So, the next step is encrypting the content before sending it through TLS...TLS over TLS
A VPN or SSH tunnel w/proxying is essentially this with a dedicated jump point.
Kazakhstan to MitM all HTTPS traffic starting Jan 1
31–40 of 378 posts
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#32wait till private keys for the cert are leaked by some disgruntled telecom company employee.. Puts the whole country internet at risk.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#33Makes me wonder how long such policy would last if Google, Facebook, and Microsoft would ignore traffic from Kazakhtelecom MITM server (or just drop the whole Kazakhtelecom IP address space). Of course I'm not saying that they should do that.
Actually they really should. As soon as major networks start saying NO is when governments change, I think this is one of the few times where this kind of pressure would be mostly good.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#34Love the Orwellian Newspeak: a "National Security Certificate" to protect people accessing "foreign resources"... If you don't know anything about the subject it really sounds like they're doing you a favor.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#35Google and Mozilla should blacklist the certificate once it's made public.
That would just stop their browsers from working in Kazakhstan on HTTPS sites, who would most likely respond by issuing a new certificate and/or recommending IE. It may also discourage websites from implementing HTTPS. Not sure how this will work with certificate pinning, though. Will sites like Google become inaccessible?
No, because locally-installed certificates override pins.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#36Google and Mozilla should blacklist the certificate once it's made public.
That would make people in the US feel better, but it wouldn't make any difference. If a country can force residents to install software or reconfigure their machines, there's nothing browser vendors can do to make those residents secure. Essentially, Kazakhstan owns (in both senses) the Internet-connected computers of all its residents, and it can do whatever it wants with them.
It's also well within Kazakhstan's budget to do subtler, harder-to-defeat things to stop MITM circumvention. This is an arms race that Google will lose.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#37And everyone made fun of Netflix for implementing a secure protocol on top of http. Suddenly that seems really useful for people in Kazakhstan.
http://techblog.netflix.com/2014/10/message-security-layer-m...
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#38So, the next step is encrypting the content before sending it through TLS...TLS over TLS
If they can unwrap the first layer of encryption, and most normal traffic inside isn't encrypted, people tunneling through MITM'd TLS are playing a game of cat and mouse with a very well-funded adversary that can imprison, torture, or kill them.
Obviously, a lot of people do this kind of thing in China, and from what we know, circumventing the "Great Firewall" isn't routinely getting people killed. But people should know what they're doing before they try it in Kazakhstan.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#39I really appreciate how they're doing this. The Chinese built up an amazing infrastructure for the Great Firewall; the Kazakhs just say "install our cert!" The Chinese spend billions and have to stay ahead of all of their citizens' clever new ideas at all times; the Kazakhs spend a few hundred and just need to point guns at their citizens until they install a cert. Sure, it's going to be difficult to enforce, but it…
easy to enforce inside the country. Just set it so that there's no https if you don't have the cert! It is becoming a legal requirement for all telcos in the country so even if you're roaming (with a data plan from a foreign provider, for example) - you're still using the local telcos. Only way to avoid is to use some kind of foreign satellite internet or maybe private / non government / non telco dark fibre.
I guess VPN is the only way to avoid it. Or sshuttle or something over port 80. But then again, how long will it take before they can detect that and then block it?!
Or you can use non-standard ports, and change them continuously.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#40And everyone made fun of Netflix for implementing a secure protocol on top of http. Suddenly that seems really useful for people in Kazakhstan. http://techblog.netflix.com/2014/10/message-security-layer-m... https://github.com/Netflix/msl
If the protocol is delivered over HTTP and runs in Javascript DOM context, it will be straightforward for an adversary that MITMs all traffic to defeat it.