51–60 of 378 posts
Earlier quoted context omitted.
Curious. How do you go about (trivially) defeating asymmetric encryption? EDIT: or do you mean to replace "all" (content + js)?
No, just inject some JS that reads the required keys.
That's just wrong and a really unpleasant slippery slope. I hope this causes a huge backlash from users and the internet at large.
> secure protection of Kazakhstan users when using coded access protocols to foreign Internet resources. I guess "coded" here means VPN as well... Wonder how other countries' embassies will be connecting if they block all the encrypted connections? Everything through a satellite connection presumably.
They're unlikely using plain HTTPS for sensitive traffic, as that still divulges what sites you're visiting.
"telecom.kz wants to use your location." NOPE
Wondering about a turtles-all-the-way solution: A web-socket based protocol that opens up a new SSL session with non-MITM'd certificates. So you'd open up the snoop-me HTTPS/1.1 connection, do some GETs, then say "GET /busy, yo", and start what looks like a video-chat conversation that is in fact a regular SSL connection with uncompromised certs. (some protocol) over SSL over Web-Socket over bad-SSL over TCP/IP
That said, there's a remarkable tendency in countries as corrupt as Kazakhstan for a "shadow" telecom network to pop up. Just run in some fiber from a neighboring country on the down-low and distribute locally via microwave dish. Yeah, it's not exactly difficult to locate a powerful dish, but it's also not glaringly obvious so you can usually pay someone to look the other way. After all, the government officials want to look into everyone's communication, but if their own communication was ever intercepted, they would be the target of blackmail! They want to use the information they gather to blackmail citizens like the Stasi, not the other way around.
Of course, the flip side of that are the mobile phone networks operated by the Mexican drug cartels and ISIS. But the only surefire way to avoid government surveillance of this sort is to bypass government regulated telecoms entirely.
And everyone made fun of Netflix for implementing a secure protocol on top of http. Suddenly that seems really useful for people in Kazakhstan. http://techblog.netflix.com/2014/10/message-security-layer-m... https://github.com/Netflix/msl
And everyone made fun of Netflix for implementing a secure protocol on top of http. Suddenly that seems really useful for people in Kazakhstan. http://techblog.netflix.com/2014/10/message-security-layer-m... https://github.com/Netflix/msl
If the protocol is delivered over HTTP and runs in Javascript DOM context, it will be straightforward for an adversary that MITMs all traffic to defeat it.