Feeds

Saving private spying: IETF Draft reveals crypto-busting proxy proposal

'Explicit Trusted Proxy' would allow carriers to decrypt data to speed transmission

SANS - Survey on application security programs

A draft put forward to the Internet Engineering Task Force has drawn the ire of prominent privacy activist Lauren Weinstein as “one of the most alarming Internet proposals” he's ever seen.

The document that's upset Weinstein is this one, out of the HTTPBis Working Group and posted as an Internet Draft on 14 February 2014.

Entitled Explicit Trusted Proxy in HTTP/2.0, the standard proposes a mechanism by which an upstream provider – say an ISP – could get permission to snoop on decrypt user traffic for the purposes of caching.

Using proxies to cache traffic in the service provider network is unremarkable and uncontroversial: it's been normal practice for a long time. The end user benefit is better performance; the service provider benefit is a reduction in traffic over their upstream transit network links.

From that point of view, encryption is a pain in the neck: the service provider can't see into the encrypted traffic, which reduces the effectiveness of its caching strategy.

The Internet Draft has this to say:

“To distinguish between an HTTP2 connection meant to transport "https" URIs resources and an HTTP2 connection meant to transport "http" URIs resource, the draft proposes to 'register a new value in the Application Layer Protocol negotiation (ALPN) Protocol IDs registry specific to signal the usage of HTTP2 to transport "http" URIs resources: h2clr.'”

In essence, to try and protect their ability to cache, the authors of the standard propose that providers seek their customers' permission to decrypt their traffic (solely for the purposes of offering a better customer experience, naturally).

For some reason, Weinstein finds this proposal outrageous: “The proposal expects Internet users to provide 'informed consent' that they 'trust' intermediate sites (e.g. Verizon, AT&T, etc.) to decode their encrypted data, process it in some manner for 'presumably' innocent purposes, re-encrypt it, then pass the re-encrypted data along to its original destination,” he writes.

“The assumption that users can even be expected to make truly informed decisions about this seems highly problematic,” he writes, concluding “The concept of "trusted proxies" as proposed is inherently untrustworthy, especially in this post-Snowden era.”

Nor is he impressed with the authors' plea that a trusted proxy is better than having service providers get their proxying to work by a transparent man-in-the-middle attack: "Fundamentally this is like arguing that execution by lethal injection is less cruel than by electric chair. This may be strictly true, but the target of the procedure ends up dead either way," Weinstein told The Register.

It probably won't surprise the reader to know that the proposal is sponsored by AT&T. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.