Deep packet inspection is dead, and here's why (2017)

Post by api » Tue, Jan 15, 2019, 7:38 PM UTC

rocqua wrote: post #25

I'm worried about this development. One the one hand, ubiquitous encryption is simply required for security on the internet. Things like lets encrypt and warning on http are great improvements. On the other hand, the owner of a network has some right to look into the packets on that network. Especially if the owner of the network also owns the end-points of that traffic. My main use-case here isn't corporate networks…

Post by vlovich123 » Tue, Jan 15, 2019, 7:42 PM UTC

m-app wrote: post #22

mabbo wrote: post #20

A few years ago, one of the best managers I ever worked for left to become the CTO of a company doing pattern analysis of network traffic, rather than Deep Packet Inspection. The premise was that most of the internet traffic on your network follows the same typical patterns, but nefarious traffic doesn't. Drop their system into the network and voila, you can start to find the weird things going on that seem out of th…

This is exactly what has been researched at multiple security companies and productized by Cisco under "Encrypted Traffic Analytics". This is based on research from 2016 that can be found on arXiv: https://arxiv.org/abs/1607.01639 > We conclude that malware's usage of TLS is distinct from benign usage in an enterprise setting, and that these differences can be effectively used in rules and machine learning classifier…

Post by jethro_tell » Tue, Jan 15, 2019, 7:43 PM UTC

diminoten wrote: post #80

TeMPOraL wrote: post #77

Earlier quoted context omitted.

> You think your offbrand Smart TV is going to update past a couple bugs? They already made all the money they are going to make off that TV and they are done. Honestly, who cares? I mean, it's a TV. It should not need Internet to work, and it definitely shouldn't need software updates . Displaying video on a screen is a solved problem. The very fact you can use "software update" and "TV" in the same sentence signals…

TVs have had software for decades. The fact that we're finally using "software update" and "TV" together is a long time coming, and finally a security model we can work with.

Post by xnyan » Tue, Jan 15, 2019, 8:00 PM UTC

TeMPOraL wrote: post #76

robohoe wrote: post #65

Earlier quoted context omitted.

Agreed. It's not even the TV that needs access to Internet. What if you have one of the Roku, Apple TV, Chromecast, etc devices that stream content from the Internet? Without those we might as well go back to storing content locally which let's face it - is mostly retrieved quasi-legally through BitTorrent.

> Without those we might as well go back to storing content locally which let's face it - is mostly retrieved quasi-legally through BitTorrent. But at least it's always available and will not disappear between the moment you first watch it and the moment you want to show it to your spouse. I really expect (and hope) to see a resurgence of torrenting in the wake of ongoing balkanization of streaming platforms.

Post by TeMPOraL » Tue, Jan 15, 2019, 8:02 PM UTC

jethro_tell wrote: post #85

TeMPOraL wrote: post #77

Earlier quoted context omitted.

> You think your offbrand Smart TV is going to update past a couple bugs? They already made all the money they are going to make off that TV and they are done. Honestly, who cares? I mean, it's a TV. It should not need Internet to work, and it definitely shouldn't need software updates . Displaying video on a screen is a solved problem. The very fact you can use "software update" and "TV" in the same sentence signals…

I don't have my TV connected to the internet. But I do stream, so I have to have something connected to the internet. And I prefer a box that is likely to be updated.