Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ITU Approves Deep Packet Inspection Recommendation

itu.int

Post reply on HN
Print view View original

81–90 of 161 posts

Re: ITU Approves Deep Packet Inspection Recommendation

#81

Post by MichaelGG »

andrewcooke wrote: post #57
MichaelGG wrote: post #46

Earlier quoted context omitted.

IPSec by itself isn't going to really help. If they are doing DPI, they can MITM your IPSec connections. You still need a key management system, and I am not aware of any large-scale systems that are in-place to just "switch on" IPSec, that is, suddenly provide you with the certificates for every IP you want to connect to.

If they are doing DPI, they can MITM your IPSec connections. what, how? dpi just means looking at packets inside ip. it doesn't somehow grant you the ability to do man-in-the-middle attacks. deep packet inspection is already possible. that doesn't mean that tls or ipsec or any other protocol is broken. (i agree with the need for key management etc; it's just the quoted statement above that seems wrong).

You're right, it could be a passive inspection. But... if they are your ISP and have access to your packets, chances are they can rewrite and inject traffic too. Sure, they might need a bit more hardware to do so, but it's not exactly difficult.

But you're correct, DPI doesn't necessarily imply MITM capabilities.

Re: ITU Approves Deep Packet Inspection Recommendation

#82

Post by npsimons »

throwit1979 wrote: post #58
bstpierre wrote: post #55

This is not worthy of "the sky is falling" levels of panic. My experience with standardization efforts is that they generally run well behind the technology innovators. DPI has been around for a while. A DPI standard (or series of standards) out of the ITU will simply make public the baseline expectations of vendors and users of DPI systems. On the other hand, CALEA has been on the books for over 15 years, and that i…

Speaking as someone who has implemented [shallow] inspection/filtering and CALEA-type features on comms equipment for markets both in and outside of the US.) I'm not trying to flame you here, but I really must ask: How do you live with yourself? I know how trollish that sounds, but I seriously don't understand engineers who voluntarily work against our own ethos. It's not like this is an industry in which implementin…

No employee boycott is going to help, they'll just hire someone else. We won't see change until we start electing better leaders, or changing the system. Reduce the demand.

Re: ITU Approves Deep Packet Inspection Recommendation

#83

Post by mfukar »

jessaustin wrote: post #56
Jach wrote: post #33

Earlier quoted context omitted.

I think you're underestimating the limit to how fast DPI is or can get. The computations aren't complicated and like many kinds of algorithms you can trade space with time.

This statement might be correct (although I've never seen any evidence to support it), but it's still misleading because "forward the packet" is always going to require fewer resources than "read the packet, parse it using this set of algos, use the parse results to search your DB of shit you want to fuck with, optionally fuck with the packet, optionally forward the packet". An exception to this would be if you have…

That's how DPI was done in the 00's, yes.

Re: ITU Approves Deep Packet Inspection Recommendation

#85

Post by etherael »

beagle3 wrote: post #19

I think it is a good time to start incorporating DJB's NaCl into ... everything. And also run HTTP Everywhere in the meantime. And set up opportunistic IPSEC. Sad day. On a related note, I suggest we stop calling the heads of state and bureaucratic organizations like the UN "Leaders" and starting referring to them by their real self appointed role, "Rulers". Language shapes perception, and we've been using the wrong…

Ruler sounds a little too majestic, how about dictators? with or without the prefix "tin pot" depending on desire for brevity vs accuracy.

Re: ITU Approves Deep Packet Inspection Recommendation

#86

Post by Nrsolis »

svachalek wrote: post #80
Nrsolis wrote: post #71

Earlier quoted context omitted.

Allow me to add my $0.02 to this discussion. I've implemented CALEA type features for a major ISP. I did it because it was the law that we implement it. I'm generally in favor of following the law. Mind you, CALEA doesn't do anything that couldn't already be done with the law. And you get more protections via CALEA than you'd get otherwise. For one thing, there are warrants that are delivered to a judge for review wh…

I honestly don't see how voluntary self-disclosure on FB or anywhere else has anything to do with privacy rights.

It matters if you're trying to gain popular support for your political positions. The average joe doesn't see why wiretapping has anything to do with them. They don't understand or care.

And those people vote. Sometimes.

Re: ITU Approves Deep Packet Inspection Recommendation

#87

Post by bediger4000 »

gknoy wrote: post #60
jeremiep wrote: post #41

Earlier quoted context omitted.

Is it me or "National Security" really means National Insecurity? Where's freedom in the illusion of safety?

It seems to be a balancing act. Too little secrets, and your law enforcement has a very hard time detecting threats before they happen. When people use VOIP instead of telephone lines, it's very hard to wiretap Dangerous People (and non-dangerous people). It's easy to find ways that such things make it easier for people whose job, goals, sworn duties, etc are to Protect us, or our nation. Many people join the armed s…

There are so very, very few Dangerous People, and so many, many non-dangerous people. The latter class also includes people with at least some money, so en masse, the non-dangerous people constitute a large amount of money. I reckon that an overwhelming majority of the wiretaps are to make money, rather than to catch Dangerous People, statistically speaking.

Re: ITU Approves Deep Packet Inspection Recommendation

#88

Post by signa11 »

bstpierre wrote: post #55

This is not worthy of "the sky is falling" levels of panic. My experience with standardization efforts is that they generally run well behind the technology innovators. DPI has been around for a while. A DPI standard (or series of standards) out of the ITU will simply make public the baseline expectations of vendors and users of DPI systems. On the other hand, CALEA has been on the books for over 15 years, and that i…

well, standardization or not, things like these have been going on for years (http://www.wired.com/science/discoveries/news/2006/05/70908). standardization would/should just level the playing field amongst various equipment vendors.

Re: ITU Approves Deep Packet Inspection Recommendation

#89

Post by jholman »

Jach wrote: post #33
kcbanner wrote: post #27

Earlier quoted context omitted.

I think he is referring to the fact that significant CPU resources are required for DPI and if the DPI can't keep up, things will slow down.

I think you're underestimating the limit to how fast DPI is or can get. The computations aren't complicated and like many kinds of algorithms you can trade space with time.

I think you're underestimating how much traffic can be out there.

DPI requires decoding application-layer protocols. This requires many layers of decoding. That's all well and good for one client (feature phones happily load web pages, after all), but to do it inline at the router means the router needs to be as powerful as the sum of all of the networking hardware of the hosts it routes to.

Source: at my last job, we were working on fixes for security holes that could cost billions of dollars of damages per incident, and the fixes were solvable in software, but we couldn't persuade customers of the value of buying beefy enough network equipment to actual block the attacks. Mind you, I didn't run any numbers myself on the cost of the hardware; that's just what my colleagues said.

Re: ITU Approves Deep Packet Inspection Recommendation

#90

Post by signa11 »

ffk wrote: post #30
MichaelGG wrote: post #17

Earlier quoted context omitted.

How is DPI related to needing more bandwidth needed per base station or residential area?

Other restrictions besides bandwidth exist. For example, DPI requires more CPU and memory, which are some of the major constraints of networking equipment, especially when the equipment resides at the edge (borders) of a Tier 1 ISP.

from (http://en.wikipedia.org/wiki/Narus_(company)) we have the following "A single NarusInsight machine can monitor traffic equal to the maximum capacity (10 Gbit/s) of around 39,000 DSL lines or 195,000 telephone modems. But, in practical terms, since individual internet connections are not continually filled to capacity, the 10 Gbit/s capacity of one NarusInsight installation enables it to monitor the combined traffic of several million broadband users."

also if you have not already read this (http://www.wired.com/science/discoveries/news/2006/05/70908) earlier, doesn't hurt to read once again.

Post reply on HN