Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

Post by jeffrallen » Tue, Oct 14, 2025, 5:38 AM UTC

varenc wrote: post #32

wyager wrote: post #16

I see no issue with the satellite backhaul itself being unencrypted; anyone using the satellite provider should assume they're hostile and encrypt+authenticate everything they send anyway. I don't trust my ISP's fiber to be snoop-resistant just because they nominally have some shitty ONT encryption. Obviously the specific examples of end-users failing to encrypt are bad, but that's not really a problem with the satel…

If someone is browsing the internet on in-flight wifi, and their DNS requests get leaked this way, I don't really think its the casual airline user's fault for not encrypting their DNS traffic. Modern cell phone data traffic (4G/5G) is all encrypted, so the same unencrypted DNS requests can't just be passively sniffed. Something similar should happen here. I'd blame the airline or their ISP provider for sending unenc…

Post by devjab » Tue, Oct 14, 2025, 5:39 AM UTC

astrange wrote: post #23

josephg wrote: post #14

Earlier quoted context omitted.

End user license agreements are a huge part of the problem. Ideally users could sue if our data is leaked - and the threat of being sued would put pressure on companies to take security more seriously. Ie, it would become a business concern. Instead we're constantly asked to sign one-sided contracts ("EULAs") which forbid us from suing. If a company's incompetence results in my data being leaked on the internet, ther…

There is in at least California, the EU, and China. A lot of clauses in EULAs aren't actually legal.

Post by stephen_g » Tue, Oct 14, 2025, 5:41 AM UTC

vasco wrote: post #33

modeless wrote: post #5

> remarkably, nearly all the end-user consumer Internet browsing and app traffic we observed used TLS or QUIC There was a surprising amount of resistance to the push to enable TLS everywhere on the public Internet. I'm glad it was ultimately successful.

It was only successful because Google said you'd rank higher if you did it.

Post by N19PEDL2 » Tue, Oct 14, 2025, 6:14 AM UTC

fennec-posix wrote: post #11

ROBLOX_MOMENTS wrote: post #4

Is it correct to Assuming the amount of Mexican companies in this paper is because of their receiver being in the major city southwestmost corner of the country ?

Yeah that's correct. The study was conducted in San Diego which falls under the satellite beam footprint required for services in Mexico. If you were in say, Alice Springs in Australia (wink wink) for example, you'd be able to see traffic for Indonesia, Philippines, most of South East Asia, and perhaps parts of China, South Korea and Japan if the beams are right.

Post by necovek » Tue, Oct 14, 2025, 6:29 AM UTC

ozim wrote: post #46

chii wrote: post #12

Earlier quoted context omitted.

> nobody gets fired when there's a breach this must mean the consequences of such a breach has either not produced any visible damage, or the entity being damaged is uncaring (or have no power to care).

If you fire people for stuff they didn’t maliciously introduced you will end up with no people to work with. Imagine jailing doctors for every patient that died you would be out of doctors quite soon.