Slashdot Mirror
Safe and Insecure?
JoeCotellese writes "Can making your network insecure actually improve your security? That's the question asked in this story running in Salon. The author makes the case that by 'making my Internet connection available to any and all who happen upon it, I have no way to be certain what kinds of songs, movies and pictures will be downloaded by other people using my IP address. And more important, my ISP has no way to be certain if it's me.'"
Bacon grease cures heart disease!
Unknown host pong.
"Last week, I turned off all the security features of my wireless router. I removed WEP encryption, disabled MAC address filtering and made sure the SSID was being broadcast loud and clear. Now, anyone with a wireless card and a sniffer who happens by can use my connection to access the Internet. And with DHCP logging turned off, there's really no way to know who's using it."
I'd have read the whole thing, but I was morally repelled by the salon.com ad policy. Anyway, this concept seems to be some perverted cousin of "security by obscurity" -- only this has less to do with protecting your security and more to do with having a way out when someone comes knocking on your door.
Unfortunately, I think this only applies when you *don't do it on purpose*. From my point of view, if you design a network solely for the purpose of relieving yourself of responsibility for what traverses your network, you are pretty much screwed once you get to court. This reeks of the "I accidentally did it on purpose" defense, and isn't likely to fly with any judge that has even a portion of a clue.
dmiessler.com -- grep understanding knowledge
That's not improving your security. That's improving your privacy (via anonymity) at the expense of your security.
Or am I the only one who has terms and conditions which say that I am responsible for everything that passes over my connection?
Wishing something doesn't make it so.
Somebody forgot to read the TOS of their ISP... because absolutely ever ISP out there has something to this effect in thier TOS: As the person who pays the bill, you're responsible for keeping the Internet connection you're buying to yourself and people who you trust with it. The reason why they're warning you to do that is because if you allow your connection to fall into "enemy hands", the usage that goes over your wire will be
By choosing to run the "notoriously vulnerable technology", as the author admited in his confession letter, he admitted that he knowingly chose a piece of technology that could be exploited yielding his internet equipment making a request on behalf of somebody unknown. That's nice... you just gave that unknown person the gift of a liability shield at your expense.
As I just posted last thread, annonymity these days is really achieved by somebody else who had the chance to know who you are intentionally failing notice or promising not to tell. The thing is, that other person is taking on the liablity for what you do.
How nice of you to pay his MPAA/RIAA verdict bill for him, you'll be a hero to copyright pirates everwhere. I'm sure they'll be excited to learn there's still people dumb enough to fall for this trick still out there.
You also have no idea what kind of FTP server your computer has become, what kind of child porn people are downloading, how much spam you're forwarding. This doesn't seem like a very good idea to me.
Karma: pi (Mostly due to circular reasoning in posts).
I never know who might get shot or when! And the police would never find out if it was me doing the shooting!!
This is brilliant. I'm in total awe.
It is doubtful you could qualify as a type of common carrier. If anything, you may increase your odds of being liable because you may be held responsible for what others do on your connection.
It would be interesting to see how this would play out. The closest analogy I can think of would be automobiles. If you allowed someone else to use your car, you may be held liable for damages they cause while they are driving it. As far a criminal activity, you may be targetted if your car is identified as taking part in a crime, though you have a pretty good chance of being found innocent if you can prove you weren't driving the car.
Not perfect, but close. The idea sounds good though.
. 62,400 repetitions make one truth -- Brave New World, Aldous Huxley
I'm not deliberately opening my network to hackers and miscreants bent on downloading copyrighted material. I'm simply choosing not to secure it. That's no different from the millions of people who haven't installed anti-virus software and the millions more who don't keep theirs up to date.
But he IS deliberately opening his network to these people:
Last week, I turned off all the security features of my wireless router. I removed WEP encryption, disabled MAC address filtering and made sure the SSID was being broadcast loud and clear.
If he didnt have them enabled in the first place, then I might have agreed with his statement, but this is nothing like the "millions of people who havent installed anti-virus software", or the "millions more who don't keep theirs up to date". Those people dont intentionally install said protection and then disable it.
And more important, my ISP has no way to be certain if it's me.
And how is this going to matter? The ISP is renting YOU the connection, so its arguably your own responsability for the traffic passing through it. Your landlord might have something to say if you left your front door open to all who might be passing, and drug dealers take up residence. Id love to see his line rentals terms and conditions, they will amost certainly forbid what this guy is doing (intentionally sharing his connection with third parties).
If it ever comes down to a lawsuit, who can be certain that I was the offender? And can the victim of hacking be held responsible for the hacker's crimes?
Theres no hacking (cracking) going on here, the networks wide open. And there are such laws as accessory to a crime, which if you are doing this wilfully, then Id almost certainly say you were.
I hope this guy took legal advice about this, and about his stance regarding correspondance with Comcast in the future, because from where I can see, he may be on the shakiest legal ground. This article is pretty lame imho.
and people wander in and out. So, it's not my fault that there are 12-year olds drinking 40s on the front porch. No way is it my fault someone's selling crack in the living room, or that someone drowned in the pool.
Ultimately, if you knowingly leave your computer open to mask your own poor behavior, you won't get off, you'll just get busted for all of it, and then get busted for knowingly providing a venue for this.
Not only does he not have the courage to stand up for himself, he's causing trouble for the rest of us. People can use his connection to send out those penis-enlarging e-mails to the rest of us. And as mentioned above, the FBI isn't likely to be amused by his defense if he becomes the hub for a child-porn ring.
"Security through apathy". Yeah, right.
Unfortunately, I think this only applies when you *don't do it on purpose*. From my point of view, if you design a network solely for the purpose of relieving yourself of responsibility for what traverses your network, you are pretty much screwed once you get to court.
The prosecution must prove that you committed a crime, not that you tried to make their job difficult. They can't convict you for something just because you tried to obsfuscate your actions or gain plausible deniability.
As the article title says, "safe and insecure." The author has decreased the risk he faces from lawsuits launched by the RIAA, MPAA, BSA, SPA, etc., in exchange for reduced network security.
Where he is in grave danger is from his ISP, which could cancel his account in a moment should they get a DMCA complaint, spam complaint, hacking complaint, DoS complaint, or virus complaint tied to his IP address. The courts have to give him due process. His ISP does not.
So that's where this all came from.
If you are providing wireless network access for your neighborhood, houseguests, or even patrons in your restaurant, then you are a carrier and protected. Just in case you were not sure, IANAL.
So the question really is if you are in violation of your Terms of Service or not. My experience has been that most cable Internet providers restrict your usage to you and your household - no operating servers (e-mail, web, etc.) This is because of the shared bandwidth nature (bus topology) of the connection. If you are consuming mass quantities, then your neighbor's connection slows down. Same is true of most satellite systems. I am sure there are some satellite and cable ISP's that offer guaranteed bandwidth, so obviously they are the exception to my comments.
xDSL on the other hand is guaranteed bandwidth (star topology). In essence you have a dedicated pipe between you and the central office. Granted if you could consume all the bandwidth at the CO then you would slow everyone else down, which is why they throttle you and have a really fat pipe there. Now xDSL typically allows servers and other activities that could result in greater bandwidth consumption because you cannot degrade the performance of your neighbors connection.
So to sum up, it would seem that this strategy would work to defray suits from MPAA, RIAA, etc., and if you were running xDSL it may even be allowed under your TOS. But, your TOS probably says you are responsible for anything that goes over your pipe. This means you are responsible to your ISP, not to anyone else. So if your ISP says "Hey, you can't do that!" then they might pull your plug. It would seem to me that loosing your ISP and having to switch to one of the competitors would be much less of a inconvenience then being sued by RIAA, MPAA, SCO, etc.
Bottom line, if you think there is a chance that incriminating traffic might take place on your connection (by you or someone else) then you may improve your odds of claiming it wasn't you by adopting this strategy. But when you are trying to download game patches or some other large download, and it is taking a lot longer then you expected, remember that is the price you pay for freedom in this country.
What you need is a router that provides bandwidth priority to some connections and not others (I forget the term), and also that partitions the public portion of your personal network off from the private portion. And instead of claiming ignorance, claim you are a nice guy who just wants to help out your neighbors, houseguests or restaurant patrons.
This is in no way an endorsment or advocation for any of the actions outlined in this comment, the comments of others, or the original news post. It is just an observation.
"Anything is possible with enough programmers, time and pizza." (Substitute caffeine for time as needed.)