Encryption on PPPoE between DSL router and ISP

Noel Butler

Hi,

I'm wondering if ISPs in general allow encrypted PPP between your DSL router and the ISP? I have a DSL account with UTV and I tried forcing the router to use MPPE128 after connecting with PPPoE. However the PPPoE connection failed to UTV.

This may seem overly paranoid about privacy, but as in many cases (as in mine) they are people and neighbours I know who work in the local Eircom exchanges.

I assuming given PPP traffic is unencryped, anyone in an Eircom exchange can eavesdrop (with something like Ethereal or something that works on probably ATM?) on what you are doing on Internet. Anyone know if this the case?

For those who might say "If you've nothing to hide, why would you care?" Well the people who work in exchanges are not the government and I'd prefer not having neighbours chatting about what "Wilfing" I was at now and again.

Cheers.

watty

The modem is connected to a DSLAM along with many other modems. That has at least a single connection, maybe fibre. It's a bit more complicated than plugging your laptop in in the exchange. Each PPPoE I think is a kind of VLAN on the DSLAM backhaul connection.

You can only use any encryption supported at both ends. I really wouldn't worry about this.

Snaga

The end PPPoE termination happens on a UTV controlled BAS so its them you need to ask.

They will say 'no' though

The local engineers that are in the exchanges will generally not be allowed to touch the dslams in any case - only the physical cable and the blocks its punched onto - so yeah - its not worth worrying about - you cant just run ethereal on a naked copper pair!

Now the guys back in the NOC on the other hand... *tinfoil hat time*

Noel Butler

Yea I guess UTV don't want the overhead of encryption on their BAS.
And I guess causes of the possible "awkwardness" of intercepting traffic to DSLAM or fibre makes it difficult.

My thought was engineers in exchanges would typically have debugging tools (on the fibre), like network system admins would use something like Ethereal to debug problems.

Cheers for your replies.

lucernarian

That NOC out in Citywest would be the place to look if you're paranoid. There's quite a lot of stuff going on there, and some "development work" takes place there.

axer

What could you possibly need encrypted? The secure sites you visit are already encrypted anyway.

JonathanAnon

Hi,

While this request might be a bit naive (I'm not being insulting Noel I will explain this), it is a legitimate request and worry.

Firstly, even if you send up encryption between your router and the exchange it will still have to be decrypted at Eircom to be router across the net. Unless you wish to set up encryption between your router and every website in the world! One possible way around this would be to use a publicly free proxy server. This would block the Ethereal tapper's view of what you are viewing, as all of your request would have the proxy server IP in the IP header (and not the IP of the site that you are actually viewing). However, if the tapper looks at the contents of the packet they will still be able to see what you are viewing.

Secondly, security especially for Eircom email is a real concern if you think that there is someone in the exchange who would be interested in eavesdropping on your email. POP3/SMTP Email is sent in clear text (unencrypted). The way that I normally find out passwords (from Outlook) in the case where the user doesnt know the passwords is to start up Ethereal on the PC, and do a send/recieve in Outlook. Stop the packet capture in Ethereal and inspect the packets and you will see something like USER Peter, PASS Peter123. It's that simple and it is possible that someone in the exchange could set up their own outlook to take a copy of your email without you knowing. If this is really a problem, you could set up a hotmail account. They shouldnt be able to decrypt that.

As for the remark about using Ethereal on the copper wires, I would have assumed that if you intecept the signal at any where along the line that there is some tool to work out the data. If you encrypt between your router and ISP, this would sort out this problem, but like I said the signal is going to have to be decrypted at the Eircom exchange to be routed across the Internet anyway.

axer

JonathanAnon wrote:

Hi,

While this request might be a bit naive (I'm not being insulting Noel I will explain this), it is a legitimate request and worry.

Firstly, even if you send up encryption between your router and the exchange it will still have to be decrypted at Eircom to be router across the net. Unless you wish to set up encryption between your router and every website in the world! One possible way around this would be to use a publicly free proxy server. This would block the Ethereal tapper's view of what you are viewing, as all of your request would have the proxy server IP in the IP header (and not the IP of the site that you are actually viewing). However, if the tapper looks at the contents of the packet they will still be able to see what you are viewing.

Secondly, security especially for Eircom email is a real concern if you think that there is someone in the exchange who would be interested in eavesdropping on your email. POP3/SMTP Email is sent in clear text (unencrypted). The way that I normally find out passwords (from Outlook) in the case where the user doesnt know the passwords is to start up Ethereal on the PC, and do a send/recieve in Outlook. Stop the packet capture in Ethereal and inspect the packets and you will see something like USER Peter, PASS Peter123. It's that simple and it is possible that someone in the exchange could set up their own outlook to take a copy of your email without you knowing. If this is really a problem, you could set up a hotmail account. They shouldnt be able to decrypt that.

As for the remark about using Ethereal on the copper wires, I would have assumed that if you intecept the signal at any where along the line that there is some tool to work out the data. If you encrypt between your router and ISP, this would sort out this problem, but like I said the signal is going to have to be decrypted at the Eircom exchange to be routed across the Internet anyway.

From what I understand Eircom could not decrypt messages coming between a webserver and the users computer. They could view the source and destination ip addresses etc but the actual data itself could only be decrypted by the web server or the user.

Couldnt a user just use ssl for their pop3 accounts aswell?

Correct me if im wrong though as I would not consider myself an expert in encryption and I do realise encryption can be broken in certain cases.

JonathanAnon

From what I understand Eircom could not decrypt messages"
Understand that all the information that is sent using the HTTP, SMTP, POP, FTP and other protocols is sent in clear text (not encrypted) by default. That is the reason that HTTPS was created and why it is called Secure Socket Layer.

Couldnt a user just use ssl for their pop3 accounts aswell?
Yes, but this needs to be set up on the server side as well. And with most home user accounts you are not given this option.


Correct me if im wrong though as I would not consider myself an expert in encryption and I do realise encryption can be broken in certain cases.
Yes of course, :-), but you have to look at it in perspective. You could then come back to me and say "but someone could just break into my house and take my PC with my email on it". For most home users, any level of encryption will be enough to deter the average hacker/nosy ISP employee. Unless your a Dub supporter living in Drumcondra, who's fond of a pint of Bass.

axer

JonathanAnon wrote:

From what I understand Eircom could not decrypt messages"
Understand that all the information that is sent using the HTTP, SMTP, POP, FTP and other protocols is sent in clear text (not encrypted) by default. That is the reason that HTTPS was created and why it is called Secure Socket Layer. .

yes, I was talking about SSL. Like I said neither eircom nor any other ISP would be able to decrypt the data being sent. If a user/business was so worried about someone being able to eavesdrop on their communications then it would make far more sense to have encryption between the final destinations server and the user and not just between the user and the ISP as you do not know who is working as an administrator in the ISP either.

JonathanAnon wrote:

Couldnt a user just use ssl for their pop3 accounts aswell?
Yes, but this needs to be set up on the server side as well. And with most home user accounts you are not given this option.

But the option is there if needed - which is my point.

@OP: my question still stands - why would you need/want encryption between your router and your ISP when it would make more since to just use SSL to ensure nobody can eavesdrop anywhere along the line?

JonathanAnon

it would make far more sense to have encryption between the final destinations server and the user and not just between the user and the ISP as you do not know who is working as an administrator in the ISP either.
You're not going to give up on this one are you..
Even if you set up SSL for your connection to the POP3 server for collection, the SMTP connection from the sender's email server to your host POP3 server (in this case mail1.eircom.net) will not be secure unless they set up some type of encryption between the two mail servers. So it will be insecure some part along the way.

Take this example, I used to work for a multi national that had an office in Bray and an office in Brussels. There was an Exchange server (Microsoft's email server) in Bray and one in Brussels. Encryption was set up between these two servers so that an email sent from Bray --> Brussels email was encrypted in Bray and decrypted in Brussels and vice versa.

BUT, any mails that were received from people whose mail servers did not have a security association with our server we sent in normal SMTP. For example people sending their CVs for jobs, requests for quotes etc etc from members of the public would be sent across SMTP.

To have total mail security (particularly for mail that you are receiving) you would need some sort of security association with EVERY mail server that is sending you an email and this is not practial to implement.

axer

JonathanAnon wrote:

it would make far more sense to have encryption between the final destinations server and the user and not just between the user and the ISP as you do not know who is working as an administrator in the ISP either.
You're not going to give up on this one are you..
Even if you set up SSL for your connection to the POP3 server for collection, the SMTP connection from the sender's email server to your host POP3 server (in this case mail1.eircom.net) will not be secure unless they set up some type of encryption between the two mail servers. So it will be insecure some part along the way.

Take this example, I used to work for a multi national that had an office in Bray and an office in Brussels. There was an Exchange server (Microsoft's email server) in Bray and one in Brussels. Encryption was set up between these two servers so that an email sent from Bray --> Brussels email was encrypted in Bray and decrypted in Brussels and vice versa.

BUT, any mails that were received from people whose mail servers did not have a security association with our server we sent in normal SMTP. For example people sending their CVs for jobs, requests for quotes etc etc from members of the public would be sent across SMTP.

To have total mail security (particularly for mail that you are receiving) you would need some sort of security association with EVERY mail server that is sending you an email and this is not practial to implement.

Aye, but if you were sending sensitive data in an email you could encrypt the email itself using pgp or whatever.

Again all im saying that it makes no sense to encrypt from a users router to their ISP as there is still a risk. I'm not saying their are no security problems past the ISP but there are ways to secure communications the whole way.

JonathanAnon

Again.. all possible. You could also zip the content of the email with password protect, send it and ring the person with the password, but it's all about practical solutions that are easy to use.

And for the scenario where you have an unknown member of the public user sending an email to info@joescarpets.com because he say the email address on the website, it is not usually feasible/practial to implement any sort of encryption.