41–50 of 378 posts
Earlier quoted context omitted.
That makes it only more interesting. However, I assume, IP-based location isn't that granular?
It's very surprisingly granular. I logged dropped packets from my router's firewall for a week and looked up the origin locations with geoip for fun. Just plugging in the coordinates to google maps would zoom directly in on peoples' houses (sometimes in the middle of nowhere). I'm not sure it's 100% accurate, of course, but it sure seemed specific.
And everyone made fun of Netflix for implementing a secure protocol on top of http. Suddenly that seems really useful for people in Kazakhstan. http://techblog.netflix.com/2014/10/message-security-layer-m... https://github.com/Netflix/msl
If the protocol is delivered over HTTP and runs in Javascript DOM context, it will be straightforward for an adversary that MITMs all traffic to defeat it.
EDIT: or do you mean to replace "all" (content + js)?
And everyone made fun of Netflix for implementing a secure protocol on top of http. Suddenly that seems really useful for people in Kazakhstan. http://techblog.netflix.com/2014/10/message-security-layer-m... https://github.com/Netflix/msl
If the protocol is delivered over HTTP and runs in Javascript DOM context, it will be straightforward for an adversary that MITMs all traffic to defeat it.
Until they figure it out and start blocking that too of course.
So like, what's the plan for people visiting Kazakhstan here? Install some rando's SSL certificate in your trust store or just not be allowed to access the internet?
Earlier quoted context omitted.
If the protocol is delivered over HTTP and runs in Javascript DOM context, it will be straightforward for an adversary that MITMs all traffic to defeat it.
Curious. How do you go about (trivially) defeating asymmetric encryption? EDIT: or do you mean to replace "all" (content + js)?
Google and Mozilla should blacklist the certificate once it's made public.
Not everything can be changed from the beautiful plains of Silicon Valley.
So like, what's the plan for people visiting Kazakhstan here? Install some rando's SSL certificate in your trust store or just not be allowed to access the internet?
They're likely only intercepting known https traffic (port 443). If you use a VPN and tunnel all traffic you probably won't have any issues. If a nation-state with the resources of China has come up with a system that can still be (albeit nontrivially) bypassed then I would imagine Kazakhstan will have a much-less-sophisticated first iteration.
A web-socket based protocol that opens up a new SSL session with non-MITM'd certificates.
So you'd open up the snoop-me HTTPS/1.1 connection, do some GETs, then say "GET /busy, yo", and start what looks like a video-chat conversation that is in fact a regular SSL connection with uncompromised certs.
(some protocol) over SSL over Web-Socket over bad-SSL over TCP/IP
So, the next step is encrypting the content before sending it through TLS...TLS over TLS
This is the biggest problem when governments go this route.