Rietta is a software security consultancy whose blog covers encryption policy, ISP traffic injection, and web application security.
HN links it for Comcast injecting content into web traffic, which commenters treat as a real man-in-the-middle risk, and for encryption policy posts.
I may be wrong on this one, but I'm sure I've read in several articles over the years that encryption is permissible if you host the keys publicly/online somewhere.
Now I know what the immediate response to that is, because it's mine too, but your problem with drive-by, opportunistic eavesdropping is semi-solved if the location of your keys is only known to your logbook and any inspectors who come knocking.
Besides, there may be wiggle-room for allowing encryption on new bands in the future, given that all mobile and most home internet use is over radio now anyway. Exciting times. I'm just about to take my test for the Intermediate license in the UK and this is the direction I want to research. 5G area-wide networks, micropayments, etc.
As a side-note, I hope I live to see a true zero infrastructure meshnet internet, where every house or device has an omnidirectional HF/VHF/UHF antenna to connect to the completely decentralised web, at speed, for all comms. That'd be neat.
--
EDIT: Some resources I've dug up:
- http://www.qsl.net/kb9mwr/projects/wireless/Data%20Encryption%20is%20Legal.pdf
- https://rietta.com/blog/2009/08/17/authentication-without-encryption-for/
- http://rsaxvc.net/blog/2014/2/1/Encryption%20and%20Amateur%20Radio.html
Clearly much room for discussion and interpretation still. And these rules vary per country, so you can imagine picking up broadcasts from more lax countries that were encrypted...
Comcast started attacking it's customers via MITM about ~2013 or so. Initially it was ads, https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=comcast+javascript+injection+mitm&btnG=Google+Search&gbv=1 . This would break things like, say, the Steam browser and prevent it from working. I literally had this happen to me. Eventually Comcast changed it's terms of service and violated it's contracts with existing customers and started limiting total data transfer to about 1 TB/mo. When it started doing this it also started MITM injecting JS about your usage into HTTP connections: https://rietta.com/blog/comcast-insecure-injection/
Comcast is the only non-56k ISP available in my area still in 2024. So I use them... but I also have to make sure to protect myself from their attacks. If I did what they're doing I'd go to prison. But some types of legal persons have more rights than human persons.
One of the problems with this is the same as any other bad behaviours companies often do that are indistinguishable from an attack, such as asking for your PIN on the phone, or sending account-related e-mails with links: They condition the user to expect this is "legitimate".
As the article points out, an attacker could do something on an unrelated web server that injects this same notice (using the same code [1] as a basis), with a link that says something like "Extend your limit for free by 1GB", which loads a fake "Xfinity login" in a pop-up to phish their Xfinity account credentials. Because the link was presented using the familiar UI, it could easily trick someone and it would be nearly impossible for most users to realize it's not legitimately Xfinity.
[1] https://rietta.com/blog/comcast-insecure-injection/injection-attack.js
So encryption isn't allowed, but is there any way to authenticate information sent over packet radio? Open communication has plenty of uses, but some of those can be spoiled by bad actors impersonating others.
Edit: I found this article on authentication that supposedly is fine, but I'm not licensed so I don't know how valid it is. https://rietta.com/blog/2009/08/17/authentication-without-encryption-for/
ISP MITM is not low risk, and has been already done by Comcast at the very least in the US to inject warnings about bandwidth caps [0]. And with the horrible security of home routers, ISP provided or not, MITM attacks are highly likely on home connections sourced from botnets and malware attacks on routers.
[0]: https://rietta.com/blog/comcast-insecure-injection/
I love this. Having operated https://rietta.com for 23 years and counting. Maintaining links and pages that are no longer my focus but history would be lessoned to have them vanish. It goes through phases that I fail to tend to it properly and then rushes to catch up and “save the plants”.