14 ms·
If this is just Realpolitik/hardware independence, fine, but security..? Any worthwhile Internet traffic should be encrypted in 2020, and if it isn’t, Huawei p
by rich_sasha 6y ago
If this is just Realpolitik/hardware independence, fine, but security..?
Any worthwhile Internet traffic should be encrypted in 2020, and if it isn’t, Huawei probably isn’t the most immediate concern.
And if it is encrypted, does it really matter who is listening?
Comments welcome, I know zilch about telecoms hardware.
- cm2187 6y agoEven if everything was encrypted (which is not the case) and that encryption could not be downgraded by a mitm (which is not the case - cf starttls), it can still be used to track whereabouts, or disrupt the connectivity or utilise any mitm zero day. But a good question would be why 5g, and not every other computer chip in any computer and network equipment, which could be backdoored, and I doubt anyone verified the conformity of the chip to the blueprint sent to the factory.
- pas 6y ago5G is the line in the sand. It's basically the point of no return, we're fully and firmly in the "cyber era" or whatever we want to call it. Where (when) even the backup and disaster recovery plans are (at least partially) Internet dependent. Going forward this kind of infrastructure will probably be more important than any other kind (because this will control all the others too). Will this finally move the cost-benefit needle toward verifiable computing (open chips, open fabs, open *ware)? Who knows. But so far it seems the power brokers of the old era (eg. countries) are trying to maintain control.
- yodelshady 6y agoYou can't encrypt "metadata" that the machine needs to know to do its job, and with enough of that, you can de-anonymise any public posters. And you'll have metadata on (some of) their contacts too. Plus, if it's your tower, you can just switch it off, at an opportune moment.
- rich_sasha 6y agoOk, that’s fair enough
- haecceity 6y agoIf that's the case then you want as many providers as possible so no one has enough information to de-anonymize the traffic?
- wheatocean 6y agoTurning aside concerns about current and future provider interoperability (which is also a common reason for concern when using huawei hardware for core network purposes and would get worse as you expect them to integrate with several different vendors)... Wouldn't traffic run through many parts of the network exposing data to even more providers? Wouldn't you be subject to any portion of the chain breaking, or being turned off?
- TheAdamAndChe 6y agoYour questions aren't about telecoms hardware, but about politics and the international flow of power. China is slated to take over the world economically. Their political model has the potential to spread around the world. These are attempts to limit China's capacity to grow as fast while inhibiting their capacity to knock out, intercept, or backdoor critical infrastructure.
- rich_sasha 6y agoYeah, this I get and, well, sympathise in a way. There is no war, but an ongoing struggle for staying ahead economically, and if this is a part of it, at least there is a logic to it. I’m asking, is there really a security risk that Huawei might listen in on telecoms. Is traffic at the low level more vulnerable somehow? Is it the prevalence of unencrypted communications? Is it leaking of metadata that people are worried about?
- TheAdamAndChe 6y agoYes, the risk is real. Imagine the US made phones for Russia during the Cold War, and the phones were so complicated and full of microcontrollers that reverse engineering and ensuring that a backdoor wasn't in place was impossible. Do you really think the US wouldn't have taken advantage of that? The specific technical risk is unknown, though. There are thousands of microcontrollers in a modern advanced electronic device. It's nearly impossible to inspect each one and see what exactly is backdoored and how.
- sudosysgen 6y agoThe phones have access to the raw data. The towers shouldn't have access to the raw data, because presumably it's encrypted. If it isn't, it's game over anyways. Not really comparable. You could make an argument about metadata, which is much more questionable from the get-go.
- filoleg 6y agoI think the parent comment wasn't talking about intercepting traffic and being able to know what your enemy is talking about. The parent comment was talking about being able to take advantage of the situation by making the enemy use your devices and then incapacitating their infrastructure at the perfect moment by activating the killswitch on those devices.
- tompagenet2 6y agoOn this thought, why is the concern about 5G rather than existing mobile networks and existing fixed-line networks (Huawei kit is common in both)? Is something different about 5G or the UK implementation of it?
- rich_sasha 6y agoJust guessing, but maybe Huawei was more niche when the earlier generations were built, so organically participated less in them anyway? Or maybe the higher density of 5G kit makes the attack cross-section larger somehow?
- kevin_thibedeau 6y agoThey're cheaper and its more likely that profit constrained telcos will buy their equipment as a competitive edge while selling out their populace.
- dogma1138 6y agoThis is from all UK networks.
- abc-xyz 6y agoYou probably wouldn’t see a browser as a security risk either. In a recent example, all the big Chinese browsers blocked or rewrote the content on GitHub’s 996 repo. Imagine if Chinese browsers became mainstream, then they could rewrite Wikipedia articles, insert their own links/propaganda in google results, Facebook feeds, change download links to include a version bundled with spyware, etc. They already demonstrated that they’re willing to do it with the GitHub repo.
- someperson 6y agoIt's worth noting that Qihoo 360 owns the Opera Web Browser, which incidentally offers a Free VPN to protect your privacy. The Qihoo 360 Browser, Tencent QQ Browser and Xiaomi smartphone's native browser all reportedly blocks the GitHub "996.icu" repository [1]. It seems likely such client-side censorship also reports the attempted access to the Chinese government authorities for further investigation. Other than the risks of using Opera (and other software like AirDroid, TikTok, WeChat etc), the main way I currently see users outside China being affected by similar issues is if they use Chinese Android devices, including grocery store smartphones, or those popular HDMI android dongles. China's export of technological-enabled totalitarianism and surveillance states (especially to developing countries) is accelerating. [1] https://www.scmp.com/abacus/culture/article/3029260/chinese-browsers-block-protest-against-chinas-996-overtime-work https://www.scmp.com/abacus/culture/article/3029260/chinese-...
- totalZero 6y agoYou're missing one of the largest risk vectors in the whole 5G game. 5G operates on higher frequency and requires a larger density of base stations. If you can identify individual devices -- even without cracking the encryption they use -- then you can track them them geographically, and also conduct traffic analysis. 5G presents a potential security risk because it allows far greater granularity of device localization, even without GPS.
- Waterfall 6y agoI don't know if I want 5G. It sounds like wimax but faster. I don't think it gives that much benefit, triangulation already was able to bomb a terrorist in Russia in the 90s. How much worst could it get?
- totalZero 6y agoMy understanding is that the difference between 5G density/localization and that of previous technologies is quite substantial, especially in urban areas. "The extension of spectrum range has an impact on the network architecture. mmwave cells will employ shorter ranges of around 100-to-200 meters which will require extreme densification to provide high coverage. 3G networks reached densities of fourto- five base stations per km², 4G networks eight-to-ten per km², while 5G networks could reach densities of 40-to-50 per km²." https://www.newtec.eu/article/article/choosing-the-right-connectivity-for-5g https://www.newtec.eu/article/article/choosing-the-right-con...
- Waterfall 6y agoI'm wondering how much worst it is since we already can track people pretty well with cellular data now. Sorry if I didn't make that clear, seems like they can already do all those things. How much worst can it be?
- gruez 6y agoIts the difference between knowing which neighborhood you're in and which street or mabye even which house you're in.
- hnarn 6y ago> And if it is encrypted, does it really matter who is listening? If your argument here is “who cares if we can trust the hardware if the encryption works” I’d encourage you to think about how you know that the encryption “works” if you can’t trust the hardware. A lot of the encryption is out of necessity far removed from the end user, it’s not exactly PGP over email. And everything is never encrypted, the operations of mobile networks require a lot of extra metadata about the operations that is still sensitive even if you completely disregard the traffic over the network.
- rich_sasha 6y agoThere isn’t really an argument, only a question. As in, a basic tenet of cryptography is that we can communicate over unsafe channels, so long as we trust the cipher, the final recipient and our own hardware. Maybe I don’t trust the 5G but I do trust the cipher and my computer, is that ok then? As for metadata, is there no cryptographic schemes that make metadata extraction impossible? I’m thinking like with Covid tracking apps, you can find out whether you were in contact with someone infected, without sharing any identifiable info.
- jimmydorry 6y agoData headers, Routing, Physical Location, and some kind of user / device identifier (e.g. Hardware ID); would already make an incredibly powerful data set. And those are things that governments around the world mandate that ISPs must log for law enforcement activities. If it's logable, one must assume that any bad actor with a backdoor can obtain a copy too.
- wyuenho 6y agoNational security != information security National security includes things such as the prevention of over-reliance on a foreign supplier working with a foreign subversive government hell-bent on their unfair mercantilist policies. It's economic security they worry about first, which could lead to a whole host of other security issues due to lost of leverage later on.
- coliveira 6y ago> prevention of over-reliance on a foreign supplier working with a foreign subversive government hell-bent on their unfair mercantilist policies. If that was true, no foreign country would be buying from US companies.