Subject: [obscurity-interest] GNU Free Call

From: Dean Willis <[email-masked]>
Date: Tue, 22 Mar 2011 00:08:40 -0500

Not obscure, but at least slightly opaque:

http://planet.gnu.org/gnutelephony/?p=14

Question: What could be done to reduce the "stand out", or "obviousness" of a SIPWitch node?

--
Dean

---

From: Christian Huitema <[email-masked]>
Date: Tue, 22 Mar 2011 05:37:38 +0000

> Question: What could be done to reduce the "stand out", or "obviousness" of a SIPWitch node?

P2P SIP comes to mind. Especially if we can use a form of P2P that allows for "local" discovery, without sending traffic to central points.

-- Christian Huitema

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Tue, 22 Mar 2011 09:44:34 -0700

Hi Christian,

> P2P SIP comes to mind. Especially if we can use a form of P2P that allows for "local" discovery, without sending traffic to central points.

I am not sure to understand what you mean by local discovery.  Can you 
elaborate?  (I plan to release a FOSS implementation of RELOAD this year.  I'll 
let someone else do the SIP part, but I am interested on requirements for the 
P2P part).

Thanks.

---

From: Dean Willis <[email-masked]>
Date: Tue, 22 Mar 2011 13:01:29 -0500

On Mar 22, 2011, at 11:44 AM, Marc Petit-Huguenin wrote:

> I am not sure to understand what you mean by local discovery.  Can you elaborate?  (I plan to release a FOSS implementation of RELOAD this year.  I'll let someone else do the SIP part, but I am interested on requirements for the P2P part).
> 

Bootstrap phase. Do we rely on a well-known server listed in DNS to find or form an overlay,  or can it be entirely accomplished with something like bonjour?

I'm reminded of the "toothing" hoax a few years back:

http://en.wikipedia.org/wiki/Toothing

With  a P2P communications architecture it might be possible to discover that people in the local broadcast domain want to hook up. Or to discover that they are injured and require emergency assistance, or that they are fellow emergency responders trying to organize a response.

--
Dean

---

From: Christian Huitema <[email-masked]>
Date: Tue, 22 Mar 2011 19:14:43 +0000

> With  a P2P communications architecture it might be possible to discover that people in the local broadcast domain want to hook up. Or to discover that they are injured and require emergency assist…
P2P technologies have an ambiguous relation with privacy. On one hand, P2P avoids reliance on a server that can be compromised or spied upon. On the other hand, it is fairly easy to hack into a P2P cloud and mount attacks such as spoofing, denial of service or spying. Hence my remark about "local" P2P service. If the communication channel can be established without sending packets outside the "local area," then it becomes somewhat immune to attacks emanating from outside that area.

Thinks to check for, and avoid, include reliance on specific "bootstrap" servers, or reliance on the DNS. I am also skeptical about using too much multicast, even on a local network, as multicast by nature is not very discrete. Thinks to seek, on the other hand, include usage of different channels for bootstrap, e.g. BlueTooth, NSP, or local Wi-Fi, and P2P cloud structures that limit connections to approved parties.

-- Christian Huitema

---

From: Dean Willis <[email-masked]>
Date: Thu, 24 Mar 2011 14:09:13 -0500

On Mar 22, 2011, at 2:14 PM, Christian Huitema wrote:
> 
> Thinks to check for, and avoid, include reliance on specific “bootstrap” servers, or reliance on the DNS. I am also skeptical about using too much multicast, even on a local network, as multicast by nature is not very discrete. Thinks to seek, on the other hand, include usage of different channels for bootstrap, e.g. BlueTooth, NSP, or local Wi-Fi, and P2P cloud structures that limit connections to approved parties.
>  

Some of the proposals for bootstrapping a P2P require getting a certificate from a central server first, which supposedly lets one detect faux participants. This has its own caveats, as the recent Comodo-announced root certificate incident illustrates

http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1529110,00.html

--
Dean