Aside from the clickbait and non-news of this possible information leakage when you already have a foot on the inside: I always assume that what the headline w

Aside from the clickbait and non-news of this possible information leakage when you already have a foot on the inside: I always assume that what the headline wrongly alludes to (actually reading traffic content) is possible, and use encryption even on my own LAN (VPN, SSH, HTTPS). Wireguard has made all of this a lot easier. I use a high MTU for most things, and the tunnels that have routes to the outside Internet run with an "inside" MTU of 1500, so no issues there. A few things can talk directly to the outside internet without a VPN, but only HTTPS to specific destinations. This is for bootstrapping reasons (for building everything from scratch). Some things are is still in the clear, but contains no real secrets: Internal DNS: Reveals internal primary hostnames, and a few services (like ntp.mydomain, mirror.mydomain and boot.mydomain). ARP, DHCP, LLDP, LACP, BGP (some of it) and PFSync: Not really worried about that. IP and MAC addresses are revealed. The MAC addreses are usually switched after bootstrapping, mostly because I have an internal MAC address scheme that let me quickly identify hosts from just looking at the MAC address. Chainloading iPXE from regular PXE via TFTP: This reveals the iPXE binary and the CA certificate contained within. After this the traffic is HTTPS. Internal mirror: Some accesses to my internal mirror, but only base OS packages that are part of a normal default install. After basic bootstrapping HTTPS or VPN is used. NTP: Meh... what is the current time? iSCSI: Only boot loader is in the clear and contains no secrets. I use "FDE" on top of iSCSI. Auth is not used as a dedicated VLAN for each host takes care of unintended access. Samba: I have a dedicated Windows PC only used for gaming and I use Samba to load my collection of games (mostly GOG). Not really sure if this Samba protocol version is encrypted or not. The password used for the share has no relation to anything else. I don't really care, as this is a separate network. I don't really know why I don't just use "public" Samba shares for this. Stuff on the outside of the primary firewall: My girlfriends phone, my work-phone and a Chromecast. This is just behind the outer router/firewall that does NAT for my network. The "real" network is behind another layer of firewalls. There is probably something else, I should probably have a look with tcpdump more often. Many years ago I stopped asking myself if something should be encrypted and now just use encryption by default (if possible/practical). Is it needed? Probably not. Is it hard? Not with automation.