Live data from Hacker News

Kazakhstan to MitM all HTTPS traffic starting Jan 1

telecom.kz

11–20 of 378 posts

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#11
post #2

> The national security certificate will secure protection of Kazakhstan users when using coded access protocols to foreign Internet resources. How is this protecting users? They are outright lying here, if I understand correctly. Also why are they asking for my location? http://i.imgur.com/fYKHRK1.png

At least they are honest - spying and not hiding it ;)

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#12
post #7
post #4

Earlier quoted context omitted.

Remember they have your location anyway from your IP address.

That makes it only more interesting. However, I assume, IP-based location isn't that granular?

It's very surprisingly granular. I logged dropped packets from my router's firewall for a week and looked up the origin locations with geoip for fun. Just plugging in the coordinates to google maps would zoom directly in on peoples' houses (sometimes in the middle of nowhere). I'm not sure it's 100% accurate, of course, but it sure seemed specific.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#13
post #2

> The national security certificate will secure protection of Kazakhstan users when using coded access protocols to foreign Internet resources. How is this protecting users? They are outright lying here, if I understand correctly. Also why are they asking for my location? http://i.imgur.com/fYKHRK1.png

It's a really backwards way to customize a phone number on their site. They POST your geocode to their server and based on the city you're in change the area/country code. Quite a strange way to do it, but hey.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#14
> secure protection of Kazakhstan users when using coded access protocols to foreign Internet resources.

I guess "coded" here means VPN as well...

Wonder how other countries' embassies will be connecting if they block all the encrypted connections? Everything through a satellite connection presumably.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#15

I really appreciate how they're doing this. The Chinese built up an amazing infrastructure for the Great Firewall; the Kazakhs just say "install our cert!" The Chinese spend billions and have to stay ahead of all of their citizens' clever new ideas at all times; the Kazakhs spend a few hundred and just need to point guns at their citizens until they install a cert. Sure, it's going to be difficult to enforce, but it…

easy to enforce inside the country. Just set it so that there's no https if you don't have the cert! It is becoming a legal requirement for all telcos in the country so even if you're roaming (with a data plan from a foreign provider, for example) - you're still using the local telcos.

Only way to avoid is to use some kind of foreign satellite internet or maybe private / non government / non telco dark fibre.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#17
post #7
post #4

Earlier quoted context omitted.

Remember they have your location anyway from your IP address.

That makes it only more interesting. However, I assume, IP-based location isn't that granular?

Try normal Geo-IP (Maxmind) and it will show the local telco exchange.

I am sure the NSA does better but Kazakhstan? I have been inside one of their embassies to be shocked that they were watching the news on a black and white CRT TV!!!

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#18
post #7

Earlier quoted context omitted.

That makes it only more interesting. However, I assume, IP-based location isn't that granular?

It's very surprisingly granular. I logged dropped packets from my router's firewall for a week and looked up the origin locations with geoip for fun. Just plugging in the coordinates to google maps would zoom directly in on peoples' houses (sometimes in the middle of nowhere). I'm not sure it's 100% accurate, of course, but it sure seemed specific.

On the other hand, my ip "resolves" via geoip to a city about 500 kilometers away so I guess it depends on what database you use and what country.

The city it resolves to is where my isp has their HQ.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#19
post #14

> secure protection of Kazakhstan users when using coded access protocols to foreign Internet resources. I guess "coded" here means VPN as well... Wonder how other countries' embassies will be connecting if they block all the encrypted connections? Everything through a satellite connection presumably.

They're unlikely using plain HTTPS for sensitive traffic, as that still divulges what sites you're visiting.
Post reply on HN