3 ms·

Actually, it isn't! While commercial fiber is usually point-to-point, consumer-grade fiber commonly uses a Passive Optical Network. Basically, a single fiber i

by crote 6y ago

Actually, it isn't! While commercial fiber is usually point-to-point, consumer-grade fiber commonly uses a Passive Optical Network. Basically, a single fiber is split to multiple devices, and the upstream device allocates time slots to devices in which they can transmit. Just like what's happening with cable internet. This means that, theoretically, a rogue end-user device could ignore the timeslot allocation and disrupt the signals sent by other devices. But because every user ends up using exactly the same equipment, I highly doubt this ever happens in practice. There's nobody connecting ancient analogue devices to fiberoptic cables, after all.

JosephRedfern 6y ago
Wow, that sounds like a crazy vulnerability... so could I shine a laser pointer (of the right wavelength) down a FTTH optical fibre, screw up the TDMA, and knock out network access for my village? EDIT: my understanding isn't great here, but could I also listen outside of my time window and snoop on other traffic?
- tialaramex 6y ago
  The GPON splitter is entirely passive, it's effectively a very fancy prism, so yes. It's a shared network. So is the road. You could just pour barrels of something nasty across the big road into the village and snarl everything up, but when they catch you I'm guessing the other villagers will be pretty unhappy about that. In principle the technology might arrange for encryption keys between your endpoint and the smarts at a remote exchange so that it's impossible without physical access to another terminal to interpret messages for other terminals or impersonate them. In practice I doubt this is actually effective. You should assume that traffic you send may be intercepted by an adversary. If you're confident that you don't have any adversaries then I suppose that needn't concern you, otherwise you should probably put most confidence in security at layers you can actually inspect, like TLS/ HTTPS rather than mysterious proprietary technologies like your FTTP installation. There are standards for stuff like the encryption of GPON, but those standards aren't for implementing by us, so they leave lots of gaps that could be filled by your service provider with strong, security focused decision making, or could be "Eh, who cares just set the password as 'password' on all the terminals and stop fiddling with it". It doesn't take too much cynicism to assume the latter.

by crote 6y ago

JosephRedfern 6y ago

Wow, that sounds like a crazy vulnerability... so could I shine a laser pointer (of the right wavelength) down a FTTH optical fibre, screw up the TDMA, and knock out network access for my village? EDIT: my understanding isn't great here, but could I also listen outside of my time window and snoop on other traffic?

tialaramex 6y ago
The GPON splitter is entirely passive, it's effectively a very fancy prism, so yes. It's a shared network. So is the road. You could just pour barrels of something nasty across the big road into the village and snarl everything up, but when they catch you I'm guessing the other villagers will be pretty unhappy about that. In principle the technology might arrange for encryption keys between your endpoint and the smarts at a remote exchange so that it's impossible without physical access to another terminal to interpret messages for other terminals or impersonate them. In practice I doubt this is actually effective. You should assume that traffic you send may be intercepted by an adversary. If you're confident that you don't have any adversaries then I suppose that needn't concern you, otherwise you should probably put most confidence in security at layers you can actually inspect, like TLS/ HTTPS rather than mysterious proprietary technologies like your FTTP installation. There are standards for stuff like the encryption of GPON, but those standards aren't for implementing by us, so they leave lots of gaps that could be filled by your service provider with strong, security focused decision making, or could be "Eh, who cares just set the password as 'password' on all the terminals and stop fiddling with it". It doesn't take too much cynicism to assume the latter.