Hacker News Reader

Comment by guelo | Hacker News Reader

> Google has proposed a new Internet protocol called SPDY that would prevent these types of header injections – much to the dismay of many telecom companies who are lobbying against it

Wow, I was pretty ambivalent about SPDY/HTTP2 before but now I really hope it catches on.

View on HN

Actually a binary format (designed to be machine-friendly) is better for MITM injections as it's easier to parse and manipulate... the only benefit of HTTP2/SPDY is that iirc it requires TLS.

I'm waiting for the first carrier to perform SSL MITM.

HTTP2 doesn't require encryption but it does compress the headers. I'm guessing compression makes it too CPU-intensive for telecoms to manipulate the headers on the fly.

I wish they'd require encryption. Perhaps make http:// be TLS but without certificate verification.

Then the telecoms would MITM it anyways.

Certificate pinning and web-of-trust verification would make that difficult to maintain for long.

It's unlikely they'll ever get mass usage because both are uncomfortable to work with.

If a certificate is compromised, changing it means all pinned clients will get a huge warning. Either the user ignores the warning (in which case pinning is useless) or he doesn't and the site is harmed. Keeping a compromised certificate is even worse.

For WoT you first need a web of trusted individuals.

Unfortunately key distribution over insecure channels is still an unsolved problem.

This is in progress. HTTP 2.0 does exactly what you specify. The tcpinc working group at the IETF is also looking at adding this at a lower level for all TCP connections.

Uh, they removed the TLS requirement.

They're already planning it: "Involve the user: Obtain user consent to trust service provider to decrypt select HTTPS"

Quote from someone working for a satellite internet provider for airlines.

Source: http://www.atis.org/openweballiance/docs/OWAKickoffSlides051... page 27

As bad as it is, at the least it should be easy to opt-out of that (unless they do something ridiculous like charge you extra if you refuse to opt-in). Just remove the certificate your ISP gives you.

> I'm waiting for the first carrier to perform SSL MITM.

Nokia, funnily enough, did this on certain dumbphone models. Not a carrier, I know, but still interesting.

http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/

> the only benefit of HTTP2/SPDY is that iirc it requires TLS.

Yeah...except the NSA-agent-hiring IETF [1] gave up on that at the last minute.

http://arstechnica.com/security/2014/01/nsa-employee-will-co...

telecom companies are actually lobbying against spdy?

they are lobbying because they see anything Google proposes as a direct long term threat to their business model.

Which it is. Good riddance, in my opinion, those threats couldn't have happened to a more deserving set of corporations.

This is the anti-SPDY lobbying alliance, http://www.atis.org/openweballiance/index.asp

They seem to be deathly afraid of becoming "dumb pipes".

Holding back innovation just because it would wipe out their business.

This, my dear friends, is why ISPs need to become regulated, government-owned utilites. Or has anyone seen regulators preventing experiments on self-driving cars and trains in order to keep train conductor's jobs?

> Or has anyone seen regulators preventing experiments on self-driving cars and trains in order to keep train conductor's jobs?

Yes? Isn't that the crux of the Uber and AirBnB and Aereo battles?

Yet, these laws you mention actually make sense (at least those Uber and Airbnb "fight" against).

Taxi regulations exist to prevent Uber's "surge pricing" model, thereby guaranteeing the customer the same price for the same distance, no matter how late at night it is or how drunk the customer is (at least in Germany; the taxi market as a whole seems to be broken in the US so that's another story).

Hotel regulations exist to protect other tenants in a building from the kind of bullshit which has happened multiple times: ever-changing, drunk tenants demolishing stuff, being loud, throwing sex parties, etc.

The only law area being "disrupted" where the existing regulations don't protect any legitimate interests aside from MAFIAA's Big Money is the TV distribution, and I'm sad that Aereo got problems there. But well, that's the area of Big Money, no chance to compete there :(

Reply on news.ycombinator.com