Hi Dan,

Your product idea seems intriguing, but I have some concerns. Specifically, it has one basic architectural flaw which leads to two related but distinct security risks.

You wrote (emphasis mine):

“Zipline is an IPSec VPN tunnel to *a* secure network *that I admin*. This solves for baddies *on the LAN* doing anything nefarious[…]”

It does indeed protect Zipline users from LAN attacks. In particular, the choice of IPSec instead of SSL tunnels is a good one. But such a system inherently places its users at extreme risk of any “baddies,” as you say, who may gain or have access to the Zipline servers themselves.

For the benefit of readers without a background in network security, the basic issue is this: a normal user in a coffee shop, browsing the web on the wireless connection, is engaging in insecure network behavior that looks like this (— is an insecure connection, === is a secure one):

[laptop]—[router]—/internet/—[website]

Note that the route between the coffee shop router and the website in question could be through all sorts of different combinations of network resources, varying per request. But all of your traffic is going through the coffee shop router, so if an attacker takes it over, you are hosed.

Dan proposes to securely route your traffic through Zipline, after which it proceeds insecurely:

[laptop]===[router]===/internet/===[zipline]—/internet/—[website]

Zipline now assumes all of the same problems that the coffee shop’s router had before: if an attacker takes Zipline over, you are hosed. But it’s actually worse than that, because it’s not just one Zipline user that gets hosed. They all do. Actually, by aggregating many users’ traffic to a known and shared network location, Zipline itself becomes an attractive target for hackers, thus exposing its users to many more hacking attempts than the mostly-empty coffee shop they frequent. With Zipline, you don’t have to worry that there’s one person *in your coffee shop* sniffing your traffic, you have to hope that there’s not one person *in the world* that’s decided to attack the Zipline servers.

The product is very aptly named—while a zipline enables its users to skip past potentially dangerous terrain, ziplines are major sources of danger in their own right.

By aggregating user traffic to one known service, Zipline itself becomes a *much more attractive target* for hackers. The benefit of Zipline (slightly increased protection against boneheads in coffee shops) doesn’t justify the cost of aggregating user traffic, inserting a known network route and server into the packet path, and (presumably) having to secure a new codebase of cert management. And having to trust an unknown third party, which brings me to the second basic security issue with Zipline.

Putting aside the increased risk of attack from outside, the Zipline scheme also requires its users to trust the Zipline network operators. You’re asking your users to put all of their security eggs into one basket—your basket—which is basically the same as asking your users to trust you *completely*. A service such as Zipline would have to have mint-level credibility for users to trust it sufficiently.

Earlier in your email, you rhetorically asked:

“Do you find yourself in coffee shops, or other public wifi frequently and sometimes wonder who is watching your traffic?”

This is a really interesting question, because it highlights this second core security problem precisely. Dan, you’re a well-known perpetrator of *exactly the kind of exploit* you claim to protect Zipline users *from*.

No one can be sure how frequently you engage in such behavior. I’ve heard of several incidents, at least one of which is well-documented[1]:
on 27 December 2008 you attended a meeting of the Linux Users of Southern California, at which you performed a man-in-the-middle attack on the coffee shop’s wireless network.

For the benefit of any of your potential customers reading this list, here are some of the details from Dan’s victims that evening:

David Kaiser wrote, in [2]:

“Right. ARP spoofing made everyone’s laptop on that network send their packets to Dan’s laptop instead of to the router. ARP spoofing can be done with a number of little tools that any script kiddie can download and run. And that’s the problem with script kiddies – they actually haven’t done anything innovative… I don’t think Dan Tentler actually wrote any code or ever did anything original – certainly nothing educational to the group – he just ran someone else’s application and harvested everyone’s packets looking for personal information. Any one of us could do that (but none of us have except for him.) The big issue I have with his actions is that at the end of the night we all had a big question mark about what amount of our information was exposed. It would be different if we saw his screen and saw when he started & stopped the capturing, and were able to audit his equipment and personally verify what of our personal data he either did or didn’t have at the end of the night – but instead we have a big question mark. Yes, Dan Tentler says he didn’t log any of the data and that he erased his capture session – but I don’t know him well enough to trust his words on face value like that. I certainly don’t find his actions (either online or in person) that trustworthy. So in my mind that means that any personal data (username, password, IP numbers, etc.) that anyone transmitted to the network on Saturday night is under a big question mark – we can’t verify that he didn’t retain it – no matter what he says about the issue.

He continued in [3]:
When the issue with Dan Tentler being dishonest and stealing people’s passwords first arose on Saturday night, he had numerous chances to be honest, contrite, forthcoming, and at least try to explain himself properly – and he didn’t.[…]

When Chris really found that he was the culprit, he passed it off as if it was some research project. When the issue of having intercepted gmail passwords and such came up – he made the comment that it was all harmless because he wasn’t going to save the log of his capturing activity. Yet he didn’t – he kept right on capturing other packets, and didn’t actually demonstrate that he had cleared the captured log. […]
there were numerous chances during the conversation as it developed that evening, where he could have provided us with a reason to supply that benefit, where we would be generous with our opinions of him – but every time he chose the wrong course, with either denial or dishonesty. […] If you want to give him the benefit of the doubt, please do – but people that started off trying to give the benefit of the doubt were quickly convinced that he didn’t deserve it based on his actions.[…] He has not provided any proof of deniable culpability – and when someone like him is observed doing the activities he was doing – proving to everyone that he was clean should have been the very first thing he did.

All in all, it’s a shameful act for someone who claims to be a security professional. Security professionals only do what’s within their bounds, and don’t shrug at legalities like Dan Tentler did. Security professionals don’t infringe on people’s privacy for sport like Dan Tentler did.

Loren Cress said, in [4]:

He claims to be a “security professional” but Dan Tentler’s unprofessional actions demonstrate his *inexperience, immaturity, and dishonesty*. This kind of thing might have been fun in high school, but it is not the kind of thing I’ve come to expect from a 29-year old adult. […] Dave said “[…] they have the right to be upset about the potential serious loss of privacy.” I disagree – this was not a *potential* loss. It was a *violation of privacy*, period. […] Anybody sitting in that cafe had a “reasonable expectation of privacy.” Dan Tentler violated that privacy, and by being associated with the group, violated the trust of the members.

In summary:

The architecture of Zipline is dubious from a security standpoint, and moreover, we have every reason to believe that its operators are precisely the sort of script-kiddies Zipline purports to protect people from.

Dan, you are the fox, offering hens your services as henhouse manager. Moreover, you expect them to pay for it! The mind boggles.

Ted

1. See the email thread beginning with:
http://socallinux.org/pipermail/linuxusers/2008-December/005946.html
2. http://socallinux.org/pipermail/linuxusers/2008-December/005952.html
3. http://socallinux.org/pipermail/linuxusers/2008-December/005965.html
4. http://socallinux.org/pipermail/linuxusers/2008-December/005978.html

Hi,

I didn’t authorize the re-posting of my email above, and would appreciate it if it were removed. Thanks!