Slashdot Mirror

← Back to Stories (view on slashdot.org)

AT&T's Plan to Play Internet Cop

Posted by Zonk on from the sorry-i-was-surfing-too-fast-occifer dept.

Ponca City, We Love You writes "Tim Wu has an interesting (and funny) article on Slate that says that AT&T's recent proposal to examine all the traffic it carries for potential violations of US intellectual property laws is not just bad but corporate seppuku bad. At present AT&T is shielded by a federal law they wrote themselves that provides they have no liability for 'Transitory Digital Network Communications' — content AT&T carries over the Internet. To maintain that immunity, AT&T must transmit data 'without selection of the material by the service provider' and 'without modification of its content' but if AT&T gets into the business of choosing what content travels over its network, it runs the serious risk of losing its all-important immunity. 'As the world's largest gatekeeper,' Wu writes, 'AT&T would immediately become the world's largest target for copyright infringement lawsuits.' ATT's new strategy 'exposes it to so much potential liability that adopting it would arguably violate AT&T's fiduciary duty to its shareholders,' concludes Wu."

51 of 272 comments (clear)

  1. How to beat it by ProteusQ · · Score: 5, Funny

    We all send copyrighted emails to one another under a license that does not allow AT&T to retransmit the contents without written permission. We then start a class-action lawsuit. IANAL, but that ought to slay the dragon if the judge agrees that the case has merit.

  2. we've already done this to death by petes_PoV · · Score: 2, Informative
    Last time this story came up (last week?) there were a lot of comments about common carrier status and how this proposal could endanger that.

    Nothing new here

    --
    politicians are like babies' nappies: they should both be changed regularly and for the same reasons
    1. Re:we've already done this to death by Zerth · · Score: 4, Funny

      > Guess it's back to carrier pidgins?

      I don't know about you, but I much prefer using carrier creole.

    2. Re:we've already done this to death by Anonymous Coward · · Score: 5, Interesting

      about common carrier status

      And as many replies stating that AT&T's internet service is not common carrier, dammit! They lobbied hard to make sure it was that way, because maintaining common carrier status is fucking expensive (what, you think having a dialtone every single time you pick up your phone without having a window where the phone company can say "ok! nobody make a call, we're going to reboot some switches!" is cheap?!), and because violating the common carrier rules doesn't mean you "lose common carrier status", it means you go to jail. Think about that, some guy at the post office reading your mail doesn't mean the post office stops being a common carrier, it means the guy goes to jail.

      This is why they have to have special laws with exceptions written just for them that protect them from being sued!

    3. Re:we've already done this to death by Cheerio+Boy · · Score: 5, Informative

      Does Speakeasy offer DSL in your area? That's what I did until I could go with RCN. Speakeasy DSL costs more, but they have highly technically skilled customer support people, an expectation that their customers run servers, and a rock-solid network. I highly recommend them.

      Your packets will still likely go through an AT&T network and thus still be inspected.

      Because AT&T is so large this will affect a good chunk of the Internet - especially US networks.

      Hell their backbone runs the entire length of the us.

      This map is from 2000 so it's probably much more invasive now:

      http://www.cybergeography.org/atlas/att_backbone_large.gif
      --

      "Bah!" - Dogbert
    4. Re:we've already done this to death by Tetsujin · · Score: 5, Funny

      Nah, carrier Swallows. I'll bet she does... Oh yes...
      --
      Bow-ties are cool.
    5. Re:we've already done this to death by chad.koehler · · Score: 2, Informative

      The way it is worded they can "inspect" data without losing their common carrier status -- as long as they do not filter it. So in essence, they can "inspect" the data, and report end users to the proper authorities -- without denying service. They keep their common carrier status AND make the media companies happy. It's a win-win (for them, at least).

      The real challenge is "inspecting" packets in real-time with no degradation of service... That would take some powerful hardware.

    6. Re:we've already done this to death by Anonymous Coward · · Score: 2, Insightful

      and this is why corporations should not have the same rights as people.
      you can't put AT&T in jail. but you should be able to hold the people who run AT&T personally responsible for anything illegal the corporation does.

  3. Encryption... by eggoeater · · Score: 4, Insightful

    Aside from the problem "fiduciary duty", it's also pointless.
    True, most traffic is not encrypted, but with encryption technology more accessible than ever I think that the whole effort will be a waste of resources.

    I can imagine whole sub-networks cropping up that uses VPN, exchanging traffic with immunity to AT&T's traffic analysis.

    --
    $7.95/mo, 200 GB disk, 2TBxfer, MySQL, PHP, RoR.
    1. Re:Encryption... by AKAImBatman · · Score: 5, Informative

      that doesn't work, all they have to know is that some ip address is serving up copyrighted material on a given port and shut of that port for that server.

      I think you misunderstand how a Virtual Private Network works. The first thing you must understand is that there is not spoon^W ports. Once you realize that there are no ports, then you only need to route packets over a secure channel that's indistinguishable from valid business. Is this user networking with his small-business employer, or a pirate spreading illegal wares? Impossible to tell from the traffic itself.
      --
      Javascript + Nintendo DSi = DSiCade
    2. Re:Encryption... by Shakrai · · Score: 2, Interesting

      Impossible to tell from the traffic itself.

      Don't most (all?) VPN systems rely on public-key cryptography and thus vulnerable to man in the middle attacks? It might not be possible to do a MITM attack against your VPN to work (presumably you have some system in place to verify the encryption keys) but how are you going to prevent it on a p2p network when you have no way to verify the keys of the hosts you are communicating with? A piratebay-type certificate registry hosted in a country that isn't friendly to copyright law? What happens when they block access to it?

      --
      I want peace on earth and goodwill toward man.
      We are the United States Government! We don't do that sort of thing.
    3. Re:Encryption... by kebes · · Score: 4, Interesting

      If AT&T actually goes so far as to automate man-in-the-middle and spoof all cryptographic key exchanges so that they can decrypt and analyze encrypted content... things are going to get interesting.

      For one thing, I imagine financial institutions are not going to take kindly to that kind of action, and could probably mount a very successful class-action lawsuit.

      The thing about encrypted traffic is that it could be anything, from confidential business data, to financial transactions, to launch-codes, to a screener of a new movie. As crazy as they are, AT&T will not start playing that game.

      The blocking of IP addresses is a more likely counter-attack to widespread encryption, but even then solutions exist (e.g. the TOR network allows routing to servers that have no "non-tor" domain name, so the real IP address is never exposed). It will quickly become a ridiculous arms race...

    4. Re:Encryption... by rudeboy1 · · Score: 4, Insightful

      I wouldn't sweat it. If this sort of policy comes to pass, I'm sure it will take all of about a month for Azureus or whoever to write a modification to the BitTorrent concept, allowing for VPN style connections between peers. Yes, I imagine this would be complicated to set up from a programming stance, but releasing a patch with most largely available BT clients would immediately transform BT as we know it, and would send all these pro-DRM groups back to the drawing board for a while. IANAP, but in concept this seems to be the next logical step anyway.
      This is the nature of the internet. The people that innovate in this field are problem solvers, often with a penchant for resiting authority and control. Whenever something like this happens, no matter how detailed or iron-clad the barrier is, someone eventually (or rapidly, more often than not) finds a way to overcome it. Bad code on CDs cause PCs to be unable to read them? Take a felt tip pen and mark the last 1/8" of the disk. DRM protection on DVDs? Here's about 2 MB of code that will overcome any known keys. It's all a matter of time.

      --
      Raging in an online forum won't do anything for the world around you. To see change, you must take action.
    5. Re:Encryption... by Anonymous Coward · · Score: 2, Interesting

      I can imagine whole sub-networks cropping up that uses VPN, exchanging traffic with immunity to AT&T's traffic analysis. Stop imagining. It's small, but perfectly formed and functional. Please mod up.
    6. Re:Encryption... by Shakrai · · Score: 2, Informative

      This was written, and then modded "insightful" by somebody who does not understand how encryption.

      I know that ssh takes steps to store the public keys and warn you if they've changed. Why would it bother doing that if man-in-the-middle attacks aren't possible?

      Party A contacts party B, and gives out its public key. This can be completely, 100% "in the clear". Party B replies with its public key. Party A uses party B's public key to encrypt a random number, and sends it to Party B. Party B decrypts this random value, and re-encrypts this random value with Party A's public key, sending it on to Party A.

      My understanding is as follows:

      Party A contacts Party B and sends it's public key. Party E (evil guy) intercepts this public key and replaces it with his own. Party B replies with his public key, which is also intercepted and replaced. Party A and B are now "encrypting" the traffic with the public key provided by Party E, whom decrypts it, and re-encrypts it with the original public keys provided by A and B prior to forwarding that traffic on to them. Party E now has access to the complete conversation between A and B whom are none the wiser, unless they have an outside method of verifying the keys they received.

      I fail to see how an exchange of a random number stops this, when Party A never actually received Party B's key to begin with, because said key was replaced by Party E.

      --
      I want peace on earth and goodwill toward man.
      We are the United States Government! We don't do that sort of thing.
    7. Re:Encryption... by houstonbofh · · Score: 2, Informative

      Mind pointing out which section of that answers my question, because I don't see it? If you are transferring the keys across the internet then they are vulnerable to being intercepted and replaced with a different key. I fail to see how you stop this without a trusted source that can sign (or otherwise vouch for) the encryption keys used for that session.

      How about the first paragraph... "Out-of-band is a technical term with different uses in communications and telecommunication. It refers to communications which occur outside of a previously established communications method or channel." Seeing as how this is a discussion about AT&T messing with stuff in the communication channel, I would think it was obvious. OOB communications would be a thumb drive, shipping a configured router, telling you the shared key over the phone (not AT&T phone), or a properly encrypted e-mail.

    8. Re:Encryption... by ashridah · · Score: 2, Insightful

      This is actually pretty easy. We already have a 'trusted' single point here. The Tracker.

      If the tracker starts using SSL, and has valid certificates, then there's no risk of man in the middle there (assuming the CA hasn't been compromised, and let's face it, we could easily set up our own for this purpose...). If we extend the tracker protocol to handle the key exchange for us as well, then we have a *secure* key exchange system, that AT&T cannot intercept, filter or screw with, without being relatively obvious.

      Then we just have a per-peer key that we generate (even if it's relatively weak, it'd still be far more effort than could be reasonably expended to decypher it by brute force), then even if ATT attaches to the same tracker, they STILL can't get at the content.

      The main problem here is that the tracker becomes more cpu-heavy, and trackers already tend to be fairly over utilized

      ash

    9. Re:Encryption... by cheater512 · · Score: 2, Interesting

      It would be nearly impossible to pluck someone's public key from the terrabytes of data they process and then swap it with their own.

      Looking for copyrighted material is one thing. Grabbing anything which could be a public key is another.

  4. don't like the law? They'll change it by axus · · Score: 3, Interesting

    AT&T obviously has some deep government connections, they've got senators thinking that what's good for AT&T is good for America. They wrote the previous law, they can unwrite it. The trick will be how to include themselves and exclude their competitors... and I'm sure they'll try to stick people with open wifi ports too.

  5. AT&T commit corporate seppuku? by AltGrendel · · Score: 2, Funny
    Good luck with that.

    No, really. I mean it

    --
    The simple truth is that interstellar distances will not fit into the human imagination

    - Douglas Adams

  6. Comment removed by account_deleted · · Score: 2, Insightful

    Comment removed based on user account deletion

  7. time to fund some campaigns by Original+Replica · · Score: 5, Insightful

    at present AT&T is shielded by a federal law they wrote themselves

    So they will just write another law. Do you really think that will be a problem for them to get a "children's internet safety" law passed. The government has been practically wetting themselves wanting a seemingly legal way to inspect all internet traffic, this is the opportunity. Nevermind "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated" because this a non-government entity.

    --
    We are all just people.
    1. Re:time to fund some campaigns by steelfood · · Score: 3, Interesting

      So they will just write another law.

      One that will force every backbone owner to filter traffic. Because if one can do it, all of them can.

      And henceforth, it will be named: The Great Firewall Act.

      It doesn't have to be implemented directly by the government to be oppressive.

      --
      "If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."
    2. Re:time to fund some campaigns by Kjella · · Score: 2, Interesting

      And henceforth, it will be named: The Great Firewall Act. More like the General Electronic Standard Transfer Analysis Permission Order. To fit the acronym it'd have to be an executive order by Bush instead, but I'm sure that can be arranged...
      --
      Live today, because you never know what tomorrow brings
  8. How to tell your management structure is broken by HangingChad · · Score: 4, Interesting

    When really stupid ideas start seeing the light of day. That means most of the management team has insulated themselves from criticism by surrounding themselves with toadies and have, effectively, separated themselves from any semblance of reality.

    Usually the case when you see corporate behavior and wonder, "How could they be that stupid?" Because on their little planet what they're doing makes sense. Just not on this world.

    In my experience it also means upper management has divided themselves into warring camps.

    --
    That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
    1. Re:How to tell your management structure is broken by FredFredrickson · · Score: 4, Interesting

      It's also a sign- the company has clearly chosen a strategy from the following two:

      1. Side with the consumer. In the end it's their money that will make you surpass your competition.
      2. Side with legislation. You can legislate yourself a consumer base, that's where the money will be.

      It's sad when a company thinks they're so big that they can take option 2. It's fun when option 2 basically kills a company. I wouldn't be surprised if this type of move kills them. Think about it- they're talking about censoring the very basic service that's being offered. It's like they're trying to sell a damaged highway to people, expecting them to take it because the potholes are on purpose. People will vote with their wallets, I hope.

      --
      Belief? Hope? Preference?The Existential Vortex
  9. How much does this affect non-ATT people? by FredFredrickson · · Score: 2, Interesting

    I assume that AT&T carries traffic across their network that doesn't neccessarily start or end with them. Somewhere in the middle? How much would this affect a Verizon subscriber accessing something from a server that's not neccessarily AT&T? Would AT&T likely get the traffic across their network somewhere in the US anyhow? If not, then could the rule be applied:

    "The Net interprets censorship as damage and routes around it."

    I could see a massive boycott of AT&T if this is possible, but I admittedly don't really understand too much how the infrastructure works.

    --
    Belief? Hope? Preference?The Existential Vortex
  10. Well, they could ... by Ihlosi · · Score: 3, Interesting
    To maintain that immunity, AT&T must transmit data 'without selection of the material by the service provider' and 'without modification of its content'



    Well, neither of the criteria contains any mention of the transfer rate. They could limit "offending" downloads to 1 kB/s.

  11. Re:Not just copyright .... by boaworm · · Score: 4, Informative

    Yea, that's the whole point of the article, you should really try and read it ;-)

    --
    Probable impossibilities are to be preferred to improbable possibilities.
    Aristotele
  12. They just buy NEW LAWS by computersareevil · · Score: 2, Informative

    Listen, they paid enough to get the common-carrier laws written so they would be immune from prosecution. What makes anybody think they won't just buy new laws that allow them to police traffic but still enjoy immunity? They are doing it for the children, after all...

  13. Just be glad... by untaken_name · · Score: 3, Funny

    That it's only AT&T doing the looking...for now. Wait until the gov't gets Google on it. Then we're all doomed. We'll actually have to pay for music, movies, and pr0n again. The humanity!

    --
    http://xkcd.com/386/
  14. Re:Who do I use for Internet access now then?? by acoustix · · Score: 5, Informative

    This issue isn't just limited to AT&T customers. It affects everyone because AT&T is a tier 1 provider, meaning that they provide backbone access for several ISPs. They are looking to sniff *all* traffic, not just traffic of their DSL customers.

    Nick

    --
    "A plan fiendishly clever in its intricacies"- Homer Simpson
  15. Another Reason Why AT&T is EVIL..... by Anonymous Coward · · Score: 4, Insightful

    Here's another reason why this company was broken up in the first place back in the 80's! How in the hell did the FCC and the American Public let this slip past us? Now we are dealing with it again. WTF? When will the FCC learn?

    1. Re:Another Reason Why AT&T is EVIL..... by computational+super · · Score: 4, Insightful

      Remember, this is the same American public which allows (even cheers for) the FCC to decide what you can and can't see and hear.

      --
      Proud neuron in the Slashdot hivemind since 2002.
  16. The real point of the move....; by supersnail · · Score: 3, Insightful

    "AT&T argues that it must get involved in stopping the flow of pirated content because much of this content is shared using peer-to-peer protocols, which eats up valuable network bandwidth, slowing network connections for many of its customers."

    They just want to block file sharers!

    The corporate weasels just dressed this up in a load of crud about copyrioght protection, protecting kittens from microwaves and otherwise keeping the planet safe for CEOs who havent yet earned thier first billion.

    Thye dont need any fancy technoligy to do this -- just a list of port numbers.

    --
    Old COBOL programmers never die. They just code in C.
  17. How and Why AT&T probably wants to do this... by nweaver · · Score: 5, Insightful

    Time-Warner cable supposidly has 50% of the bandwidth used by 5% of the users. Who wants to bet that of this bandwidth, it is almost all pirated material?

    The strength of piracy on the Internet is the ease of getting the pirated material, and the ease of distribution. Thus pirated material must be easy to find. So all the MP/RI-AA has to do is find it, and do something about it. Rather than playing Whak-A-Mole on Torrent tracker servers (which are largely offshore), with ISP cooperation from AT&T it becomes possible to play Whak-A-Mole on the users of the torrents themselves...

    So the MP/RI-AA or their contractor surfs the Torrent sites, and connects to the torrents with a manipulated client, verifies that a particular torrent is a copyright violation, maps the users of the torrent, and then sends an automated list of the nodes to the ISP saying "This graph is bad, any edge between two nodes in this graph should be killed", and the ISP simply RST-flood any edge in the graph which crosses its network, or just put in a router ACL to drop that pair for a while. Because the strength of the system relies on it being public and P2P, the MP/RI-AA can easily get this information.

    AT&T has multiple incentives to cooperate, and can probably do it safely. It has a second party (MP/RI-AA or a company they create/contract for) do the deciding, so they dont' have the liabliity.

    It keeps the content providers happy for when they are negotiating their compete-with-iTunes/Netflix video on demand and cable TV services.

    It keeps the content providers from pushing through very draconian legislation, or at least draconian legislation you aren't happy with. (It can F-up your competitors, but thats just a bonus)

    Its very easy to implement (short-lived router ACLs which are automatically injected and revoked).

    And it drops their bandwidth bills by 30-50% by eliminating a large amount of deliberately-noncacheable (both politically and because of bittorrent encryption) traffic.

    I wouldn't take it as a guarentee, but I'd almost be willing to bet that AT&T does something like this in the next year. Who wouldn't leap at a chance to reduce your costs by 30%, keep a group of "partners" you have to deal with happy, and without any real work on your part (just an SNMP-manager program)?

    This won't stop closed-world pirates, but those are far less annoying to the ISPs simply because there are so many fewer of them, and less important to the MP/RI-AA because they are less likely to be users you can convert to paying customers if you make the illegal content sources unusable.

    --
    Test your net with Netalyzr
  18. There's a more insidious possibility by QCompson · · Score: 3, Interesting

    Maybe by the time AT&T has it's filtering plan in place, they also hope to have a wide-ranging immunity law passed by Congress that supplants 17 U.S.C. 512. The new law, passed by a Congress that is nearly completely united on their love for telecom companies, would give telecoms complete immunity from any lawsuits while engaged in "efforts to combat copyright violations."

    It looks as if there's a good chance the telecoms will get retroactive immunity for aiding in breaking the law and eavesdropping on customer's communications without warrants; it doesn't seem to be a stretch to imagine that they will plan on their congress-critters to help them out in their fight against digital piracy.

  19. This all about the 'success' of MediaDefender by ifknot · · Score: 2, Interesting
    This is really about making lots of money in a new market... 'beating the pirates'

    They have seen how MediaDefender has made huge profits out of the rabid desire of the music industry & hollywood to stop the perceived 'theft' of music and movies to illeagal downloads particulary torrents through technological techniques.

    AT&T see themselves in excellent position to tap into this market through traffic monitoring and MediaDefender's recent stock crash after leaked emails reveal they were pwned by a bunch of high school kids http://torrentfreak.com/mediadefender-stock-plunges-due-to-leaked-emails-071222/ and http://www.portfolio.com/news-markets/national-news/portfolio/2008/01/14/Media-Defenders-Profile?print=true couldn't have come at a better time

    This a big and growing market and one of its major players just took a nosedive, the market share is up for grabs.

    I can't see big music & hollywood coming to their senses about the whole thing anytime soon so the 'fight' will go on and the likes of AT&T will be there to profit and drive the market.

    So if you've got no morals and an idea for a good algorithm or counter-pirate technique give AT&T a ring...

    --
    we are all cosmic nuclear waste
  20. Here's how it'll go down... by glindsey · · Score: 4, Insightful

    AT&T will simply purchase a new law from Congress stating "communications providers are allowed to monitor everything you do and turn you over to the government, but if they happen to miss anything, they are absolutely indemnified." They'll make arguments like "Hey, if the police aren't able to stop a murder from happening, but are shown to be putting forth their best effort to prevent murders, you don't hold the police officer responsible -- so why should we be held responsible if we miss some illegal content?"

    And all the legislators will nod their heads and murmur to each other "hey, yeah, they've got a point," while a bag of money passes quietly underneath their tables, and voila, they're allowed -- hell, probably required by the government -- to monitor all traffic and report any and all Violations of the Right to Corporate Profit, and completely immune from prosecution if they happen to miss something.

    It'll happen, and the typical "America, Fuck Yeah" voter will grin and gleefully agree that it's for the Good of the Nation, and if you're innocent you should have nothing to hide anyway, so what's the big deal?

    The legislators who draft and vote for the bill, meanwhile, will be hailed as patriots and re-elected, again and again, for Protecting the Motherland while simultaneously paying lip-service to smaller government and less federal intrusion into our private lives.

    I abhor the fact that my daughter is going to grow up in this pathetic shell that America is today.

  21. Death to the Death Star by Doc+Ruby · · Score: 2, Interesting

    AT&T is already facing a mortal threat because it helped Bush/Cheney spy on every phonecall on its network for at least 5 years, in blatant violation of the FISA. Those crimes should get Bush/Cheney impeached (and it just might) - AT&T would be an even huger casualty. That's why it (and its also guilty "competitors" like Verizon - but not Qwest, which refused) is pulling in all its favors in the Congress (especially in the Senate), to get amnesty/immunity for having broken that essential law so much and so badly.

    If it gets away with those many and flaming FISA violations, AT&T will write new laws to allow, even encourage, more spying like this one.

    But if AT&T doesn't get amnesty (even if it convinces a court that it isn't liable for breaking the FISA, because "the devil^WExecutive made me do it"), then maybe it will be stopped. Not just from spying, but from doing whatever it damn pleases to prey on America, both regular people and the many people who've been trying for several years now to compete with new technologies like VoIP and other open networks.

    Death to AT&T. Maybe a lawsuit right up its heat exhaust will do the trick.

    --

    --
    make install -not war

  22. Policy by Eudial · · Score: 2, Funny

    Nothing new. Just the usual corporate policy of "Why aim for the sky when you can shoot yourself in the foot?"

    --
    GAAH! MY PRINTER IS ON FIRE!!! PUT IT OUT! PUT IT OUT!
  23. Re:Who do I use for Internet access now then?? by eln · · Score: 2, Interesting

    Try getting dry loop DSL, it's even worse.

    AT&T does offer dry loop, but they won't admit it, and most of their call center drones don't know that it exists. I ordered it a few months back, and after being transferred all over the place just to find someone that would admit that it existed and knew how to set it up, I finally got someone to actually hook it up.

    After I got my first bill, I jumped online and set up automatic payment, and everything was fine. Then, two months later, I get a nastygram saying my bill was overdue. The notice had a completely different account number. So, I call AT&T and tell them I'm getting double billed with two account numbers for the same service. Two hours of transfers later, I get a lady who tells me that this happens "ALL the time" and agrees to close the past due account and credit back the charges.

    A week later, my DSL is disconnected. Of course, when they closed that one account, they disconnected the service as well. After another couple of hours on the phone, I finally got my DSL turned back on under (I hope) the right account number. Good times.

  24. Re:How and Why AT&T probably wants to do this. by kebes · · Score: 5, Insightful

    Your post outlines a possible means by which AT&T will stop bit-torrent traffic. It seems workable and realistic, and AT&T may very implement it (despite the obvious ramifications: e.g. if they block everything listed on PirateBay they will block many sanctioned/legal file transfers).

    But the P2P community will fight back. It will become an arms race. For example:
    -Trackers inject all kinds of bogus data into the trackers, crafted so that humans skip over it but automated crawlers choke on the massive amount of data (and RST packets!) they must deal with. For added fun, the bogus data includes IPs of legitimate company services, so AT&T will be interfering with, e.g. Blizzard downloads.
    -ISPs adjust their software to differentiate "real torrents" from "fake torrents."
    -Trackers begin accumulating lists of IP addresses and other signatures that detect the ISP bots, and feed them bogus data.
    -ISPs use their control of IP blocks to fake requests from different IPs.
    -P2P software starts ignoring RST packets, and uses a different (encrypted) protocol to open/close sessions.
    -ISPs give up sending RST-floods, and instead drop all packets.
    -Trackers implement algorithms that keep track of "user contribution" based on swarm participation (transmitting valid packets), and block/throttle clients with no "reputation." This makes it difficult for the ISPs bot to browse the torrent listing without actively participating in valid torrenting.
    -ISPs switch to checking what IP addresses a person connects to, and simply stalls any connection (all traffic) that connects to a tracker site.
    -Trackers switch entirely to TOR: they have no public IP address or domain name. All tracking requests go through TOR routing using the ".onion" pseudo-TLD.

    And so on...

    My point is this is a crazy arms race, and one should not enter that kind of battle until analyzing all the possible counter-attacks. And the difference here is that hackers will view this as a challenge, whereas AT&T will be spending literally millions of dollars implementing technologies that become invalidated over and over.

  25. Encrypted internet - sooner than I thought by zerofoo · · Score: 3, Interesting

    I'm not an encryption expert, but I have used my fair share of VPN gear and tunneling software.

    Mathematician friends of mine tell me that most modern encryption methods put brute-force cracking well out of range of the most modern computing hardware - even distributed cracking is extremely difficult with a sufficiently large key size.

    So if modern encryption techniques are so secure, what is to stop everyone from encrypting all their traffic?

    Once that happens, how does AT&T propose to filter traffic it can not examine?

    -ted

    1. Re:Encrypted internet - sooner than I thought by starfishsystems · · Score: 2, Informative
      what is to stop everyone from encrypting all their traffic?

      To give a very abbreviated answer, the network effect for this has not yet taken off. There has been no technical barrier to widespread encryption for over a decade, but there are two social barriers which remain to be overcome:

      • Education
        In order for you to use crypto, you have to know how it works. Most other technologies are not like this, in that they can just kind of operate in the background. But cryptographic communications operate between defined endpoints, and you are one of those endpoints. Understanding takes considerable effort. At minimum, people need to understand how asymmetric crypto works in both message signing and message encryption, and they also must develop some insight into what motivates key distribution, because otherwise they won't be able to make sense of the public key infrastructure in which they must participate. I think it's important enough that ultimately it will be taught as part of the standard school curriculum. But we're a long way from that at the moment.
      • Sequence
        Message encryption is the last in a fairly involved series of steps. This delays the network effect. Participants first have to generate their cryptographic keys and then have them signed by a trusted third party. Then they have to begin signing their own messages with them. As these messages go out, a side effect is to distribute the public keys which are in turn necessary for message encryption. Finally, participants can begin to encrypt messages.
      So, there's an elaborate sequence of events, each with a big activation threshold, that have to be crossed in order to trigger the network effect. Until you see a lot of cryptographically signed emails, for example, you can safely assume that there are not yet a lot of encrypted emails in circulation. And the same will be comparably true of any other encrypted protocol.

      This explains why adoption has proven to be very slow. There have been many early adopters, of course, but so far evidently not enough to inspire the public at large.

      The good news is that we've seen this kind of phenomenon lots of times before. The Internet itself was widely ignored for a long time, despite being completely satisfactory from a technical perspective. Something eventually kicks it into public awareness, and then, if those of us who engineer these things have done our job right, it takes off without a backwards glance.

      --
      Parity: What to do when the weekend comes.
  26. confusing the content by ACMENEWSLLC · · Score: 3, Interesting

    We run a medium sized network. We monitor our folks. We can also view their screen.

    Something I've noticed happening a few times which I thought was interesting. I can see the screen & url that the person is looking at, and it has very questionable content.

    I pull the URL from my logs and go to that page and it serves up an entirely different site.

    Sort of like the webpage that has a breakout game that looks like you are working in Excel, escalation has many fronts. If you make it difficult for people to get the content one way, they find a different way. While we dis-allow e-mail for personal use while at work, and blocked webmail - people can now surf the Internet on their phones.

    Why spend all this money on a war? Why not adjust the cost of a CD or DVD to be more in line with what the multitude will pay?

    How is it a DVD costs $12.99
    http://www.bestbuy.com/site/olspage.jsp?id=31042&skuId=3776596&type=product&ref=06&loc=01&ci_src=17588969&ci_sku=3776596

    But the same CD costs $12.99?
    http://www.bestbuy.com/site/olspage.jsp?id=124207&skuId=2830565&type=product&ref=06&loc=01&ci_src=17588969&ci_sku=2830565

    Shouldn't the CD be cheaper? I know I'd go back to buying CD's if they price were $5.

  27. Finally, Step 2! by Jason+Levine · · Score: 2, Funny

    Step 1: Create something.
    Step 2: Sue AT&T when it's inevitably pirated.
    Step 3: Profit!

    --
    My sci-fi novel, Ghost Thief, is now available from Amazon.com.
  28. -sigh.. Why Man-In-The-Middle is easily stopped by KWTm · · Score: 3, Informative

    This was written, and then modded "insightful" by somebody who does not understand how encryption.
    Agree. I've previously written a post about this, but it would be useful to review the relevant portions.

    In a nutshell, a "man-in-the-middle" attack is no more to be feared than a "dictionary" attack on a password: the attack only works if the security is implemented poorly. In the same way that you wouldn't say, "They use a password? How useless --simply do a dictionary attack!", you would not say, "Encryption? Just do a man-in-the-middle attack!"

    I know that ssh takes steps to store the public keys and warn you if they've changed. Why would it bother doing that if man-in-the-middle attacks aren't possible?
    For the same reason that they warn you when you change your password: "Your password is too short!" or "Your password is dictionary-guessable!" etc. Why would it bother doing that if dictionary attacks aren't possible?

    You said:

    My understanding is as follows:

    Party A contacts Party B and sends it's public key. Party E (evil guy) intercepts this public key and replaces it with his own. Party B replies with his public key, which is also intercepted and replaced. Party A and B are now "encrypting" the traffic with the public key provided by Party E, whom decrypts it, and re-encrypts it with the original public keys provided by A and B prior to forwarding that traffic on to them. Party E now has access to the complete conversation between A and B whom are none the wiser, unless they have an outside method of verifying the keys they received.

    I fail to see how an exchange of a random number stops this, when Party A never actually received Party B's key to begin with, because said key was replaced by Party E.
    This is a common question about public key encryption. I'm going to quote my own post:

    People worried about man-in-the-middle note that the phone company owns the channel, and thus can intercept everything! But that's not enough for a man-in-the-middle attack (MitM attack, where attacker K intervenes in the conversation between A and B; K tells A that K is really B, and K tells B that K is really A, and relays the conversation). The key to breaking MitM is to recognize the additional condition for such an attack: the attacker must completely replace the messages from the sender with his own messages. Otherwise, either:

            * the attacker is only eavesdropping, but won't be able to get any info once sender and receiver start using encryption, or
            * sender and receiver realize that there is someone intercepting, and switch encryption or move to a different channel

    Thus, sender and receiver must prevent a MitM attacker from completely replacing all the messages. The way to do this is to exchange messages through more than one channel, at least in the beginning.

    With the usual PKE such as GPG over email, for example, the sender doesn't just send public keys to you and say, "Here's my public key; now let's talk." [...] And, no, the way to make it more secure is NOT to send more data, like "Here's my public key and my photo. Now do you believe that it's my real key?" That would just be sending more data over the same channel. You need another channel.

    Hope that clarifies things for anyone who's still confused about WHY public key encryption works. The GP poster is correct.
    --
    404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
    [GPG key in journal]
  29. This is only going to get worse, and it's wrong. by moxley · · Score: 3, Insightful

    I have been saying for a while that our corporatist government and their partners in crime will not tolerate the freedom and openness on the internet much longer.

    It's ability to bypass the propaganda and behavior control traditionally handled by TV news and (now corporate) newspapers; the ability for people to organize worldwide and share information and files in real time; obviously the IP debate - all of this is the antithesis of where government and corporations are pushing societies in every other aspect of our lives.

    They want to turn the net into an interactive place much like a cross between early AOL and the home shopping network....They will snoop on everything you do, download, view, etc.

    You've already seen the endless barrage of stuff in the media about "how dangerous the internet is" lurking with pedophiles and terrorists, viruses and those who want to steal your identity; when in reality none of those things are real threats if you take the most basic of precautions.

    It may take a catalyzing event, like a virus that shuts down a financial network or turns off a power grid or plays a part in some "terrorist attack." They may even try to require that everything you do online is stamped with a virutal confirmable ID that you have to renew like a drivers license.

    This is coming, make no mistake about it. The only hope we have to prevent it is to fight fiercely on both the corporate front (against non net neautrality, because if they can't legislate it directly, they'll do it in a defacto manner) and against laws like S1959 which criminalize thoughtcrime and dissent; make organizing a boycott and other such actions a crime and involve the internet.

  30. Meet my buddy AT&T, aka 'man in the middle'. by Mr.+Underbridge · · Score: 2, Funny

    So if modern encryption techniques are so secure, what is to stop everyone from encrypting all their traffic?

    Once that happens, how does AT&T propose to filter traffic it can not examine?

    Your ISP: the ultimate man in the middle. You want real security, hand deliver your public key to all your contacts after first encrypting *it*. With a one-time pad. Which you then proceed to burn. And eat the ashes.

  31. ATT (via NSA) already filtering all the traffic... by xtronics · · Score: 2, Interesting

    Seeing as ATT is already filtering all the traffic for the NSA I don't see that it would be much harder to add this layer.

    Welcome to the American Stasi.