21–30 of 80 posts
This is a good write up Dan. Is there anything as an owner of a home router we can do to protect ourselves?
I'm trying to avoid sounding like Chicken Little here, but this article makes these actions very accessible. If you're someone who is just getting started toying with networks and security, it's likely that you haven't thought through what can happen if something you try actually works.
Nmap has a great page that discusses the ins-and-outs of the civil and legal issues involved with port scanning (a related activity). However, keep in mind that the guide linked here goes well beyond port scanning in to actually attempting, and presumably, gaining access to someone else's network. While the legality of port scanning is ambiguous, accessing someone else's network is not. If you land on the wrong guy's lawn, you can end up in a very expensive, and potentially dangerous place.
It feels like we need to include anonymity in the Internet Bill of Rights: 1. I have a right to read or write public information in an anonymous way. 2. I have a right to prevent you from reading or writing MY private information in an anonymous way, even if the intent is to obtain the right to exercise #1 in the process. 3. Using someone else's infrastructure/compute/power to enable #1 without breaking #2 requires y…
Your infrastructure will immediately be used to download or upload child pornography. If you're exceptionally unlucky, the FBI will come knocking and, if you're unable to provide them with a useful honeypot, you may risk legal consequences. If you're unable to prove your innocence (the request for the CP did come from your IP address, after all) then you may be very screwed.
I invite the community to toss around ideas about how to protect against this. I hypothesize that it's an unsolvable problem: if you enable strong anonymity, that anonymity will immediately be used for child porn.
One way to combat this would be to have some kind of credentialing, where you are able to generate credentials for the anonymous party to use. Assuming your infrastructure is set up as a Tor hidden service, then it's possible for them to use your infrastructure anonymously, and then you can revoke the credentials for individual violators.
However, under that scheme, your IP address(es) are shared by every user. 4chan will immediately ban all of them as soon as it becomes clear you're a proxy, for example.
It may still be worth exploring, but it needs some thought. Tor itself still doesn't have "endpoint bridges," that is, endpoints which aren't publicly listed. Meaning it's very easy to ban all of Tor, as far as I know.
Why release pre-made tools that allow anyone to cause harm? You could still explain the problem without them or show code snippets if you have to.
http://defcon.org/html/links/dc-archives/dc-19-archive.html#...
It feels like we need to include anonymity in the Internet Bill of Rights: 1. I have a right to read or write public information in an anonymous way. 2. I have a right to prevent you from reading or writing MY private information in an anonymous way, even if the intent is to obtain the right to exercise #1 in the process. 3. Using someone else's infrastructure/compute/power to enable #1 without breaking #2 requires y…
My concerns are:
As for anonymity: Internet protocols require addressing - without an address where to send packets back you can only communicate unidirectionally - sending information but not receiving any. Does being identified by an address still considered "anonymous"?
As for prevention: I'm not sure why need any sort of law to do so. Is there any case - except for law enforcement situations - where one's prevented from disclosing their private information?
Also, writing "requires you pay for it" may have bad consequences. For example, in Russia we had a copyright law that said quite similar thing - a statement that any software license must explicitly define payment process (or explicitly declare rights being provided free of charge) - and this led to issue with perceived legality of some FLOSS licenses that don't say anything about. To my knowledge, this hadn't been ever examined in a court and had been fixed in laws since then, but hope you see the point.
This is a good write up Dan. Is there anything as an owner of a home router we can do to protect ourselves?
Earlier quoted context omitted.
I leave my keys in the car sometimes when I'm running errands in my home town. I care a whole lot more about my network security at home than I do my car. It's just a car.
The reason to secure your network is a good reason to secure your car. Your network and your car can/will be used by bad guys to do bad things. You should care.