Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

White House asks agencies to step up internet routing security efforts

reuters.com

Post reply on HN
Print view View original

31–40 of 57 posts

Re: White House asks agencies to step up internet routing security efforts

#31

Post by hnuser123456 »

growse wrote: post #12
throwaway63467 wrote: post #8

It’s interesting how easy it is to get someone to announce your prefixes, it often just takes a credible letter of authority, in my understanding all processes rely on manual due diligence. If an organization e.g. has a valid RIPE database entry that it can announce a given prefix under its own ASN I could set up an account at a cloud provider like Vultr using the business data of said company, charge it with 10 USD…

> what I did for my own organization and in my RIPE data there’s nothing that specifically says Vultr can announce my prefixes In RIPE, each as-num should list out a policy of which other ASNs can import/export routes from that ASN. I think there should also be a route/route6 object. Do vultr not check/enforce this? (Other providers do).

They do not validate this and it's probably part of their appeal.

Re: White House asks agencies to step up internet routing security efforts

#32

Post by _djo_ »

aucisson_masque wrote: post #21

> The White House said on Tuesday it wants federal agencies to boost internet routing security on networks in the face of concerns raised by U.S. officials about China's ability to divert internet traffic. Isn't that funny when the white house has been exposed secretly tapping every single non American (Chinese included) and American online activity, phones calls, mails, etc. I'm not saying the Chinese should be able…

Do you really think that only the US has been doing international electronic espionage?

Russia (and before them the Soviets), the Chinese, the French, the Brits, and many others have been doing it for decades.

This isn’t a response from China to US revelations, it’s a continuation and escalation of a practice they’ve been doing all along.

Re: White House asks agencies to step up internet routing security efforts

#33

Post by motohagiography »

it looks like route views and bgpmon got embraced, extended, and largely extinguished by cisco? I've been out of this loop for a long time. is there a free service around for monitoring tables or something you can connect an openbgpd instance to for doing analysis?

Re: White House asks agencies to step up internet routing security efforts

#34

Post by tptacek »

AnthonyMouse wrote: post #23
unethical_ban wrote: post #9

Earlier quoted context omitted.

Yes. Edit: SOX, HIPAA, NIST CSF. Government is not always bad.

These aren't great examples. HIPAA is extraordinarily expensive, meanwhile healthcare providers continue to have abominable security because compliance is offloaded to a "compliance team" who comes around once in a while to check boxes without really understanding the system, which is managed by other people who don't really understand HIPAA. This is one of the reasons security in large organizations is hard. Bureauc…

HIPAA is not extraordinarily expensive.

Re: White House asks agencies to step up internet routing security efforts

#35

Post by rustcleaner »

JumpCrisscross wrote: post #30
AnthonyMouse wrote: post #19

Earlier quoted context omitted.

There's a simple way to tell if 2FA is being used for security or to harvest phone numbers: Does the site let you use an email instead of a phone number? If you can't use an email, the purpose is to harvest phone numbers.

> Does the site let you use an email instead of a phone number? Or TOTP.

TOTP is so good, it should be treated equally to or superior than phone number or e-mail as a requirement, by regulation, as an option for any site conducting business in US Dollars. E-mail is terrible for secure authentication. Banks have had plenty of time to implement this and haven't. TOTP can eliminate the password altogether, and make login usernames long-lived long TOTP or HOTP codes and I have just solved the terrible passkey problem!

Re: White House asks agencies to step up internet routing security efforts

#36

Post by codebje »

xyst wrote: post #4
throw0101c wrote: post #2

This article leans more towards a general audience. For more a tech-leaning audience, perhaps see: * https://arstechnica.com/tech-policy/2024/06/fcc-pushes-isps-... * https://www.techspot.com/news/104590-white-house-declares-bg... * https://www.securityweek.com/white-house-outlines-plan-for-a... WH PR (linked to by Reuters): > While there is no single solution to address all internet routing vulnerabilities, the road…

So ROA/ROV are for preventing prefix hijacking and IANA will personally issue a certificate to verify organization owns ASN. But what impacts does this have on performance? Great we solved hijacking issue. But this other ASN which used to be a preferred route doesn’t use ROA/ROV (yet or refuses). Now traffic reroutes to a less efficient path?

> But what impacts does this have on performance? Great we solved hijacking issue. But this other ASN which used to be a preferred route doesn’t use ROA/ROV (yet or refuses).

No performance impact: a routing table is a very (ahaha) binary thing, it takes a destination address and does a longest prefix match search in a table to find the next hop interface, to which it routes the packet.

Route validity is considered (alongside a bunch of other routing policy inputs) when constructing the table, not when a packet arrives.

Re: White House asks agencies to step up internet routing security efforts

#37

Post by petesergeant »

ddtaylor wrote: post #11
kjellsbells wrote: post #10

Earlier quoted context omitted.

There are many, but perhaps the second part of your question is invisible, but is the meaningful one: "in a short timeframe" or "at reasonable cost" or something. People like to dump on government but they can move the acceptable window/best practice to a place that corps would not have gotten to by themselves. Crypto is one, OWASP springs to mind, etc. But the government is not a homogeneous monolithic entity and it…

I think there is a good argument to be made that many companies would have created a better infrastructure by now if the government wasn't involved.

I think the fact that most of the world has decent payment systems (eg UK FPS) now due to government mandates, where the US notably does not, is a decent counterpoint.

Re: White House asks agencies to step up internet routing security efforts

#38

Post by vitus »

codebje wrote: post #36
xyst wrote: post #4

Earlier quoted context omitted.

So ROA/ROV are for preventing prefix hijacking and IANA will personally issue a certificate to verify organization owns ASN. But what impacts does this have on performance? Great we solved hijacking issue. But this other ASN which used to be a preferred route doesn’t use ROA/ROV (yet or refuses). Now traffic reroutes to a less efficient path?

> But what impacts does this have on performance? Great we solved hijacking issue. But this other ASN which used to be a preferred route doesn’t use ROA/ROV (yet or refuses). No performance impact: a routing table is a very (ahaha) binary thing, it takes a destination address and does a longest prefix match search in a table to find the next hop interface, to which it routes the packet. Route validity is considered (…

I think you missed the parent commenter's point.

The purported performance hit wouldn't be from the propagation delay on any given router, but rather from shifts in traffic resulting in a longer path.

In practice, I suspect there will be very little impact for most traffic, since typical aspath lengths are, like, 2. (Mostly, direct peering between CDNs and ISPs if the data isn't cached within the ISP network to begin with)

edit for source:

> The average AS path length in a well-developed content network is about 1. Maybe 1.1.

https://youtu.be/gxO73fH0VqM?t=1387

Re: White House asks agencies to step up internet routing security efforts

#39

Post by CuriousCosmic »

petesergeant wrote: post #37
ddtaylor wrote: post #11

Earlier quoted context omitted.

I think there is a good argument to be made that many companies would have created a better infrastructure by now if the government wasn't involved.

I think the fact that most of the world has decent payment systems (eg UK FPS) now due to government mandates, where the US notably does not, is a decent counterpoint.

worth noting that the Federal Reserve has gradually started up programs that now basically handle all the different types of inter bank transfers in the US.

Those programs have now out competed every corporate service in the space and are either the main clearing house/provider or the second main provider in each type of US bank transfer.

They now have FedNow which is a "next gen" for these types of transfer systems and over the course of the next few years to the next decade it'll probably eat all the other systems as well as the many corporate offerings as well.

https://en.wikipedia.org/wiki/Fedwire

https://en.wikipedia.org/wiki/FedACH

https://en.wikipedia.org/wiki/FedNow

Re: White House asks agencies to step up internet routing security efforts

#40

Post by nwav »

aucisson_masque wrote: post #21

> The White House said on Tuesday it wants federal agencies to boost internet routing security on networks in the face of concerns raised by U.S. officials about China's ability to divert internet traffic. Isn't that funny when the white house has been exposed secretly tapping every single non American (Chinese included) and American online activity, phones calls, mails, etc. I'm not saying the Chinese should be able…

I don't understand why IT laypeople so often appeal to moral hypocrisy in matters of internal state interests: The basis for national security recommendations is not fairness for all human beings. Yes, if you're not a citizen, you are discriminated against. Sometimes, even if you are. That's the case for every nation. It also has limited bearing on whether a security policy is in the government's self-interest.
Post reply on HN