Slashdot Mirror
Encrypted Traffic No Longer Safe From Throttling
coderrr writes "New research could allow ISPs to selectively block or slow down your encrypted traffic even if they cannot snoop on your transmitted data. Italian researchers have found a way to categorize the type of traffic that is hidden inside an encrypted SSH session to around 90% accuracy. They are achieving this by analyzing packet sizes and inter-packet intervals instead of looking at the content itself. Challenges remain for ISPs to implement this technology, but it's clear that encrypting your traffic inside an SSH session or VPN connection is not a solution to protect net neutrality."
They could just throttle all encrypted packets for free.
First, encrypted traffic was never safe from throttling anyway. Second, FTA:
"So it seems the use of a tool like this would be limited to an extremely controlled environment where users are limited to a white-list set of network protocols (so that they can't use a different tunneling mechanism, stunnel for example) and only allowed to ssh to servers under the control of the censoring party. In which case you would wonder why the admin wouldn't just set the ssh server's AllowTcpForwarding option to false."
Kinda useless.
If the application is not time-critical, introducing random jitter would go some way to subverting this, no?
Leela: "Is all the work done by children?" Alien: "No, not the whipping."
Can anyone explain to me why any ISP would use this technique? If they start looking at packet sizes to determine different kinds of encrypted traffic then the packets will just be padded, causing their network to be further overloaded...
Not really, they're providers of the medium and have no business limiting or snooping the datat that goes through their network especially since they were often granted a monopoly over building infrastructure in their area.
Justice is the sheep getting arrested while an impartial judge declares the vote void.
Even without this analysis it was kinda obvious that throttle-happy ISPs would simply throttle all encrypted data once encrypting became mainstream in P2P.
-- Technology for the sake of technology is as pathetic as eschewing technology because it's technology.
You can identify the type of traffic, because we're not trying very hard to hide it. If you keep going down this road, we'll just send all the time, the same constant packet size, the same rate, regardless of actually required service. It's the same to us, really, because we pay a flat price. It is not the same to you, though, because when we have to make every traffic look the same, we'll use much more of your precious bandwidth, so cut out the crap.
I would have been first but my ISP throttled my SSH tunnel
All its going to do is encourage P2P developers to try (and they will likely succeed) to make P2P traffic look more like other traffic. Want your bittorent to look more like encrypted telnet? Easy send tons of tiny packets and take a short break every few seconds. All this is going to do is increase the packet overhead the ISPs see. That same overhead will also hurt P2P end users but unless its more then the throttle does they will do it anyone. Its a loose loose situation really. They ISPs should realize they gain nothing going down this path.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
And throttle all encrypted traffic over whatever an IP phone or VPN connection would use on assumption of file-sharing. They don't give a rat's ass what you are doing, really, they just want a reason to throttle you and this company just makes money by giving them one.
How about:
Not a solution to defeat ISPs attempts to control what's going through the government-funded, monopoly-protected, public-land-using network.
You're right, facts do change the interpretation.
Well, the next move would simply be some tool, or modification to bittorrent, that makes the traffic patterns look like that of other protocols. While I'm sure it would have some impact upon performance, surely torrent packets can be make to look pretty damn similar to a bunch of HTTPS images being loaded on a web page (or something along those lines). Just like DRM, each move like this isn't solving any problem, just slowing things down, while a counter-move is made. (Or, another provider is chosen who doesn't throttle traffic, competition permitting.)
Love many, trust a few, do harm to none.
Could be worse. Rogers and Bell, here in Canada, just throttle ALL encrypted traffic.
Do you understand that ISPs are not exactly charity organizations, don't you? I am paying for their service and I expect it to work as it was advertised in their offer.
detect if one of the mario brothers is inside the packet, 89.9% of the time
no, but they can add some latency
rewriting history since 2109
If these policies where openly documented, and there where truly free competition, I'd agree with you; let the market sort it out.
That typically isn't the case. First, these policies are rarely documented at all, and if they are, it's in language so vague as to make it useless for purposes of comparing one ISP to another. ("We may, at our discretion, at various times, perform adjustments to packet-priority")
Free competition is also the exception rather than the rule. A huge fraction of end-user-lines where built by telcos acting as a government-granted monopoly, and then they somehow got to keep a large piece of this after the monopolies are no longer in principle monopolies. Which means in many areas they are still in -practice- pretty close to monopolies.
And even where they're not, competition is low and that will remain so. Few people have more than 2, perhaps 3 physical cables coming in that are suitable for broadband. (many have a twisted-pair copper that used to be for POTS and a coax that used to be for analogue-cable, and that's it, extra bonus if the old monopolist owns the tv-cable in your area!)
This ain't gonna change. A single modern cable has moder than enough capacity for all needs, so it's not economically sensible to have a large number of competitive cable-networks.
Really, last-mile networks should be owned and run by the neighbourhoods, or failing that atleast be considered infrastructure, really today a working broadband-connection is basic infrastructure like electric power, water, sewage and roads. (it's not -equally- crucial as those, but it's crucial nevertheless, I doubt a house with -no- telecom-connection of any sort would find many buyers)
Wireless changes the picture a bit, for low-bandwith applications. But only a bit. The problem is that the RF-spectrum is fundamentally shared, thus it will not be possible to deliver the same speeds and reliability as is possible on physical cable. (a single single-mode fibre easily supports speeds up atleast a Tbps or thereabouts which is more than most people need for the next few decades)
Not a solution to defeat ISPs attempts to control, what's going through networks they constructed with large sums of both public and private money they mortgaged against providing a service to their customers, not fighting against them.
Yup, sure do.
Yeah but that's a cheat owing to the tubes. See, they route all traffic through a huge green pipe and listen for the "Gew gew gew" noise that signals the presence of a Mario Brother.
Why would an ISP do Deep Mario Brother Inspection, I hear you ask? Well if you remember, those depths were filled with coins! There's no depth an ISP won't go in order to get those.
And in the next (or two) release of SSH implementations, this weakness will, no doubt, be fixed.
Professional cryptographers have known for decades that you don't just switch on your transmitter when you want to send a secret message - no matter how well encrypted it is. The mere fact of traffic is frequently a sizeable tell-tale itself. Instead, you keep your transmitter on 24*7 sending encrypted garbage, with the ability to interleave genuine messages when the need arises. I'm sure that in a short time, the SSH people will remove the ability to profile the transmission to glean anything usable from it.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
Attempts to analyze (and then throttle) Internet traffic reminds me of copy protection schemes. The schemes get more and more complicated (and costly) and at every turn the user gets more sophisticated in his or her attempts to get around the protection. ISPs would be wise to look at the music, movie, and in particular video game industries and realize that there are many, many more users who wish to use P2P software than there are ISP engineers who wish to throttle said users, and that it will always be a losing battle.
Personally, I think the granularity of the ISP payment schemes need to be increased. We pay for cell phone minutes in blocks of 100 or so (or by the minute, depending on your plan); we pay for electricity by the kWH, we pay for water by the gallon (or liter), and so on... why not pay for bandwidth by the Mb? In a perfect world (yeah, well, one can dream!) this would mean reduced costs for the average home Internet user, as most people aren't using anywhere close to what is available, and maybe slightly increased costs for people like me. But then at the same time throttling is no longer an issue. Of course in reality this is unlikely to happen any time soon; why charge responsible, realistic rates when you could charge a flat fee and then just block any traffic you don't like with increasingly expensive technology (and pass the cost on to your monthly subscribers, of course)?
ISPs, learn from the "War on Copyright Violation" - you won't win this battle; give it up and fix the underlying problem.
Call me a troll, and I don't usually comment, however I don't think this is what "net neutrality" is about. If you want to be able to download anything and interrupt other people who want to surf freely, that is one thing, but if you just want to be able to surf freely without restriction being imposed by IPS's and such, that is a totally different kettle of fish.
Funny, when I began using their service they never told me they would throttle certain protocols. They said they'd give me access to the internet at certain speeds to the best of their ability. Throttling packets seemed to be significantly below their best.
Mario Brothers would never be in the packets, as they travel through pipes, not tubes. :-)
Okay, before everyone starts their throttling engines for war please remember the following:
A: ISP's are not throttling data because of bandwidth, they are throttling because of latency. If you do not understand the difference, here is a simple way to look at it
A router can handle a million packets a second let say. Wether the packet is a size of 10 or a size of 1000 it still can only handle a million packets. Bandwidth is how many seats on the bus (or if all the buses had the same number of seats, how many lanes on the road), latency is how fast the bus is going. A router it a toll gate. Too many buses, regardless of how many seats, will bog down the toll gate. P2P is very chatty in the number of packets and depending on how it sliced the data, lots of big chunks, or a whole hella lot of small chunks. Either way the guy working the toll gate is going to go postal at some point.
B: Encryption, your rights online, data type, freedom, and all of that supurious crap we like to toss around means nothing when: "You sign a contract." While I am not a lawyer I am an informed customer (I read the small print). When you sign up for Internet service, regardless of what you feel, or in fact what your rights are, you can and do sign most of those away when you sign up for a commerical service. If they say that you cannot encrypt your P2P traffic and you do; thus losing your service... that is more then acceptable under most nations idea of contract law. You have no right to privacy if you sign a contract that gives them the right to look.
Keeping A & B in mind please feel free to march forward with your discussions but, the most important thing to remember, is point A. Telling people there is plenty of bandwidth has LITTLE IF ANYTHING to do with throttling as far as I can tell. I watched 3 hearing on CSPAN and not one rep from the big three telecoms mentioned BANDWIDTH as a reason, but I did hear 18 engineers talk about routers, MTU initiated fragments, and total packets per second capacities on core routers, and I did keep count of bandwidth vs. latency.
Bandwidth Mentioned: 34 times
Latency: 400+ times (I ran out of chicken scratch space on the page and gave up...)
Now I admit I did doze off after 30 minutes of an engineer trying to explain to a senate committee the difference between TCP and UDP but I am human after all.
Now certainly there is some complexity in latency and bandwidth in how they are related and from what I have heard fiber does take care of a lot of the latency issues (signal to noise ratio seemed to be a big talking point from some AT&T engiee who looked like Dracula) so feel free to toss that into the discussions.
But seriously, this whole filtering stuff has nothing to do with bandwith, so please, please, please, stop with the bad 3rd party reporting. We have already seen on /. that the ISPs aren't hurting for bandwidth.
Getting accurate information from the mainstream press on Internet filtering is like asking a caveman to fix your car... all he's gonna do is smash it with a rock.
-=[ Who Is John Galt? ]=-
The ultimate solution would be to ban last-mile owners from providing any services at all. No voice, no video, no data. They exist to provide copper and/or fiber to subscriber premises, and to operate central offices as colocation facilities. That's all. Nothing else.
Then, anyone who wants to provide services, simply colocates their head end equipment at the central offices in areas where they wish to provide service. At that point it doesn't matter whether they're offering video, voice, data, local or long distance, Internet or private lines, it just doesn't matter because the central office is shared between as many providers as will fit in the building.
We need to separate the last mile land-use monopoly from the services being provided. There should be no such thing as an ILEC.
Tired of FB/Google censorship? Visit UNCENSORED!
You'd think those ISPs *cough* Shaw Cable *cough* would have learned the lesson by now. That lesson should have been wastin... I mean spending, MILLIONS and MILLIONS on products like Sandvine to try to throttle bittorrent only to find out a few months later people were bypassing it with encryption.
So now some Italians can identify prediction based on packet size etc... watch ISPs spend many more Millions implementing this, then the torrent client software guys simply change 10 lines of code, recompile and voila... Millions down the drain for ISPs!
So go ahead, make my day! Just don't try to pass off those costs in your monthly bills to me.
Adeptus
No trees were killed in the making of this post; however, many trillions of electrons were horribly inconvenienced.
When did P2P become illegal? It seems like every comment on this story talks about P2P like it's evil and needs to be stopped. I pay for an unlimited connection to the internet with a max speed of 30Mbps. I should be able to download and upload legitimate data as often as I'd like. And I do have a computer seeding torrents 24/7 which are completely legal. If Verizon doesn't like the fact that I'm constantly using most of my available upload then they should change the contract to say I can't do it. So far they haven't had any problems.
I wonder if doing
ifconfig ppp0 mtu 73
Would bypass that shaping?
I worked on implementing Error correction codes over IP some time back http://www.ecip.com/
This is what we would call part of a family of Rude protocols that would do reverse Throttling.
All of these ISP are counting on TCP being polite, but it's also counting on the network being passive or at least polite as well.
In our case we originally implemented ECIP and SPAK when we had a 100KBPS video stream and 99KBPS gave us nothing but garbage. Since video is all or nothing. http://www.videotechnology.com/jessem/all_or_nothing.html
But with ISP taking a hostile approach, application writers could also start talking a more aggressive approach in a sort of arms race.
I know everyone has been afraid of this, but I feel that this is indeed a necessary step if some sort if truce is to be reached between USERS and their ISP's. Right now we are really fighting over our rights on how we can use the "last mile" since it's all now been consolidated into the hands of only a few companies. We have already lost our ability to choose and market freedom.
I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso
It's called Camfrog. Look into it. I can saturate my connection down and up running a Camfrog server faster than I can torrenting the most popular Linux distro. It would look just like P2P traffic too.
I'd love to see them throttle my $200 Camfrog Pro server. The lawsuit for doing so and saying that it's 'illegal P2P' traffic would get them so owned in court.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.