4 ms·
> Google has proposed a new Internet protocol called SPDY that would prevent these types of header injections – much to the dismay of many telecom companies who
by guelo 12y ago
> Google has proposed a new Internet protocol called SPDY that would prevent these types of header injections – much to the dismay of many telecom companies who are lobbying against it
Wow, I was pretty ambivalent about SPDY/HTTP2 before but now I really hope it catches on.
- mschuster91 12y agoActually a binary format (designed to be machine-friendly) is better for MITM injections as it's easier to parse and manipulate... the only benefit of HTTP2/SPDY is that iirc it requires TLS. I'm waiting for the first carrier to perform SSL MITM.
- guelo 12y agoHTTP2 doesn't require encryption but it does compress the headers. I'm guessing compression makes it too CPU-intensive for telecoms to manipulate the headers on the fly.
- TazeTSchnitzel 12y agoI wish they'd require encryption. Perhaps make http:// http:// be TLS but without certificate verification.
- kaoD 12y agoThen the telecoms would MITM it anyways.
- nitrogen 12y agoCertificate pinning and web-of-trust verification would make that difficult to maintain for long.
- kaoD 12y agoIt's unlikely they'll ever get mass usage because both are uncomfortable to work with. If a certificate is compromised, changing it means all pinned clients will get a huge warning. Either the user ignores the warning (in which case pinning is useless) or he doesn't and the site is harmed. Keeping a compromised certificate is even worse. For WoT you first need a web of trusted individuals. Unfortunately key distribution over insecure channels is still an unsolved problem.
- TD-Linux 12y agoThis is in progress. HTTP 2.0 does exactly what you specify. The tcpinc working group at the IETF is also looking at adding this at a lower level for all TCP connections.
- deleted 12y ago[deleted]
- TazeTSchnitzel 12y agoUh, they removed the TLS requirement.
- deleted 12y ago[deleted]
- jankassens 12y agoThey're already planning it: "Involve the user: Obtain user consent to trust service provider to decrypt select HTTPS" Quote from someone working for a satellite internet provider for airlines. Source: http://www.atis.org/openweballiance/docs/OWAKickoffSlides051414.pdf http://www.atis.org/openweballiance/docs/OWAKickoffSlides051... page 27
- meowface 12y agoAs bad as it is, at the least it should be easy to opt-out of that (unless they do something ridiculous like charge you extra if you refuse to opt-in). Just remove the certificate your ISP gives you.
- girvo 12y ago> I'm waiting for the first carrier to perform SSL MITM. Nokia, funnily enough, did this on certain dumbphone models. Not a carrier, I know, but still interesting. http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/ http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/
- higherpurpose 12y ago> the only benefit of HTTP2/SPDY is that iirc it requires TLS. Yeah...except the NSA-agent-hiring IETF [1] gave up on that at the last minute. http://arstechnica.com/security/2014/01/nsa-employee-will-continue-to-co-chair-influential-crypto-standards-group/ http://arstechnica.com/security/2014/01/nsa-employee-will-co...
- tedunangst 12y agotelecom companies are actually lobbying against spdy?
- softdev12 12y agothey are lobbying because they see anything Google proposes as a direct long term threat to their business model.
- girvo 12y agoWhich it is. Good riddance, in my opinion, those threats couldn't have happened to a more deserving set of corporations.
- guelo 12y agoThis is the anti-SPDY lobbying alliance, http://www.atis.org/openweballiance/index.asp http://www.atis.org/openweballiance/index.asp They seem to be deathly afraid of becoming "dumb pipes".
- mschuster91 12y agoHolding back innovation just because it would wipe out their business. This, my dear friends, is why ISPs need to become regulated, government-owned utilites. Or has anyone seen regulators preventing experiments on self-driving cars and trains in order to keep train conductor's jobs?
- tedunangst 12y ago> Or has anyone seen regulators preventing experiments on self-driving cars and trains in order to keep train conductor's jobs? Yes? Isn't that the crux of the Uber and AirBnB and Aereo battles?
- mschuster91 12y agoYet, these laws you mention actually make sense (at least those Uber and Airbnb "fight" against). Taxi regulations exist to prevent Uber's "surge pricing" model, thereby guaranteeing the customer the same price for the same distance, no matter how late at night it is or how drunk the customer is (at least in Germany; the taxi market as a whole seems to be broken in the US so that's another story). Hotel regulations exist to protect other tenants in a building from the kind of bullshit which has happened multiple times: ever-changing, drunk tenants demolishing stuff, being loud, throwing sex parties, etc. The only law area being "disrupted" where the existing regulations don't protect any legitimate interests aside from MAFIAA's Big Money is the TV distribution, and I'm sad that Aereo got problems there. But well, that's the area of Big Money, no chance to compete there :(