9 ms·

I'm continually amazed at how insecure almost every aspect of internet routing is - it mostly boils down to a sort of "gentlemen's agreement" that everybody wil

I'm continually amazed at how insecure almost every aspect of internet routing is - it mostly boils down to a sort of "gentlemen's agreement" that everybody will follow the rules.

toomuchtodo 8y ago
Internet routing (BGP), SMTP, and DNS (not inclusive, just off the top of my head) were developed during the very beginnings of the internet, without much thought into today's use and scale. Today you'd do better, with hindsight being 20/20.
- Mtinie 8y ago
  That's certainly true. But now that we have the benefit of hindsight, isn't the only reasonable option to start to take the steps to correct the obvious problems?
  - toomuchtodo 8y ago
    Yes, with a "but" the size of celestial bodies: it's a herculean effort. Witness how long IPv6 has taken to obtain traction (and the lack of any traction on DNSSEC, and the resulting DNS over HTTP shims). These are improvements that occur over years, if not decades and require substantial human and financial resources to deliver on.
    - Mtinie 8y ago
      No doubt. I didn't mean to trivialize the effort required to address the existing issues with scaling and securing the global Internet.
    - 0x8BADF00D 8y ago
      Why do you think IPv6 never took off? Do you think the format of addresses was less human readable, and therefore that’s what led to its slow adoption? What if the address was instead displayed as a mapping using a data format like JSON?
      - toomuchtodo 8y ago
        Networks found ways to reduce IPv4 usage, or support dual stack early on when necessary. Turns out every internet endpoint doesn't need to be directly addressable, and most Internet use cases are one to many (CDNs to eyeballs). https://www.nonog.net/wp-content/uploads/2017/06/Altibox-An-IPv6-Story-NONOG-2017-01-min.pdf https://www.nonog.net/wp-content/uploads/2017/06/Altibox-An-... https://www.networkworld.com/article/3254575/lan-wan/what-is-ipv6-and-why-aren-t-we-there-yet.html https://www.networkworld.com/article/3254575/lan-wan/what-is...
      - q3k 8y ago
        Because it takes effort and CAPEX to deploy it and most ISP are for-profit entities.
    - tptacek 8y ago
      The "DNS over HTTP shims" are not the result of DNSSEC taking too long to be adopted, but rather the fact that DNSSEC doesn't provide the protection that DoH does. People have a lot of weird ideas about what DNSSEC does; in particular: it doesn't encrypt queries.
  - topspin 8y ago
    One of the best steps is modern protocols. China - or whomever - can collect all the QUIC packets they want and it won't tell them much. The incentive for these games goes way down when all you get is some connection metadata and cryptographic line noise.
    - throwaway2048 8y ago
      Not if you control CAs. Cert pinning only works in a limited amount of cases, and certificate transparency only works with CAs who have agreed to implement them (Which is not the vast majority).
      - jopsen 8y ago
        CT will take time, I wouldn't be surprised if it catches on and becomes are requirement further down the line.. But sure, it won't happen overnight.. just saying gaps are closing :)
        tialaramex 8y ago
        Finishing the entire Certificate Transparency system will take time, but the elements that exist today already work fine. Install Google's Chrome browser. The browser checks for SCTs (the proof that the certificate was logged) and will reject new certificates that don't include such proof. It has been doing this since April. Try this URL: https://invalid-expected-sct.badssl.com/ https://invalid-expected-sct.badssl.com/ If you visit that in Chrome it gives you a full page interstitial warning it's bogus and if you click past the page is labelled "Not Secure". In other popular browsers it works fine, because it has a perfectly nice certificate but the Bad SSL site is deliberately not presenting the SCTs for it. [[ It's hard to do this by accident, most places that give lay folk a certificate will assume your goal is to have your certificate accepted, so they will log a "pre-certificate" for you and bake the SCTs inside the certificate they give you and you can't remove those ]] But yes, fully completing Certificate Transparency will be more work, we need a Gossip system so that monitors can consult each other to detect a split horizon, and mechanisms for clients to show summaries of what they know to determine if there are conflicts. What we have now is like if you have a house you've half-built, there is no roof over two rooms, and no electricity, and the floor is bare dirt. But, it's still a house, and in a rain storm it's better to be inside that unfinished house than out in the cold and wet. The people outside in the rain don't think "That guy's house doesn't have triple-glazed windows" they think "Lucky bastard isn't out in the rain like me".
- cwkoss 8y ago
  Do you know of any interesting alternative protocols proposed recently?
- thrower123 8y ago
  At this point I'm inclined to think you'd be more likely to get bogged down for decades bikeshedding behind proposals in a standards consortium that has no actual power to enforce them, and the results would be a horrific mishmash with terminal second-system syndrome...
cm2187 8y ago
A "gentlemen's agreement" that was designed to sustain a nuclear strike...
- DoctorOetker 8y ago
  I didn't know that, was this the motivation of the current design? is there a source to back this up?
  - toomuchtodo 8y ago
    https://www.wired.com/2012/09/what-do-the-h-bomb-and-the-internet-have-in-common-paul-baran/ https://www.wired.com/2012/09/what-do-the-h-bomb-and-the-int...
- TeMPOraL 8y ago
  The two aren't at odds. Packet routing was designed to survive sudden and severe loss of network paths, but it still assumes that participants on the network are cooperative players.
  - cm2187 8y ago
    In other words that they were confident there wouldn't be a russian evil maid anywhere on a US wide network.
    - TeMPOraL 8y ago
      You got me here. I have no clue if this scenario was considered, and how this affected the design process. It was the Cold War after all.
- throwaway2048 8y ago
  BGP was designed far after that era of ARPANET
StudentStuff 8y ago
Such is the nature of BGP. Something like SPF (eg: an authorized AS list for an IP block) and DMARC (reporting about who tried to broadcast what IP block and was rejected) would be great, perhaps even have the latter component convey attack info so ISPs could deal with infected clients automatically. Basic security mechanisms when it comes to large ISP networks are a pipe dream though, instead we get vendors pushing extremely vulnerable Juniper gear cause its reasonably priced, meanwhile these boxes have new root exploits found multiple times a year. None of the vendors give a crap about security, Cisco pays it some lip service (to win gov't contracts) but charges a premium for basic features.
- jopsen 8y ago
  I'm amazed telecoms let's this happen, routing massive amounts of traffic the wrong way, must cause a lot of latency, right?
  - felix_nagaand 8y ago
    Sure, but how many users care about 20ms to their local data farm versus 70 cross country and maybe 200 to China?
    - cronix 8y ago
      Right, they generally say "my phone is getting slow, time to upgrade"
jgrahamc 8y ago
And that agreement is trying to be enforced using PKI: https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki/
- maltalex 8y ago
  RPKI doesn't stop BGP hijacks. Sure, it's better than nothing but RPKI doesn't validate the entire path, only the origin. If you want path validation, you need BGPSec. But BGPSec is basically un-deployable in real-world networks.
  - Avamander 8y ago
    Why is BGPSec un-deployable?
e40 8y ago
I'd like to point out that government used to run by agreements that were like that, and look what has happened in that domain. I say this as a warning what the internet could become.
- dangerlibrary 8y ago
  Your analogy is confusing. I have no idea if you are talking about international, national, or local agreements. I also have no idea what your opinions are. Your comment simultaneously contains almost no information is super off topic.
magicbuzz 8y ago
And state actors are proving themselves to not be gentlemen at all.

I'm continually amazed at how insecure almost every aspect of internet routing is - it mostly boils down to a sort of "gentlemen's agreement" that everybody will follow the rules.

toomuchtodo 8y ago

Internet routing (BGP), SMTP, and DNS (not inclusive, just off the top of my head) were developed during the very beginnings of the internet, without much thought into today's use and scale. Today you'd do better, with hindsight being 20/20.

Mtinie 8y ago
That's certainly true. But now that we have the benefit of hindsight, isn't the only reasonable option to start to take the steps to correct the obvious problems?
- toomuchtodo 8y ago
  Yes, with a "but" the size of celestial bodies: it's a herculean effort. Witness how long IPv6 has taken to obtain traction (and the lack of any traction on DNSSEC, and the resulting DNS over HTTP shims). These are improvements that occur over years, if not decades and require substantial human and financial resources to deliver on.
  - Mtinie 8y ago
    No doubt. I didn't mean to trivialize the effort required to address the existing issues with scaling and securing the global Internet.
  - 0x8BADF00D 8y ago
    Why do you think IPv6 never took off? Do you think the format of addresses was less human readable, and therefore that’s what led to its slow adoption? What if the address was instead displayed as a mapping using a data format like JSON?
    - toomuchtodo 8y ago
      Networks found ways to reduce IPv4 usage, or support dual stack early on when necessary. Turns out every internet endpoint doesn't need to be directly addressable, and most Internet use cases are one to many (CDNs to eyeballs). https://www.nonog.net/wp-content/uploads/2017/06/Altibox-An-IPv6-Story-NONOG-2017-01-min.pdf https://www.nonog.net/wp-content/uploads/2017/06/Altibox-An-... https://www.networkworld.com/article/3254575/lan-wan/what-is-ipv6-and-why-aren-t-we-there-yet.html https://www.networkworld.com/article/3254575/lan-wan/what-is...
    - q3k 8y ago
      Because it takes effort and CAPEX to deploy it and most ISP are for-profit entities.
  - tptacek 8y ago
    The "DNS over HTTP shims" are not the result of DNSSEC taking too long to be adopted, but rather the fact that DNSSEC doesn't provide the protection that DoH does. People have a lot of weird ideas about what DNSSEC does; in particular: it doesn't encrypt queries.
- topspin 8y ago
  One of the best steps is modern protocols. China - or whomever - can collect all the QUIC packets they want and it won't tell them much. The incentive for these games goes way down when all you get is some connection metadata and cryptographic line noise.
  - throwaway2048 8y ago
    Not if you control CAs. Cert pinning only works in a limited amount of cases, and certificate transparency only works with CAs who have agreed to implement them (Which is not the vast majority).
    - jopsen 8y ago
      CT will take time, I wouldn't be surprised if it catches on and becomes are requirement further down the line.. But sure, it won't happen overnight.. just saying gaps are closing :)
      - tialaramex 8y ago
        Finishing the entire Certificate Transparency system will take time, but the elements that exist today already work fine. Install Google's Chrome browser. The browser checks for SCTs (the proof that the certificate was logged) and will reject new certificates that don't include such proof. It has been doing this since April. Try this URL: https://invalid-expected-sct.badssl.com/ https://invalid-expected-sct.badssl.com/ If you visit that in Chrome it gives you a full page interstitial warning it's bogus and if you click past the page is labelled "Not Secure". In other popular browsers it works fine, because it has a perfectly nice certificate but the Bad SSL site is deliberately not presenting the SCTs for it. [[ It's hard to do this by accident, most places that give lay folk a certificate will assume your goal is to have your certificate accepted, so they will log a "pre-certificate" for you and bake the SCTs inside the certificate they give you and you can't remove those ]] But yes, fully completing Certificate Transparency will be more work, we need a Gossip system so that monitors can consult each other to detect a split horizon, and mechanisms for clients to show summaries of what they know to determine if there are conflicts. What we have now is like if you have a house you've half-built, there is no roof over two rooms, and no electricity, and the floor is bare dirt. But, it's still a house, and in a rain storm it's better to be inside that unfinished house than out in the cold and wet. The people outside in the rain don't think "That guy's house doesn't have triple-glazed windows" they think "Lucky bastard isn't out in the rain like me".
cwkoss 8y ago
Do you know of any interesting alternative protocols proposed recently?
thrower123 8y ago
At this point I'm inclined to think you'd be more likely to get bogged down for decades bikeshedding behind proposals in a standards consortium that has no actual power to enforce them, and the results would be a horrific mishmash with terminal second-system syndrome...

cm2187 8y ago

A "gentlemen's agreement" that was designed to sustain a nuclear strike...

DoctorOetker 8y ago
I didn't know that, was this the motivation of the current design? is there a source to back this up?
- toomuchtodo 8y ago
  https://www.wired.com/2012/09/what-do-the-h-bomb-and-the-internet-have-in-common-paul-baran/ https://www.wired.com/2012/09/what-do-the-h-bomb-and-the-int...
TeMPOraL 8y ago
The two aren't at odds. Packet routing was designed to survive sudden and severe loss of network paths, but it still assumes that participants on the network are cooperative players.
- cm2187 8y ago
  In other words that they were confident there wouldn't be a russian evil maid anywhere on a US wide network.
  - TeMPOraL 8y ago
    You got me here. I have no clue if this scenario was considered, and how this affected the design process. It was the Cold War after all.
throwaway2048 8y ago
BGP was designed far after that era of ARPANET

StudentStuff 8y ago

Such is the nature of BGP. Something like SPF (eg: an authorized AS list for an IP block) and DMARC (reporting about who tried to broadcast what IP block and was rejected) would be great, perhaps even have the latter component convey attack info so ISPs could deal with infected clients automatically. Basic security mechanisms when it comes to large ISP networks are a pipe dream though, instead we get vendors pushing extremely vulnerable Juniper gear cause its reasonably priced, meanwhile these boxes have new root exploits found multiple times a year. None of the vendors give a crap about security, Cisco pays it some lip service (to win gov't contracts) but charges a premium for basic features.

jopsen 8y ago
I'm amazed telecoms let's this happen, routing massive amounts of traffic the wrong way, must cause a lot of latency, right?
- felix_nagaand 8y ago
  Sure, but how many users care about 20ms to their local data farm versus 70 cross country and maybe 200 to China?
  - cronix 8y ago
    Right, they generally say "my phone is getting slow, time to upgrade"

jgrahamc 8y ago

And that agreement is trying to be enforced using PKI: https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki/

maltalex 8y ago
RPKI doesn't stop BGP hijacks. Sure, it's better than nothing but RPKI doesn't validate the entire path, only the origin. If you want path validation, you need BGPSec. But BGPSec is basically un-deployable in real-world networks.
- Avamander 8y ago
  Why is BGPSec un-deployable?

e40 8y ago

I'd like to point out that government used to run by agreements that were like that, and look what has happened in that domain. I say this as a warning what the internet could become.

dangerlibrary 8y ago
Your analogy is confusing. I have no idea if you are talking about international, national, or local agreements. I also have no idea what your opinions are. Your comment simultaneously contains almost no information is super off topic.

magicbuzz 8y ago

And state actors are proving themselves to not be gentlemen at all.