0

IP Addresses are pretty common around the internet so they're often easily found in plain text. However, let's say there's a number of IP addresses configured on a server to allow access through a firewall to specific locations. So, 1) these addresses are allowed access to a protected server and 2) someone else owns these IP addresses.

Is it "safe" to send a list of IP addresses to the owner or another trusted entity in plain text? Possibly via email? If not, what is the bare minimum solution that would be "good enough" considering limited resources that I may or may not have?

  • Ever heard of GPG? (Or PGP) – Stolas Mar 17 '14 at 14:34
  • @Stolas: Sure have, and I've used it (PGP) elsewhere. But that isn't something we currently use for an application like this where I am now and takes some time to set up with the other party, which said party may or may not find to be an inconvenience. I'm trying to determine if I should even be concerned first. – Ellesedil Mar 17 '14 at 14:39
  • 1
    Someone who intercepts this list would also have to be able to send traffic from one of those IPs for it to be useful. So long as you're using TCP (instead of say UDP) they shouldn't be able to easily forge traffic from that address. – John Downey Mar 17 '14 at 15:14
4

This is safe in general, though you should be concerned about any services on those machines that are exposed via stateless protocols such as UDP, as the source address can be spoofed. As such, if an attacker knows the IP, they could still send UDP traffic through the firewall by faking the source IP. If you've got no UDP-based protocols exposed then the firewall should be blocking this anyway.

If you're only sending this list once, sending it in the clear isn't the end of the world. It's only a list of IPs, and doesn't contain any credentials, so you should be fine. That said, GPG is a great option for securing email, and really isn't as hard as people think it is. Just install an email client extension and it should do the hard work for you.

3

Easiest way to be a bit more secure is to place the list of IP adresses in a password-protected zip file. 7-zip does this, it's free, uses AES-256, and can also encrypt the files inside in addition to the archive itself. Then you can give the other party the password to the zip file over the phone or via text message.

Not failsafe by any means, but does add a bit more security than just sending the list in the clear over email.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.