4 ms·

Thing is, the network layer of the internet was never intended to be secure. Routing data through unknown hosts controlled by untrusted public organizations, pr

Thing is, the network layer of the internet was never intended to be secure. Routing data through unknown hosts controlled by untrusted public organizations, private enterprises and foreign countries, when it makes sense on the technical/business level, is what internet routing protocols are designed to do. Sure, here we are talking about BGP using a less-than-ideal route, but the same effect (traffic going from Russia into China then back into Russia) could very well happen from the intended behavior of the protocols. The network layer is explicitly assumed/designed to be unreliable, insecure and hard to centrally control (for TCP/IP, this is not true of some cell-based/virtual-circuit networking layers). This is why security should be built at the end points (namely encryption and authentication) and not assumed from the network layer. p.s. A very simple way to make Russian internet more secure against foreign powers would be to have a highly competent government-operated certificate authority which would issue EV TLS certificates for free to Russian businesses and individuals. Then pass two laws, one requiring web browsers sold or distributed in Russia to only allow that certificate authority for .ru domains, and a second one requiring web sites to get those certificates (either for all websites or only those considered 'sensitive'). This doesn't solve the issue of foreign-owned and foreign-located cloud services, and is honestly a worse solution than working at an international level to create a better standard for authentication and data protection than host certificates and certificate authorities. But, from the point of view of a single country's government with (let's face it, reasonable) paranoia about foreign spying on their internal internet communications, this would be about the best 'counter-measure' that I can see being realistically applied.

userbinator 12y ago
Routing data through unknown hosts controlled by untrusted public organizations, private enterprises and foreign countries, when it makes sense on the technical/business level, is what internet routing protocols are designed to do. That's basically what Tor does, and its users are perfectly fine - expecting that - their traffic goes through many other hosts before it reaches its destination. The reason this isn't a problem is largely due to... This is why security should be built at the end points (namely encryption and authentication) and not assumed from the network layer.

userbinator 12y ago

Routing data through unknown hosts controlled by untrusted public organizations, private enterprises and foreign countries, when it makes sense on the technical/business level, is what internet routing protocols are designed to do. That's basically what Tor does, and its users are perfectly fine - expecting that - their traffic goes through many other hosts before it reaches its destination. The reason this isn't a problem is largely due to... This is why security should be built at the end points (namely encryption and authentication) and not assumed from the network layer.