5 ms·

Nah, we're just gonna get every state having its own mini-Great-Firewall and very limited access to non-friendly states, at the routing level. There's a next ge

Nah, we're just gonna get every state having its own mini-Great-Firewall and very limited access to non-friendly states, at the routing level. There's a next gen Internet protocol that makes this easy. Maybe also personal IDs with a kind of Internet "credit score". We already do that, but with IP addresses and machine fingerprints. I expect some countries will adopt something like that, even in the "West". Either that or the cost of attacks will remain lower than the benefit of being able to sell bits and bytes to your adversaries. I do not expect this to be the case, but maybe. The open, global, semi-anonymous web is what's not going to survive this fight, I'm afraid. I give it 20 more years, tops, and maybe a lot less.

lallysingh 5y ago
While I don't doubt the motivation of such a naked power grab, it has almost no useful security effect.
- handrous 5y ago
  How so? Can't attack from abroad if non-trusted states have trouble even getting packets routed to the target state, let alone the specific network you're trying to breach. Very hard to attack from inside the "firewall" if access is, as a condition of being considered a trusted routing peer, gated by tying all traffic to a personal or corporate ID that would cause all kinds of trouble for the holder of same IDs should they route traffic on some bad actor's behalf (as, say, through Tor or other means).
  - lallysingh 5y ago
    That's just a matter of finding a vulnerable ally county to hop through. That's SOP now to hide your tracks. It's not like current attacks from Iran to the US have Irani addresses in the IP header.
    - handrous 5y ago
      That's fine until it's nearly impossible to route a packet from (for example) Iran to any IP in any state that's legally unfriendly to hackers and scammers, or otherwise operates outside the broad legal jurisdiction of the hackers' target states.
      - viraptor 5y ago
        That's why we have technologies like Tor which will happily find a number of hops that do allow you to establish that connection. Also IP-level blocks will never be perfect. See Hong Kong proxies. Or people in traded IP ranges classified as coming from another country.
        handrous 5y ago
        Yes, the Internet as currently structured is resistant to this. The Internet is not guaranteed to continue to have that structure. I'm saying that if our choices are "constant attacks such that the Internet is horribly dangerous" and "don't have the Internet", the popular (at the state level) solution will be "I choose neither—instead, we're changing the Internet".
      - lallysingh 5y ago
        It's not direct packets. You ssh into a box in, say, UAE, then Cuba, then Canada, then USA. You're just uploading and running scripts, so latency doesn't matter.
        handrous 5y ago
        Yes, I know how the Internet works now. It doesn't have to keep working that way, and if attacks get really bad the result will not be that we just live with them. The Internet will be modified to reduce the threat to a tolerable level. There's already been some pretty serious work put into what this will look like, if/when it happens.
        5y ago
  - trhway 5y ago
    That is basically KYC for internet traffic. Hasn't stopped big operators in finance, and i doubt that it will be different in Internet. A new crime of "traffic laundering", and mesh networks untraceable and unregulated like cash transactions.
  - rsj_hn 5y ago
    Because the problem is critical infrastructure with holes in it, not that someone might communicate with that infrastructure. Trying to change the environment to ensure there are no attackers on the net is not a feasible alternative to hardening the critical systems.
viraptor 5y ago
That could sounds interesting to to a lawmaker, but it wouldn't change anything in practice. Those hacks don't come directly from the authors nicely identified by their affiliation and location. They'll come from a trusted node in the US. Some many already do.
- handrous 5y ago
  It would force the attackers to enter the jurisdiction of a state that will prosecute them if they're discovered, to carry out the attack, or else resort to much more difficult and slower methods (sneaker-net introduction of initial malware infections in the target state, say).
  - viraptor 5y ago
    You don't have to enter a specific jurisdiction. There are supply chain attacks, escalation through residential connections, existing international botnets, and a thousand other approaches. And of course, there's always someone out there ready to open an email which will own them.
    - handrous 5y ago
      > There are supply chain attacks Yes, some relatively slow, difficult, and expensive attacks would of course still be viable. That does not mean that, "it wouldn't change anything in practice." > escalation through residential connections, existing international botnets Right—so how are you going to talk to your botnet from outside the target sub-Internet when it won't even route packets you send it, except maybe to some hardened commerce-and-propaganda-only subnet that may have limited or no connection to the rest of the target state/bloc's Internet (and again, even that part existing is a maybe)?
      - viraptor 5y ago
        We have a small experiment with that already - corporate NATs which are supposed to achieve the same thing. They still get owned. Even SWIFT which is basically as isolated as it gets in business had bad actors with access. I don't believe a complete separation would ever be possible. We'd have to put banks on the commerce side. But that means every single business entity would also have to have access to them. But most businesses also need access to the other side and will not do perfect separation. In malware research labs you can find rooms literally painted in two colours to separate the isolated part and prevent joining networks by accident. Normal companies do not care that much. Most single-person entities will just plug both ends into one computer and go on with their life.
FridayoLeary 5y ago
The 'splinternet' allegedly.
- handrous 5y ago
  Right. I posit that either we will arrive at that outcome, or "cyber attacks" and various other forms of Internet-enabled international abuse will never get bad enough to justify it. I suspect we're in for the former.
mortenjorck 5y ago
Certificate authorities, but for the evil bit.
- handrous 5y ago
  Sorta, but more like marking anyone's packets from outside your (or a friendly and cooperative country's) legal jurisdiction with the evil bit by default, and then also tracking which person or company, not device or IP address, originated every packet, so if they sent anything that should have been evil-bitted you can track them down. Again, I reckon it's either that or this problem never gets much worse. Given trends, I expect we're gonna lose the open, global Internet.
dublin 5y ago
This is NOT a cybersecurity or network vulnerability problem. That's just a symptom. The real problem is that here, like so many other places in modern society, we've allowed consolidation to proceed far beyond healthy levels - when a single company is responsible for 20% of beef supply, it's time for antitrust action! (Yes, I'm looking at you, too, Internet, Tech, Media, Pharma, Aerospace/Defense, etc. companies...) Maybe just allow one merger per decade, only available to companies with less than 10% of their market?
- heavyset_go 5y ago
  The security state is willing to do anything, up to kidnapping, torture and murder, in order to not change a thing about the current economic order. I expect the problem to be addressed with technology, treaties, extraditions and putting a lot of people in prisons before the fragility of consolidation is addressed.
- aphextron 5y ago
  Consolidation leads to efficiency. Which in the case of commodities, is the only way to ensure low prices. A new slaughter company is not going to innovate a more efficient means of producing a pound of beef. In theory, a perfectly run state monopoly would be the ideal system. But that rarely ends well. In the US we've worked out a sort of half way between the two extremes, where large private corporations are allowed to consolidate in the name of consumer prices, while still maintaining just enough competition for profit motive to keep things well run. It's not perfect but it's the best we've figured out so far.
- unclebucknasty 5y ago
  There are many problems with over-consolidation, but this isn't one of them. The primary problem here is criminals and criminal organizations parading as nation-states. The secondary problem is systems and networks that are insufficiently secured.
User23 5y ago
Back in the EFNet days pretty much everyone just banned .ru, .br, .se, .no, and a few others because it was all takeover attempts all the time.
ineedasername 5y ago
Unless we shut down physical borders that won't work because the developed world has travel open enough that hackers can travel to the country if their target, setup the attack, and leave. A few months later it executes and we're in the same boat as before, albeit with an additional speed bump for the hackers. Or it will just be home grown criminals doing the same thing.
darepublic 5y ago
Couldn't there be an open internet for non critical things and the great firewall protected net would be what countries infra is on
- handrous 5y ago
  I think it'll be easier to have one network that's secure (or, at least, securable) at the protocol level, than two networks. As someone notes down-thread, people don't like dealing with two highly-separated networks, and if you have devices on both then that's a huge threat vector. Further, I think states are likely to use this both to prevent beyond-their-reach nationals from attacking infrastructure and citizens, and to curtail foreign astroturf propaganda efforts. The ID stuff is something I don't think all states will adopt, but some might, even in Democratic states. I think adjusting backbone routing to allow easy network-wide black holing based on verifiable origin, though, is very likely to become widely adopted over the next couple decades.

lallysingh 5y ago

While I don't doubt the motivation of such a naked power grab, it has almost no useful security effect.

handrous 5y ago
How so? Can't attack from abroad if non-trusted states have trouble even getting packets routed to the target state, let alone the specific network you're trying to breach. Very hard to attack from inside the "firewall" if access is, as a condition of being considered a trusted routing peer, gated by tying all traffic to a personal or corporate ID that would cause all kinds of trouble for the holder of same IDs should they route traffic on some bad actor's behalf (as, say, through Tor or other means).
- lallysingh 5y ago
  That's just a matter of finding a vulnerable ally county to hop through. That's SOP now to hide your tracks. It's not like current attacks from Iran to the US have Irani addresses in the IP header.
  - handrous 5y ago
    That's fine until it's nearly impossible to route a packet from (for example) Iran to any IP in any state that's legally unfriendly to hackers and scammers, or otherwise operates outside the broad legal jurisdiction of the hackers' target states.
    - viraptor 5y ago
      That's why we have technologies like Tor which will happily find a number of hops that do allow you to establish that connection. Also IP-level blocks will never be perfect. See Hong Kong proxies. Or people in traded IP ranges classified as coming from another country.
      - handrous 5y ago
        Yes, the Internet as currently structured is resistant to this. The Internet is not guaranteed to continue to have that structure. I'm saying that if our choices are "constant attacks such that the Internet is horribly dangerous" and "don't have the Internet", the popular (at the state level) solution will be "I choose neither—instead, we're changing the Internet".
    - lallysingh 5y ago
      It's not direct packets. You ssh into a box in, say, UAE, then Cuba, then Canada, then USA. You're just uploading and running scripts, so latency doesn't matter.
      - handrous 5y ago
        Yes, I know how the Internet works now. It doesn't have to keep working that way, and if attacks get really bad the result will not be that we just live with them. The Internet will be modified to reduce the threat to a tolerable level. There's already been some pretty serious work put into what this will look like, if/when it happens.
        5y ago
- trhway 5y ago
  That is basically KYC for internet traffic. Hasn't stopped big operators in finance, and i doubt that it will be different in Internet. A new crime of "traffic laundering", and mesh networks untraceable and unregulated like cash transactions.
- rsj_hn 5y ago
  Because the problem is critical infrastructure with holes in it, not that someone might communicate with that infrastructure. Trying to change the environment to ensure there are no attackers on the net is not a feasible alternative to hardening the critical systems.

viraptor 5y ago

That could sounds interesting to to a lawmaker, but it wouldn't change anything in practice. Those hacks don't come directly from the authors nicely identified by their affiliation and location. They'll come from a trusted node in the US. Some many already do.

handrous 5y ago
It would force the attackers to enter the jurisdiction of a state that will prosecute them if they're discovered, to carry out the attack, or else resort to much more difficult and slower methods (sneaker-net introduction of initial malware infections in the target state, say).
- viraptor 5y ago
  You don't have to enter a specific jurisdiction. There are supply chain attacks, escalation through residential connections, existing international botnets, and a thousand other approaches. And of course, there's always someone out there ready to open an email which will own them.
  - handrous 5y ago
    > There are supply chain attacks Yes, some relatively slow, difficult, and expensive attacks would of course still be viable. That does not mean that, "it wouldn't change anything in practice." > escalation through residential connections, existing international botnets Right—so how are you going to talk to your botnet from outside the target sub-Internet when it won't even route packets you send it, except maybe to some hardened commerce-and-propaganda-only subnet that may have limited or no connection to the rest of the target state/bloc's Internet (and again, even that part existing is a maybe)?
    - viraptor 5y ago
      We have a small experiment with that already - corporate NATs which are supposed to achieve the same thing. They still get owned. Even SWIFT which is basically as isolated as it gets in business had bad actors with access. I don't believe a complete separation would ever be possible. We'd have to put banks on the commerce side. But that means every single business entity would also have to have access to them. But most businesses also need access to the other side and will not do perfect separation. In malware research labs you can find rooms literally painted in two colours to separate the isolated part and prevent joining networks by accident. Normal companies do not care that much. Most single-person entities will just plug both ends into one computer and go on with their life.

FridayoLeary 5y ago

The 'splinternet' allegedly.

handrous 5y ago
Right. I posit that either we will arrive at that outcome, or "cyber attacks" and various other forms of Internet-enabled international abuse will never get bad enough to justify it. I suspect we're in for the former.

mortenjorck 5y ago

Certificate authorities, but for the evil bit.

handrous 5y ago
Sorta, but more like marking anyone's packets from outside your (or a friendly and cooperative country's) legal jurisdiction with the evil bit by default, and then also tracking which person or company, not device or IP address, originated every packet, so if they sent anything that should have been evil-bitted you can track them down. Again, I reckon it's either that or this problem never gets much worse. Given trends, I expect we're gonna lose the open, global Internet.

dublin 5y ago

This is NOT a cybersecurity or network vulnerability problem. That's just a symptom. The real problem is that here, like so many other places in modern society, we've allowed consolidation to proceed far beyond healthy levels - when a single company is responsible for 20% of beef supply, it's time for antitrust action! (Yes, I'm looking at you, too, Internet, Tech, Media, Pharma, Aerospace/Defense, etc. companies...) Maybe just allow one merger per decade, only available to companies with less than 10% of their market?

heavyset_go 5y ago
The security state is willing to do anything, up to kidnapping, torture and murder, in order to not change a thing about the current economic order. I expect the problem to be addressed with technology, treaties, extraditions and putting a lot of people in prisons before the fragility of consolidation is addressed.
aphextron 5y ago
Consolidation leads to efficiency. Which in the case of commodities, is the only way to ensure low prices. A new slaughter company is not going to innovate a more efficient means of producing a pound of beef. In theory, a perfectly run state monopoly would be the ideal system. But that rarely ends well. In the US we've worked out a sort of half way between the two extremes, where large private corporations are allowed to consolidate in the name of consumer prices, while still maintaining just enough competition for profit motive to keep things well run. It's not perfect but it's the best we've figured out so far.
unclebucknasty 5y ago
There are many problems with over-consolidation, but this isn't one of them. The primary problem here is criminals and criminal organizations parading as nation-states. The secondary problem is systems and networks that are insufficiently secured.

User23 5y ago

Back in the EFNet days pretty much everyone just banned .ru, .br, .se, .no, and a few others because it was all takeover attempts all the time.

ineedasername 5y ago

Unless we shut down physical borders that won't work because the developed world has travel open enough that hackers can travel to the country if their target, setup the attack, and leave. A few months later it executes and we're in the same boat as before, albeit with an additional speed bump for the hackers. Or it will just be home grown criminals doing the same thing.

darepublic 5y ago

Couldn't there be an open internet for non critical things and the great firewall protected net would be what countries infra is on

handrous 5y ago
I think it'll be easier to have one network that's secure (or, at least, securable) at the protocol level, than two networks. As someone notes down-thread, people don't like dealing with two highly-separated networks, and if you have devices on both then that's a huge threat vector. Further, I think states are likely to use this both to prevent beyond-their-reach nationals from attacking infrastructure and citizens, and to curtail foreign astroturf propaganda efforts. The ID stuff is something I don't think all states will adopt, but some might, even in Democratic states. I think adjusting backbone routing to allow easy network-wide black holing based on verifiable origin, though, is very likely to become widely adopted over the next couple decades.