Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deep packet inspection is dead, and here's why (2017)

security.ias.edu

Post reply on HN
Print view View original

61–70 of 126 posts

Re: Deep packet inspection is dead, and here's why (2017)

#61

Post by Dylan16807 »

jrockway wrote: post #44
rocqua wrote: post #38

Earlier quoted context omitted.

It could be shown client-side whether an SSL connection uses a locally installed root CA or a globally trusted CA. This way, an employee could see whether their employer is MitM-ing their connection to FB / reddit.com / pornhub / their bank. Based on this, they could complain to their employer for unreasonable MitMing, and serve as a weak detection point for compromise of the company root CA.

You can't trust your client. The IT department will just push a browser that says "you're using the root CA for this connection" while actually using the MITM CA. Maybe you'll download your own Chrome, but that silently gives you their hacked version. The SHA256sum on their website has also been tampered with. Fine, you say, you'll download the source code and compile it yourself. But the compiler has been tampered w…

That's a separate issue, because a completely custom browser can intercept even without a MitM on the connection.

Sometimes you either have your own device or you trust your employer to not directly lie to you.

Re: Deep packet inspection is dead, and here's why (2017)

#62

Post by diminoten »

rocqua wrote: post #25

I'm worried about this development. One the one hand, ubiquitous encryption is simply required for security on the internet. Things like lets encrypt and warning on http are great improvements. On the other hand, the owner of a network has some right to look into the packets on that network. Especially if the owner of the network also owns the end-points of that traffic. My main use-case here isn't corporate networks…

You ostensibly have access to any private key being used to decrypt this traffic, assuming you have access to the device, which I believe is the correct boundary.

Re: Deep packet inspection is dead, and here's why (2017)

#63

Post by diminoten »

jmcqk6 wrote: post #31
rocqua wrote: post #25

I'm worried about this development. One the one hand, ubiquitous encryption is simply required for security on the internet. Things like lets encrypt and warning on http are great improvements. On the other hand, the owner of a network has some right to look into the packets on that network. Especially if the owner of the network also owns the end-points of that traffic. My main use-case here isn't corporate networks…

>Really, my issue is stuff on my own network. I want to see what my TV sends home. Same with an amazon-echo, or really any IoT thing. I'm with you 100%. The reality is, though, your only choice is to not run those devices with access to the internet. A TV should not require internet access to be usable. I won't use an Echo, and IoT devices are isolated to their own internal network without WAN access.

Your definition of a usable TV is outdated.

Re: Deep packet inspection is dead, and here's why (2017)

#64

Post by robohoe »

jstanley wrote: post #33
rocqua wrote: post #25

I'm worried about this development. One the one hand, ubiquitous encryption is simply required for security on the internet. Things like lets encrypt and warning on http are great improvements. On the other hand, the owner of a network has some right to look into the packets on that network. Especially if the owner of the network also owns the end-points of that traffic. My main use-case here isn't corporate networks…

> Really, my issue is stuff on my own network. I want to see what my TV sends home. Same with an amazon-echo, or really any IoT thing. Yet, if they all use SSL and don't allow me to add a root CA, I can't look at what they run. Which is part of why the more paranoid of us steadfastly refuse to own such devices.

And sadly it's near-impossible to find a non-Smart TV these days :(

Re: Deep packet inspection is dead, and here's why (2017)

#65

Post by robohoe »

diminoten wrote: post #63
jmcqk6 wrote: post #31

Earlier quoted context omitted.

>Really, my issue is stuff on my own network. I want to see what my TV sends home. Same with an amazon-echo, or really any IoT thing. I'm with you 100%. The reality is, though, your only choice is to not run those devices with access to the internet. A TV should not require internet access to be usable. I won't use an Echo, and IoT devices are isolated to their own internal network without WAN access.

Your definition of a usable TV is outdated.

Agreed. It's not even the TV that needs access to Internet. What if you have one of the Roku, Apple TV, Chromecast, etc devices that stream content from the Internet?

Without those we might as well go back to storing content locally which let's face it - is mostly retrieved quasi-legally through BitTorrent.

Re: Deep packet inspection is dead, and here's why (2017)

#66

Post by robohoe »

anonymousisme wrote: post #49

It's not dead. Encryption has (unjustifiably) pushed the enterprise to install fake catchall certificates on proxies so they can snoop plain-text traffic. (Why anyone would ever think this is a good idea is beyond me.)

Corporate MITM devices/proxies are surely in a new business boom. Now we went from lack of encryption to encryption with MITM certificates on questionable appliances running questionable code.

Re: Deep packet inspection is dead, and here's why (2017)

#67

Post by genpfault »

mabbo wrote: post #20

A few years ago, one of the best managers I ever worked for left to become the CTO of a company doing pattern analysis of network traffic, rather than Deep Packet Inspection. The premise was that most of the internet traffic on your network follows the same typical patterns, but nefarious traffic doesn't. Drop their system into the network and voila, you can start to find the weird things going on that seem out of th…

> Drop their system into the network and voila, you can start to find the weird things going on that seem out of the ordinary.

hmmm[1]

[1]: https://everything2.com/user/The+Custodian/writeups/Seek+And...

Re: Deep packet inspection is dead, and here's why (2017)

#68

Post by mdpopescu »

ryukafalz wrote: post #29
rocqua wrote: post #25

I'm worried about this development. One the one hand, ubiquitous encryption is simply required for security on the internet. Things like lets encrypt and warning on http are great improvements. On the other hand, the owner of a network has some right to look into the packets on that network. Especially if the owner of the network also owns the end-points of that traffic. My main use-case here isn't corporate networks…

The implication here is that you can't trust the devices on your network. IMO that's itself a problem; rather than weakening encryption to enable network owners to analyze traffic on their network (which also harms dissidents who need secure network access), I would prefer a push for more trustworthy devices. The devices we own should be acting in our own best interest; we shouldn't need to treat them as adversaries.

The devices we own should be acting in our own best interest; we shouldn't need to treat them as adversaries.

This reminds me of Programming Satan's Computer [1] (PDF link), the first time I understood that while programming is hard, security programming is absolutely insane.

[1] https://www.cl.cam.ac.uk/~rja14/Papers/satan.pdf

Re: Deep packet inspection is dead, and here's why (2017)

#69

Post by aaaaaaaaaab »

logfromblammo wrote: post #47
rocqua wrote: post #35

Earlier quoted context omitted.

I'm hoping for something like 'Right to Repair' or 'Right to Tinker' that'll let us verify more devices are trustworthy. My smart TV (I am ashamed to admit I have one) is really useful. Very little about the idea of a TV with build-in Plex support requires it be totally locked down. Hence it is a buisness decision that could be competed or regulated away. (I was going to make the same argument about a TV with build-i…

Some of us (for whom Charisma is not their dump stat) need to get elected to national legislative assemblies and form technology and engineering caucuses. Possible items for its agenda: - Right to Repair - Right to Tinker - Right to "Pwn Ur Own" - Hardware sellers required to deliver firmware source to buyers --- including build scripts --- including device-specific signing keys --- even for cars and tractors - Publi…

Ok, I’ll draw the logo!

Re: Deep packet inspection is dead, and here's why (2017)

#70

Post by jethro_tell »

robohoe wrote: post #65
diminoten wrote: post #63

Earlier quoted context omitted.

Your definition of a usable TV is outdated.

Agreed. It's not even the TV that needs access to Internet. What if you have one of the Roku, Apple TV, Chromecast, etc devices that stream content from the Internet? Without those we might as well go back to storing content locally which let's face it - is mostly retrieved quasi-legally through BitTorrent.

yeah, while that's true, a manufacture like amazon or apple is much more likely to update your device since they are still hoping to sell you content. You think your offbrand Smart TV is going to update past a couple bugs? They already made all the money they are going to make off that TV and they are done.

Still have to trust the manufacture for that to work, but at lease you're not just left wide open there. (I mean you still could be, but it seems less likely with this model). And, if it doesn't stay up todate, you can toss the box and plug in a new one.

Post reply on HN