Subject: [hrpc] Cases - P2P

From: Nex <[email-masked]>
Date: Sun, 11 Oct 2015 02:45:59 +0200

Hello everybody.
Here are some initial considerations on P2P networks. This is a complex
one to address as implementations and use cases vary so much. I'm sure
it needs to be expanded upon, but this could a starting point.

                                    PEER-TO-PEER

    Introduction

Peer-to-Peer (P2P) is a network architecture (defined in RFC7574) in
which all the participant nodes are equally responsible engaged into the
storage and dissemination of information. A P2P network is a logical
overlay that lives on top of the physical network, and allows nodes (or
"peers") participating to it to establish contact and exchange
information directly from one to each other. The implementation of a P2P
network may very widely: it may be structured or unstructured, and it
may implement stronger or weaker cryptographic and anonymity properties.
While its most common application has traditionally been file-sharing
(and other types of content delivery systems), P2P is increasingly
becoming a popular architecture for networks and applications that
require (or encourage) decentralization. A prime example is Bitcoin (and
similar cryptocurrencies), as well as Skype, Spotify and other
proprietary multimedia applications.

In a time of heavily centralized online services, peer-to-peer is often
seen as an alternative, more democratic, and resistant architecture that
displaces structures of control over data and communications and
delegates all peers equally to be responsible for the functioning,
integrity, and security of the data. While in principle peer-to-peer
remains critical to the design and development of future content
distribution, messaging, and publishing systems, it poses numerous
security and privacy challenges which are mostly delegated to individual
developers to recognize, analyze, and solve in each implementation of a
given P2P network.

    Network Poisoning

Since content, and in some occasions peer lists, are safeguarded and
distributed by its members, P2P networks are prone to what are generally
defined as "poisoning attacks". Poisoning attacks might be directed
directly at the data that is being distributed, for example by
intentionally corrupting it, or at the index tables used to instruct the
peers where to fetch the data, or at routing tables, with the attempt of
providing connecting peers with lists of rogue or non-existing peers,
with the intention to effectively cause a Denial of Service on the network.

    Throttling

Peer-to-Peer traffic (and BitTorrent in particular) represents a high
percentage of global Internet traffic and it has become increasingly
popular for Internet Service Providers to perform throttling of
customers lines in order to limit bandwidth usage[1] and sometimes
probably as an effect of the ongoing conflict between copyright holders
and file-sharing communities[2].

Throttling the peer-to-peer traffic makes some uses of P2P networks
ineffective and it might be coupled with stricter inspection of users'
Internet traffic through Deep Packet Inspection techniques which might
pose additional security and privacy risks.

    Tracking and Identification

One of the fundamental and most problematic issues with traditional
peer-to-peer networks is a complete lack of anonymization of its users.
For example, in the case of BitTorrent, all peers' IP addresses are
openly available to the other peers. This has lead to an ever-increasing
tracking of peer-to-peer and file-sharing users[3]. As the geographical
location of the user is directly exposed, and so could be his identity,
the user might become target of additional harassment and attacks, being
of physical or legal nature. For example, it is known that in Germany
lawfirms have made extensive use of peer-to-peer and file-sharing
tracking systems in order to identify downloaders and initiate legal
actions looking for compensations[4].

It is worth nothing that there are varieties of P2P networks that
implement cryptographic practices and that introduce anonymization of
its users. Such implementations proved to be successful in resisting
censorship of content, and tracking of the network peers. A primary
example is FreeNet[5], a free software application designed to
significantly increase the difficulty of users and content
identification, and dedicated to foster freedom of speech online[6].

    Conclusions

Encrypted P2P and Anonymous P2P networks already emerged and provided
viable platforms for sharing material, publish content anonymously, and
communicate securely[7]. If adopted at large, well-designed and
resistant P2P networks might represent a critical component of a future
secure and distributed Internet, enabling freedom of speech and freedom
of information at scale.

[1]
https://torrentfreak.com/is-your-isp-messing-with-bittorrent-traffic-find-out-140123/
[2]
https://wikileaks.org/sony/docs/05/docs/Anti-Piracy/CDSA/EANTC-Survey-1.5-unsecured.pdf
[3]
http://arstechnica.com/uncategorized/2007/10/p2p-researchers-use-a-blocklist-or-you-will-be-tracked-100-of-the-time/
[4]
https://torrentfreak.com/lawyers-sent-109000-piracy-threats-in-germany-during-2013-140304/
[5] https://freenetproject.org/whatis.html
[6] https://freenetproject.org/philosophy.html
[7] https://bitmessage.org/wiki/Main_Page

---

From: Mark Nottingham <[email-masked]>
Date: Sun, 11 Oct 2015 15:06:19 +1100

Hi,

> identification, and dedicated to foster freedom of speech online[6].

I think there's an important aspect here that deserves highlighting; not only is lack of anonymity an issue, but also the privacy of the user's activity is extremely difficult to protect.

That's because fundamentally, you have to ask your peers for content by some identifier, and they can use that identifier to discover what you're requesting. Freenode admits as such [1]

Private Information Retrieval theoretically can avoid this, but AFAIK this isn't implemented in any P2P system, nor is it likely to be soon, due to the technical challenges (would be VERY happy to be proven wrong on this point).

Of course, this isn't an issue if you implicitly trust your peers; however, that doesn't seem a very good assumption to make for human rights considerations...

Cheers,

1. https://freenetproject.org/faq.html#hash
  
--
Mark Nottingham   https://www.mnot.net/

---

From: Avri Doria <[email-masked]>
Date: Sun, 11 Oct 2015 12:21:47 -0400

Hi,

Thanks for this contribution.

A question on throttling:  while used extensively against BitTorrent, I
think that it would be a broader issue. 

>From reading the use cases, I have begun to think that there is much as
case to made for some of the combinatorial effects of protocols as well
as the effect of the individual protocols.

avri

On 10-Oct-15 20:45, Nex wrote:
> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc
>
>

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 12 Oct 2015 14:53:13 +0200

On Sun, Oct 11, 2015 at 02:45:59AM +0200,
 Nex <[email-masked]> wrote 
 a message of 116 lines which said:

> In a time of heavily centralized online services, peer-to-peer is
> often seen as an alternative, more democratic, and resistant
> architecture that displaces structures of control over data and
> communications and delegates all peers equally to be responsible for
> the functioning, integrity, and security of the data.

An important point about P2P is that the typical user's daily
experience is not a pure P2P one but there is a big mandatory
centralised step, such as ThePirateBay for BitTorrent. The use of P2P
for real applications show us which features are hard to do in a fully
P2P way (here, search).

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 12 Oct 2015 20:32:23 +0200

On 10/12/2015 02:53 PM, Stephane Bortzmeyer wrote:
> On Sun, Oct 11, 2015 at 02:45:59AM +0200, Nex <[email-masked]> wrote
>> In a time of heavily centralized online services, peer-to-peer
>> is often seen as an alternative, more democratic, and resistant 
>> communications and delegates all peers equally to be responsible
>> for the functioning, integrity, and security of the data.
> 
> centralised step, such as ThePirateBay for BitTorrent. The use of
> P2P for real applications show us which features are hard to do in
> a fully P2P way (here, search).
> 

I thought this was pretty nicely solved by Tribler [0].

Best,

Niels

[0] https://en.wikipedia.org/wiki/Tribler

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 12 Oct 2015 22:14:38 +0200

On Mon, Oct 12, 2015 at 08:32:23PM +0200,
 Niels ten Oever <[email-masked]> wrote 

> I thought this was pretty nicely solved by Tribler [0].

I suspect there are much more ThePirateBay than Tribler users.