4 ms·
> The thing that's most ridiculous about this is that the bandwidth is essentially "free" for SK telecom. They sit a netflix caching server in their network an
by piaste 5y ago
> The thing that's most ridiculous about this is that the bandwidth is essentially "free" for SK telecom. They sit a netflix caching server in their network and the traffic never leaves.
Wouldn't that require them to MITM the Netflix traffic, which I would hope is under TLS?
- namibj 5y agoNetflix ships them the box is they ask and sign a contract that they will plug it in and have a security guard it so.
- isiahl 5y agoHere's more information about the program: https://openconnect.netflix.com/en/ https://openconnect.netflix.com/en/ I believe YouTube has the same type of program.
- merlinscholz 5y agoNetflix provides the ISP with the box, afaik the box contains a signed certificate for a Netflix subdomain specific to that box. The "real" Netflix servers direct the customer to that subdomain for the actual content.
- LeifCarrotson 5y agoNo, Netflix's applications would have users of that ISP use the CDN server which they would locate within SK Telecom's network. Netflix calls it their Open Connect Appliance: https://openconnect.netflix.com/en/appliances/ https://openconnect.netflix.com/en/appliances/ That server would, of course, have a connection to the Internet, they push logs to AWS and get updates from Netflix's authoritative servers in Netflix's other datacenters, but they also serve HTTPS connections to thousands of ISP users; the upstream traffic would be minimal.
- sumtechguy 5y agoMy guess Netflix can guide that by handing back different IPs when the end user requests the netflix server name. They can also handle it in application the netflix application can look and see it is in a network that has a box and just goto that ip/host/proxy instead of the generic one. Netflix still controls the keys. No MITM needed.
- ZetaZero 5y agoIt's not a caching server run by the ISP. It's a Netflix server embedded in ISP's datacenter/network. No MITM required https://openconnect.netflix.com/en/ https://openconnect.netflix.com/en/
- gregable 5y agoDoes this mean that Netflix has to have a private TLS key in the box? I wonder how the security of these keys is usually maintained. Interesting engineering/cryptography problem. This problem might also be an interesting use case for Signed HTTP Exchanges. Sign the video files, then push them to the caching server. The caching server then never possesses the private keys for the connection and also cannot modify the content.
- ryanlol 5y agoThere’s nothing interesting here. What are you going to achieve by stealing the certificate for edge0.sktelecom.geo.netflixcdn.com from the box you already have access to? There’s no reason to put *.netflix.com certs on the edge caches.
- 1001101 5y agoCould be in a TPM as well.
- monocasa 5y agoTPMs are pretty slow; the LPC bus they sit off of is basically run at ISA bus speeds.
- nitrogen 5y agoMaybe they used TPM when they meant HSM
- monocasa 5y agoEven then, it's probably too high of latency. These Netflix caching boxes are perennially the subject of "this is how you TLS at line rate and memory bandwidth limits" talks. When you combine this with the fact that these boxes aren't just installed anywhere, but deep inside ISP networks, and ostenisbly the certs aren't for *.netflix.com, but instead for either that specific ISP or even that specifc box, _and_ the certs need to be remotely updated anyway, so they can't just live in an HSM the whole time, I'd just store them on disk if I were Netflix.