4 ms·

My ISP is well known for using Deep Packet Inspection techniques to look at what you're doing and where, and to shape traffic to sites they want to discourage -

My ISP is well known for using Deep Packet Inspection techniques to look at what you're doing and where, and to shape traffic to sites they want to discourage -- like NetFlix. And they inject their own ads into web pages, which could be a source of malware. It's trivial for large providers to get root certs so that they can MITM any TLS traffic on their network, unless you're using pinned certificates. So, I need to protect myself against my ISP. And their name? AT&T.

rjh29 3y ago
Do you have any proof that AT&T are conducting mass-scale MITM attacks against their users?
- xyst 3y ago
  https://www.theguardian.com/commentisfree/2015/feb/20/att-price-on-privacy https://www.theguardian.com/commentisfree/2015/feb/20/att-pr... It’s even explained on their site: https://cybersecurity.att.com/blogs/security-essentials/what-is-deep-packet-inspection https://cybersecurity.att.com/blogs/security-essentials/what... Justification: to keep you safe!1
  - rjh29 3y ago
    Okay, I concede that they have injected cookies into HTTP sites for tracking purposes, and maybe injected ads. But 8 years later the web landscape has changed, everyone uses TLS by default and we have Certificate Transparency, so this sort of thing can't be done anymore. The most they can do now is spy on your DNS and redirect unresolved domains to some ad-filled page.
    - Reisen 3y ago
      It's worth considering that spying on DNS is a tremendous privacy leak, much more than "the most they can do" implies. An aware user might configure their system with DoH and use a privacy respecting DNS provider but for many users on a default home connection the ISP is pretty much able to build up a traffic profile of everything you visit and when you visit it. A VPN provider can close this hole too quite easily. Just from DNS, your ISP can: 1. Infer shopping habbits. 2. Infer which communication services you use (flag users hitting signal.org) 3. Infer when you install, update, or open programs based on telemetry DNS, potentially the versions being run, and how long they run for. 4. Infer when you're most active, infer sleeping habits. 5. Infer probability of health problems if you're hitting more medical sites. 6. Infer political alliance from news sites you visit. And much more. Since US congress dropped the rules preventing ISPs selling this data this might be the most insidious thing your ISP can do today. If you believe that a VPN provider is less likely to spy due to it being the incentive for a paying customer, then a VPN with a no-log DNS option is a huge privacy win. I would argue DoH with NextDNS by itself does more for your privacy than any VPN does with IP masking.
      - doublerabbit 3y ago
        How many folk here on HN are using 1.1.1.1 or 8.8.8.8 for DNS? I do not believe that Google/Cloudflare are not doing something with the DNS data. Data is a commodity after-all.
        PlutoIsAPlanet 3y ago
        It depends on what they're using the data for. Cloudflare if they use their DNS data, is likely to use it to improve their network and security products. Google likely uses it to sell intrusive ads. I know which one I'm more comfortable with.
    - jsnell 3y ago
      So, the original statement that companies like AT&T can trivially get root certificates and MITM TLS traffic is just crazy talk, and you were right to challenge that. > The most they can do now is spy on your DNS and redirect unresolved domains to some ad-filled page. But this isn't really true either. There's a lot more that can be done with a packet stream than spy on DNS, even if the actual payload traffic is encrypted. A combination of DNS, SNI, IPs, and packet sizes and transmission patterns can allow fairly granular classification of traffic by type, and specific connections can then be traffic-shaped, e.g. by explicit throttling to some target bitrate or by applying differential QoS to them.
thriftwy 3y ago
"It's trivial for large providers to get root certs so that they can MITM any TLS traffic on their network" Seriously? Just like that? You can pretend that you are a random site.com and get a SSL lock icon in 2023 if you are big enough?
- blueflow 3y ago
  Its already worse than that. Any provider sitting between you and LetsEncrypt could pass the HTTP challenge on your behalf and get themselves certified as your server.
  - rootusrootus 3y ago
    I'd love to hear how exactly they'd pull that off.
    - blueflow 3y ago
      In Linux, you can do a dstaddr/dstport based redirect in the iptables FORWARD chain to your own http server and serve the ACME challenge/response things from there. This is basically a transparent proxy setup.
      - rootusrootus 3y ago
        What does that buy you? The challenge is merely an authorization, intercepting it does not get you a certificate.
        blueflow 3y ago
        What else would i need to request the certificate?
  - 3np 3y ago
    The ambition is that this will be addressed by supporting RFC8657[0], which would allow domain owners to restrict HTTP-01 issuance by declaring an issuance policy through DNS records. It's been live at staging for years and still waiting to make it to prod[1]. DNS-01 attacks are by default similarly vulnerable to MitM between the issuer and your DNS server, which can be mitigated by setting up DNSSEC. [0]: https://datatracker.ietf.org/doc/html/rfc8657 https://datatracker.ietf.org/doc/html/rfc8657 [1]: https://community.letsencrypt.org/t/prod-support-for-rfc8657-caa-constraints-for-accounturi-and-validationmethods/181584/2 https://community.letsencrypt.org/t/prod-support-for-rfc8657...
raesene9 3y ago
It really shouldn't be and (AFAIK) isn't trivial for people to get root certs any more unless they can get end-users to install them on their systems. It used to be relatively straightforward (you could buy security appliances that had them) but that was quite a long time ago, things have tightened up considerably since then. So if an ISP wants to do this, the only other option is a mandatory proxy.
- bradknowles 3y ago
  How many root certificate authorities are there in the world that are trusted by default by most browsers, or have their authority cross signed by one of the trusted root certificate authorities. At last count, the number I heard of was north of 300. All it takes is one of them being semi shady and being willing to sell or cross sign root certs for someone else, like an ISP. And surprising number of those 300+ are pretty shady. This is one of the methods used in the Great Firewall of China. Or Russia. Or a number of other countries. And most of those countries have smaller annual budgets than AT&T. Of course, that's also why a lot of people in China use VPNs. Just like any sufficiently well funded company or country can go to certain businesses in Israel and get professional zero day/no touch malware that they can drop on any unsuspecting target. And Israel is not the only country selling that kind of technology.

rjh29 3y ago

Do you have any proof that AT&T are conducting mass-scale MITM attacks against their users?

xyst 3y ago
https://www.theguardian.com/commentisfree/2015/feb/20/att-price-on-privacy https://www.theguardian.com/commentisfree/2015/feb/20/att-pr... It’s even explained on their site: https://cybersecurity.att.com/blogs/security-essentials/what-is-deep-packet-inspection https://cybersecurity.att.com/blogs/security-essentials/what... Justification: to keep you safe!1
- rjh29 3y ago
  Okay, I concede that they have injected cookies into HTTP sites for tracking purposes, and maybe injected ads. But 8 years later the web landscape has changed, everyone uses TLS by default and we have Certificate Transparency, so this sort of thing can't be done anymore. The most they can do now is spy on your DNS and redirect unresolved domains to some ad-filled page.
  - Reisen 3y ago
    It's worth considering that spying on DNS is a tremendous privacy leak, much more than "the most they can do" implies. An aware user might configure their system with DoH and use a privacy respecting DNS provider but for many users on a default home connection the ISP is pretty much able to build up a traffic profile of everything you visit and when you visit it. A VPN provider can close this hole too quite easily. Just from DNS, your ISP can: 1. Infer shopping habbits. 2. Infer which communication services you use (flag users hitting signal.org) 3. Infer when you install, update, or open programs based on telemetry DNS, potentially the versions being run, and how long they run for. 4. Infer when you're most active, infer sleeping habits. 5. Infer probability of health problems if you're hitting more medical sites. 6. Infer political alliance from news sites you visit. And much more. Since US congress dropped the rules preventing ISPs selling this data this might be the most insidious thing your ISP can do today. If you believe that a VPN provider is less likely to spy due to it being the incentive for a paying customer, then a VPN with a no-log DNS option is a huge privacy win. I would argue DoH with NextDNS by itself does more for your privacy than any VPN does with IP masking.
    - doublerabbit 3y ago
      How many folk here on HN are using 1.1.1.1 or 8.8.8.8 for DNS? I do not believe that Google/Cloudflare are not doing something with the DNS data. Data is a commodity after-all.
      - PlutoIsAPlanet 3y ago
        It depends on what they're using the data for. Cloudflare if they use their DNS data, is likely to use it to improve their network and security products. Google likely uses it to sell intrusive ads. I know which one I'm more comfortable with.
  - jsnell 3y ago
    So, the original statement that companies like AT&T can trivially get root certificates and MITM TLS traffic is just crazy talk, and you were right to challenge that. > The most they can do now is spy on your DNS and redirect unresolved domains to some ad-filled page. But this isn't really true either. There's a lot more that can be done with a packet stream than spy on DNS, even if the actual payload traffic is encrypted. A combination of DNS, SNI, IPs, and packet sizes and transmission patterns can allow fairly granular classification of traffic by type, and specific connections can then be traffic-shaped, e.g. by explicit throttling to some target bitrate or by applying differential QoS to them.

thriftwy 3y ago

"It's trivial for large providers to get root certs so that they can MITM any TLS traffic on their network" Seriously? Just like that? You can pretend that you are a random site.com and get a SSL lock icon in 2023 if you are big enough?

blueflow 3y ago
Its already worse than that. Any provider sitting between you and LetsEncrypt could pass the HTTP challenge on your behalf and get themselves certified as your server.
- rootusrootus 3y ago
  I'd love to hear how exactly they'd pull that off.
  - blueflow 3y ago
    In Linux, you can do a dstaddr/dstport based redirect in the iptables FORWARD chain to your own http server and serve the ACME challenge/response things from there. This is basically a transparent proxy setup.
    - rootusrootus 3y ago
      What does that buy you? The challenge is merely an authorization, intercepting it does not get you a certificate.
      - blueflow 3y ago
        What else would i need to request the certificate?
- 3np 3y ago
  The ambition is that this will be addressed by supporting RFC8657[0], which would allow domain owners to restrict HTTP-01 issuance by declaring an issuance policy through DNS records. It's been live at staging for years and still waiting to make it to prod[1]. DNS-01 attacks are by default similarly vulnerable to MitM between the issuer and your DNS server, which can be mitigated by setting up DNSSEC. [0]: https://datatracker.ietf.org/doc/html/rfc8657 https://datatracker.ietf.org/doc/html/rfc8657 [1]: https://community.letsencrypt.org/t/prod-support-for-rfc8657-caa-constraints-for-accounturi-and-validationmethods/181584/2 https://community.letsencrypt.org/t/prod-support-for-rfc8657...

raesene9 3y ago

It really shouldn't be and (AFAIK) isn't trivial for people to get root certs any more unless they can get end-users to install them on their systems. It used to be relatively straightforward (you could buy security appliances that had them) but that was quite a long time ago, things have tightened up considerably since then. So if an ISP wants to do this, the only other option is a mandatory proxy.

bradknowles 3y ago
How many root certificate authorities are there in the world that are trusted by default by most browsers, or have their authority cross signed by one of the trusted root certificate authorities. At last count, the number I heard of was north of 300. All it takes is one of them being semi shady and being willing to sell or cross sign root certs for someone else, like an ISP. And surprising number of those 300+ are pretty shady. This is one of the methods used in the Great Firewall of China. Or Russia. Or a number of other countries. And most of those countries have smaller annual budgets than AT&T. Of course, that's also why a lot of people in China use VPNs. Just like any sufficiently well funded company or country can go to certain businesses in Israel and get professional zero day/no touch malware that they can drop on any unsuspecting target. And Israel is not the only country selling that kind of technology.