Subject: Re: interception proxies

From: Vernon Schryver <[email-masked]>
Date: Tue, 18 Apr 2000 09:02:42 -0600 (MDT)

> From: John Martin <[email-masked]>

> ...
> But one very common mis-conception I have noticed is about the point at 
> which redirection occurs. In my experience, the redirection takes place 
> only at either source or destination, or more specifically, at a point 
> which is under the same administrative control as the end-user or (e.g.) 
> the web server itself.

You're mistaken, as America Online's SMTP redirection proxies demonstrate.
As I pointed out in the main IETF list, AOL is openly redirecting all SMTP
traffic from their dialups and nominally IP-addresed to the Internet at
large to boxes operated by AOL.  Currently those seem to boxes do no
more than add SMTP Received: headers, but realsoonnow are supposed to
added an X-Apparently-From: header and to filter the entire message if
the box considers it spam.

For at least a year, I think HTTP redirection proxies have been operated by
some ISP's, justified by the familiar efficiency reasoning.

In both cases the ISP must be viewed as a third party, and in
security terms, a man in the middle.

> A lot of the recent discussion on the IETF list seemed to assume that this 
> happened "somewhere in the middle". I'm not saying this is not possible, 
> just that it is not happening today (to my knowledge). 

In the main IETF list I quoted some of AOL's words on the subject and
pointed to others.  Again, this differs from what many ISP's (e.g.
UUNet) have done, configuring their routers to block all TCP packets
from their customers to distant port 25's.

>                                                        In the future, I 
> think that it will get more, not less difficult to do this too - e.g. when 
> traffic is already tagged / labelled it will be more difficult to intercept 
> in the middle of its path.

I don't see how tagging or labeling might prevent such games by third
parties, unless you mean something based on encryption, and even then a
secret shared only by the endpoints and used for something like a message
authentication code (MAC) is required.  Otherwise a man in the middle can
replace or modify tags, labels, and MAC's just as it does IP addresses.
IP addresses can be viewed as tags or labels.

> In the meantime, there are many other ways to redirect clients to the 
> closest proxy. One common way is to simply use the DNS to give a response 
> dependant on the client's source IP address (for either the proxy or the 
> destination web server); many corporates do this today already - Akamai 
> have built a whole business out of it.

Yes, and no one I know really objects to those techniques...well, sometimes
I grumble about it when one of Akamai's servers hiccups as seems to be
happening a lot this week.  And some of those techniques make it between
hard and impossible to save useful bookmarks.

Vernon Schryver    [email-masked]

---

From: John Martin <[email-masked]>
Date: Tue, 18 Apr 2000 18:45:21 +0200

>the box considers it spam.

I don't think I'm mistaken - perhaps I wasn't clear. What I mean is that 
ISPs do this for their own customers only. Isn't that what you are saying 
AOL does?

The point is that I know of no ISP who applies an interception proxy to, 
say, traffic transiting their network from a peer.

>some ISP's, justified by the familiar efficiency reasoning.

Yes - true...?

>security terms, a man in the middle.

OK. That is the confusion. I was viewing the ISP as being in the same 
administrative domain, at least that is true for most dialup ISPs. In this 
case, the customer has a choice to change ISP if they don't like their 
policies.

>hard and impossible to save useful bookmarks.

I suspect that those techniques will ultimately lead to a deprecation in 
the use of interception proxies at source (for web traffic). But that is a 
few years away and we still have the problem of 100 or so Akamai-like 
companies - how does the user determine the closest / best proxy?

I still believe the key is in proxy discovery. Or rather, replica discovery 
- since the content will be controlled by the content provider, even if is 
distributed by a third party. This will lead to a brokerage system similar 
to the peering and transit relationships we have already between ISPs... 
but what is still missing is how the user gets told where to look. DNS is 
one answer but may not be the best. E.g. I may not want the fastest / 
closest but rather the cheapest.

This is what I hope we can start to work on in WREC. But first, we need to 
get our current documents rock solid, get some wider review (particularly 
of the known problems) and get them published and discussed widely.

John
---------------------------------------------------------------
Network Appliance           Direct / Voicemail: +31 23 567 9615
Kruisweg 799                               Fax: +31 23 567 9699
NL-2132 NG Hoofddorp               Main Office: +31 23 567 9600
---------------------------------------------------------------

---

From: Keith Moore <[email-masked]>
Date: Tue, 18 Apr 2000 14:35:27 -0400

> administrative domain, at least that is true for most dialup ISPs. 

I think that's a big stretch.

> In this 

I don't see how this matters.  The typical customer doesn't know whether
the ISP is intercepting his traffic.  All the customer knows is that his
internet phone application, or game or whatever, doesn't work.  And he's 
at least as likely to blame the vendor of the application as the ISP.

And it's not always the case that the customer has the ability to change
ISPs...it depends on where the customer is and how many ISPs serve that
area and how many of those otherwise provide the service that the customer
needs.  When I travelled to Adelaide recently I was pretty much stuck
with the dialup service provided by my ISP (interception proxy and all)
because there was not enough time to find a better service.

Not all problems are solved by competition, especially where the ability 
to make good decisions depends on knowledge of subtle technical issues.

Keith