Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

One of the Most Alarming Internet Proposals I've Seen

lauren.vortex.com

Post reply on HN
Print view View original

61–70 of 95 posts

Re: One of the Most Alarming Internet Proposals I've Seen

#61

Post by Amezarak »

pktgen wrote: post #48
quotemstr wrote: post #32

Earlier quoted context omitted.

> http:// means that the endpoint has not been verified using the CA system and is using a self-signed certificate (and is thus trivially vulnerable to a MITM should certificate keys not be independently checked). Right. I understand that. The lack of certificate verification for the http scheme means that ISPs can MITM HTTP traffic with or without this proposal, just like they can with HTTP/1.1. So how does this pro…

> Really? That's a special kind of evil and should be illegal. Nah, no need to make it illegal. He's referring to AT&T's "GigaPower" gigabit service in Austin... the same service that's available from 2 other providers for the same, or cheaper, as what AT&T's charging for their data-mined bullshit. AT&T will have a fun time getting customers when Google and Grande point that out in their attack ads. :D

Unless Grande and Google eventually decide to do the same thing. Why not, from their perspective?

Re: One of the Most Alarming Internet Proposals I've Seen

#62

Post by MBCook »

bbatsell wrote: post #44
natrius wrote: post #36

Earlier quoted context omitted.

Can you elaborate on those AT&T plans?

It's part of GigaPower (their 300Mbps, soon-to-be 1Gbps FTTH service they rolled out quickly after the Google Fiber announcement). AT&T does a good job of obscuring it on their website[0], but if you click "See offer details", you'll find that the $70/month price is a "special" that requires you opting in to "AT&T Internet Preferences", which is their euphemism for DPI. It's not explained there, but if you opt out, y…

I pay AT&T about half that no-DPI price for 12mbit. I wouldn't sweat paying the extra to avoid DPI if I wanted the service.

Re: One of the Most Alarming Internet Proposals I've Seen

#63

Post by JoshTriplett »

rdl wrote: post #41

There are some kinda legitimate uses for this in certain environments -- enterprise DLP, various kinds of filtering, etc. Potentially even caching and stuff on the distant end of really weird network connections (when I go to Mars in ~30y, I'd like to have as much cached as possible, and converted to message-based vs. connection-oriented protocols). We have good enough workarounds for this right now (putting wildcard…

There are potentially legitimate (though still sketchy) reasons to MITM HTTPS traffic from a host configured to allow that (for instance, by trusting an organizational CA). There are no legitimate reasons to MITM HTTPS traffic without the host's knowledge.

Re: One of the Most Alarming Internet Proposals I've Seen

#64

Post by ams6110 »

stephenbez wrote: post #9
jstsch wrote: post #5

Crazy. If you want to use caching, just use HTTP for that content.

It's not that simple. If you are going to use HTTPS, you need to use it for all content on that domain. Otherwise if you load for example a large javascript file over HTTP, the attacker can just poison that file and control your whole page. Even if you loaded an image from the same domain, your credentials would sent sent as a cookie in plain text. You could use a separate domain for content as explained here: http:/…

credential-containing cookies should be set as secure.

Re: One of the Most Alarming Internet Proposals I've Seen

#66

Post by zmanian »

derefr wrote: post #60
bbatsell wrote: post #30

Earlier quoted context omitted.

HTTP/2 changes the meaning of the http:// scheme. All connections will now be TLS-encrypted. (Edit: Maybe not. See hobohacker below.) http:// means that the endpoint has not been verified using the CA system and is using a self-signed certificate (and is thus trivially vulnerable to a MITM should certificate keys not be checked out-of-band). The purpose is to provide confidentiality to the vast majority of traffic, e…

> This proposal's purpose is to ... expose all traffic using the http:// scheme to your ISP, exactly as it is today. Isn't that a semantic requirement of HTTP, though? Half of the "tech" in the HTTP/1.X spec is to allow for caching of resources and responses by proxies, allowing anyone between the client and server (e.g. your ISP) to act as a CDN. HTTPS/1.X effectively throws that away by doing end-to-end encryption.…

I find it difficult to imagine a world where Applications agnostic caching for encrypted sessions is possible.

I fully expect a world where application developers have services at their disposal for positioning assets closer to the end user with VM instance level isolation and security guarantees.

Transport level security is not likely to be enough for high value/sensitivity data in the long run but adding a bunch of new trusted parties to the system is going to be huge enabler for end user surveillance.

Re: One of the Most Alarming Internet Proposals I've Seen

#67

Post by nitrogen »

MBCook wrote: post #62
bbatsell wrote: post #44

Earlier quoted context omitted.

It's part of GigaPower (their 300Mbps, soon-to-be 1Gbps FTTH service they rolled out quickly after the Google Fiber announcement). AT&T does a good job of obscuring it on their website[0], but if you click "See offer details", you'll find that the $70/month price is a "special" that requires you opting in to "AT&T Internet Preferences", which is their euphemism for DPI. It's not explained there, but if you opt out, y…

I pay AT&T about half that no-DPI price for 12mbit. I wouldn't sweat paying the extra to avoid DPI if I wanted the service.

The point isn't whether one can afford it, but whether it's right.
Post reply on HN