Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is BGP safe yet?

isbgpsafeyet.com

Post reply on HN
Print view View original

11–20 of 98 posts

Re: Is BGP safe yet?

#11

Post by badgersnake »

chrismustcode wrote: post #6
nemomarx wrote: post #2

This actually shows pretty good coverage for this feature, it seems to me. The big American isps do it, the mobile ones do too... How many major isps would we want to implement it to be "safe" and what would that look like? Is this a regional thing? They've only listed 4 unsafe ones on the site and that doesn't seem like a major issue, but maybe they're very large somewhere.

I'm on sky in the UK which is marked as not safe due to no RPKI. It's not on the list so imagine there is a fair few missing, would be neat to have a table you could filter by country, provider type (cloud/isp etc) based on real results from users. edit: there's a show all button to expand the table

I get the same result for A&A, but frankly I trust them more than some random site with (apparently) an axe to grind.

Re: Is BGP safe yet?

#13

Post by NewsaHackO »

> A BGP hijack occurs when a malicious node deceives another node, lying about what the routes are for its neighbors. Without any security protocols, this misinformation can propagate from node to node, until a large number of nodes now know about, and attempt to use these incorrect, nonexistent, or malicious routes.

But with HTTPS, they wouldn't be able to actually pose as another website, just delay/black hole the request so it doesn't reach its goal target, right? From the figure, it makes it seem like a person can use BGP to spoof a website and make a user visit a phished website, but that's not right, correct?

Re: Is BGP safe yet?

#15

Post by maltalex »

RPKI doesn't make BGP safe, it makes it safer. BGP hijacks can still happen.

RPKI only secures the ownership information of a given prefix, not the path to that prefix. Under RPKI, an attacker can still claim to be on the path to a victim AS, and get the victim's traffic sent to it.

The solution to this was supposed to be BGPSec, but it's widely seen as un-deployable.

Re: Is BGP safe yet?

#16

Post by benjojo12 »

wussboy wrote: post #14
commandersaki wrote: post #9

I think the test for BGP is Safe is when we stop using it and instead use SCION: https://en.wikipedia.org/wiki/SCION_(Internet_architecture) .

Why hasn't this happened?

Because SCION is mostly said as a joke in the more serious carrier world.

SCION is practically speaking proprietary, and has 1 and maybe a half implementations. I have a laundry list of real problems with SCION but SCION feels like one of those entities that would get quite legal-ey if discussed publicly.

Re: Is BGP safe yet?

#17

Post by dsr_ »

wussboy wrote: post #14
commandersaki wrote: post #9

I think the test for BGP is Safe is when we stop using it and instead use SCION: https://en.wikipedia.org/wiki/SCION_(Internet_architecture) .

Why hasn't this happened?

Because BGP works, is understood, and has been debugged by thousands of people and billions of sessions between dozens or hundreds of implementations.

So the benefit of changing out all that infrastucture needs to be much higher than the cost.

Re: Is BGP safe yet?

#18

Post by dsr_ »

NewsaHackO wrote: post #13

> A BGP hijack occurs when a malicious node deceives another node, lying about what the routes are for its neighbors. Without any security protocols, this misinformation can propagate from node to node, until a large number of nodes now know about, and attempt to use these incorrect, nonexistent, or malicious routes. But with HTTPS, they wouldn't be able to actually pose as another website, just delay/black hole the…

If you can inject arbitrary malicious routes, you can make ACME requests for a new cert.

Re: Is BGP safe yet?

#19

Post by infogulch »

NewsaHackO wrote: post #13

> A BGP hijack occurs when a malicious node deceives another node, lying about what the routes are for its neighbors. Without any security protocols, this misinformation can propagate from node to node, until a large number of nodes now know about, and attempt to use these incorrect, nonexistent, or malicious routes. But with HTTPS, they wouldn't be able to actually pose as another website, just delay/black hole the…

Well if they can deceive certificate authorities that implement the ACME protocol like LetsEncrypt, then they could get a certificate for your site with the HTTP-01 challenge, see the paper Using BGP to Acquire Bogus TLS Certificates (2017) [1]. That paper suggested a mitigation they call Multiple Vantage Point Verification, which has already been implemented [2].

[1]: https://petsymposium.org/2017/papers/hotpets/bgp-bogus-tls.p...

[2]: https://community.letsencrypt.org/t/validating-challenges-fr...

Re: Is BGP safe yet?

#20

Post by pigggg »

commandersaki wrote: post #9

I think the test for BGP is Safe is when we stop using it and instead use SCION: https://en.wikipedia.org/wiki/SCION_(Internet_architecture) .

SCION is generally considered snake oil within the network operator community. Its weird single vendor for profit company that ships it's software, the fact that no router hw asic fwding supports what they want to do and then the general scummy inclusion of block chain / crypto as well as some "green washing" for PR hype.

Sure the swiss have their toy but no one is taking it seriously.

Post reply on HN