Hacker News Reader

I don't see how this resolves BGP hijacking attacks? If I announce a more specific route all four locations should still land on my hijacked network... Or is this trying to race the BGP propagation?

View on HN

It doesn't "resolve" BGP attacks. The point is an attacker would have to pull off three or four successful attacks at once, which is harder than pulling off just one, especially if they hope to go unnoticed.

Or of course for smaller targets their attack is just much closer to the target than to any of the multiple viewpoints, and so this mitigation makes no difference to them whatsoever.

We shall see how well this works in practice. Assuming it's relatively cheap it's harmless to at least try.

If the domain is hosted on a /24, then more specific routes will be filtered out by default in most ASes. Also, with the increasing adoption of RPKI, in conjunction with its maxlength option, more specific attacks will be a challenge for adversaries.

If you announce a matching /24 it will fall back to shortest distance. If the original network has a long AS path, you can still hijack from a moderately well connected network.

Reply on news.ycombinator.com