you’re connecting to (ips, latency, response size patterns, blah blah) but it really messes up anyone (person or enterprise) who wants to use stuff but also know what’s going on.
- pilif 8y ago
  >also force me to install certs on everything I own before I can comfortably let those things on the network I'm curious: How is TLS 1.3 different from TLS 1.2 in that regard? How would you implement an intercepting proxy with TLS 1.2 and without installing a CA cert in the clients?
  - ameshkov 8y ago
    I guess the encrypted SNI draft is what's meant here.
    - xyzzy123 8y ago
      Thanks, sorry, you are totally right and I should be more specific. Yes. It’s a metadata leak and generally I am pro the end-to-end principle but encrypted SNI actually forces everyone to MITM. Whether that is good or bad is a value judgement but for people who have been doing “light touch” egress filtering it is a huge PITA. It is actually going to force more invasive surveillance in basically any regulated workplace.
      - 8y ago
dstroot 8y ago
> for the good ISPs... and those are? Do they actually exist?
- dylz 8y ago
  Some do. Monkeybrains in SFBA and AAISP, Bogons in UK are a few possible examples?

by dylz 8y ago

CobrastanJorji 8y ago

Exactly. Would the Internet be way easier to design and use if we could assume that everybody is a good actor? Heck yeah! It'd be great. There are some really useful things you can do when you're allowed to intercept the conversations between two people. Caching, debugging, fixing spelling errors, etc. But we can't assume that the folks between me and you are good, and sharing anything at all with them is a bad idea. Does that mean a whole bunch of really useful techniques are harder or straight up impossible now? Yes, absolutely, and we should plan ahead and make sure to come up with ways to debug issues like this. But stepping back on security and privacy because it makes it harder to benevolently spy? Screw that noise.

caf 8y ago

Here's the problem: other companies ruined it for the good ISPs. There's a phrase for that situation: "Poisoning the Well".

TeMPOraL 8y ago
How's it called when some companies are run by good humans, and other by evil reptilians, and the reptilians poison the well with something they can drink, but humans can't?
- felipemnoa 8y ago
  terraforming

xyzzy123 8y ago

The problem I have with TLS 1.3 proposal is it’s gonna stop me having control over the things that go out of my own network :( Realise that this is a multifaceted debate but it’s going to destroy the utility of anything I can’t install a certificate on, and also force me to install certs on everything I own before I can comfortably let those things on the network. It’s gonna screw a lot of enterprise use cases as well. I’m not sure people fully get that the privacy extended to say “dissidents in Syria” is also going to apply to HP printers on their own networks trying to figure out whether to show “toner low” dialogs. Personally I don’t think the “hey the dissidents” value is worth it since those people are pretty screwed anyway - filtering at scale can still work out what you’re connecting to (ips, latency, response size patterns, blah blah) but it really messes up anyone (person or enterprise) who wants to use stuff but also know what’s going on.

pilif 8y ago
>also force me to install certs on everything I own before I can comfortably let those things on the network I'm curious: How is TLS 1.3 different from TLS 1.2 in that regard? How would you implement an intercepting proxy with TLS 1.2 and without installing a CA cert in the clients?
- ameshkov 8y ago
  I guess the encrypted SNI draft is what's meant here.
  - xyzzy123 8y ago
    Thanks, sorry, you are totally right and I should be more specific. Yes. It’s a metadata leak and generally I am pro the end-to-end principle but encrypted SNI actually forces everyone to MITM. Whether that is good or bad is a value judgement but for people who have been doing “light touch” egress filtering it is a huge PITA. It is actually going to force more invasive surveillance in basically any regulated workplace.
    - 8y ago

dstroot 8y ago

> for the good ISPs... and those are? Do they actually exist?

dylz 8y ago
Some do. Monkeybrains in SFBA and AAISP, Bogons in UK are a few possible examples?