Why can't Internet companies simply block the entire backward country? I can't imagine Borat's motherland traffic monitizes well anyway. You want to MITM? Fine, build your own Kazakh Google.
Kazakhstan to MitM all HTTPS traffic starting Jan 1
81–90 of 378 posts
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#82So, the next step is encrypting the content before sending it through TLS...TLS over TLS
If they can unwrap the first layer of encryption, and most normal traffic inside isn't encrypted, people tunneling through MITM'd TLS are playing a game of cat and mouse with a very well-funded adversary that can imprison, torture, or kill them. Obviously, a lot of people do this kind of thing in China, and from what we know, circumventing the "Great Firewall" isn't routinely getting people killed. But people should…
Next step: steganography
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#83Woah, it can't be stressed how bad this is. If this succeeds, other countries will definitely follow! If it can be shown to work, it will be demanded that this be implemented by pretty much everyone for difficult to deny political reasons (terrorists, children, crime, etc)
This feels like the first bullet in a new war that will occur in every parliament world wide.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#84Earlier quoted context omitted.
If they can unwrap the first layer of encryption, and most normal traffic inside isn't encrypted, people tunneling through MITM'd TLS are playing a game of cat and mouse with a very well-funded adversary that can imprison, torture, or kill them. Obviously, a lot of people do this kind of thing in China, and from what we know, circumventing the "Great Firewall" isn't routinely getting people killed. But people should…
Next step: steganography
Steganography needs vast quantities of cover data. You're increasing the bandwidth costs dramatically when you recommend steganography for everything.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#85While there are probably 100 different ways to avoid this and retain secure traffic, I would venture to guess that the average Internet savvy-ness of Kazakhstan is pretty low, so using any of them would single you out for additional government attention (whether you're actually doing anything illegal or not). That said, there's a remarkable tendency in countries as corrupt as Kazakhstan for a "shadow" telecom network…
Kazakhstan is possibly more democratic than all its neighbours save maybe Kirghizstan (I'm not up do date on the current government position). More democratic as in I can't make up who's more of a despot between Putin and Nazarbayev, after all they both win open elections, albeit with an iron grip on medias... But then Kirghizstan is likely depending on its neighbours for connectivity (also landlocked). The other nei…
While Russia does encroach on various Internet liberties, it does so quite lazily so far. It does not have a great firewall, it does not have force-fed SSL certs, it does not crack down on the widespread VPN usage. When Roskomnadzor blacklists certain resources, Internet providers enforce it at their leisure, it seems, because different users report a resource either be blocked or not.
"The strictness of Russian laws is compensated by their optional enforcement", as they say.
In a smaller country like Kazakhstan such things are easier to enforce, probably.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#86This is what HTTP Public Key Pinning (HPKP) protects against.
It allows a server to specify the only set of certificates that a browser should accept. Meaning that MITM'ing is impossible, without a valid cert in the chain of one of the advertised trusted certificates from the server.
Chrome, Firefox, Opera, Chrome for Android, and the Android stock browser all support it.
I'm not sure how they intend to circumvent this problem, apart from perhaps just instructing users to not use those browsers? That's quite difficult to put into practice.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#87Why can't Internet companies simply block the entire backward country? I can't imagine Borat's motherland traffic monitizes well anyway. You want to MITM? Fine, build your own Kazakh Google.
That would actually be a huge win for Kazakhstan. Much like China pushing people to use Baidu and other state friendly services instead of Western owned services.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#88"telecom.kz wants to use your location." NOPE
I wonder why that website needs your location... After all it's just a news article / press release.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#89This is what HTTP Public Key Pinning (HPKP) protects against. It allows a server to specify the only set of certificates that a browser should accept. Meaning that MITM'ing is impossible, without a valid cert in the chain of one of the advertised trusted certificates from the server. Chrome, Firefox, Opera, Chrome for Android, and the Android stock browser all support it. I'm not sure how they intend to circumvent th…
No, it isn't. Locally installed certificates override pins; if they didn't, HPKP browsers wouldn't be deployable inside large companies that have regulatory requirements to monitor traffic from their own desktops, and there would be no benefit, because an adversary who can install software or reconfigure your machine can defeat pins in a variety of other less transparent ways.
HPKP is great, but it doesn't address this problem.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#90Google, Facebook, Yahoo, Microsoft, Salesforce, Box, Dropbox, Twitter, etc. could have a very strong influence on changing this if they banded together to respond to this in some way. The government might be doing what they think is right, but public backlash can change policy almost overnight. We saw this in the US recently with SOPA/PIPA. The "Internet" response was unprecedented. The people of Kazakhstan can achie…
What should these companies responses be? And why should the kazach goverment care? They'd prefer if the poeple used russian (or kazach) copy cats like vkontakte anyway.
The government preference isn't important, citizen preference is.
As to what they can do... it's a range from info to painful, but they can choose a range of options from serving up interstitials in a localized language that explains the issues, problems, and privacy and security implications... all the way to deny service.
If the citizens demand access to those services, or find it offensive that their privacy and security is being violated and circumvented, they will take action.
And these companies can help orchestrate, just as we did with SOPA/PIPA.