Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kazakhstan to MitM all HTTPS traffic starting Jan 1

telecom.kz

Post reply on HN
Print view View original

91–100 of 378 posts

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#91

Post by azinman2 »

tptacek wrote: post #35
nsgi wrote: post #29

Earlier quoted context omitted.

That would just stop their browsers from working in Kazakhstan on HTTPS sites, who would most likely respond by issuing a new certificate and/or recommending IE. It may also discourage websites from implementing HTTPS. Not sure how this will work with certificate pinning, though. Will sites like Google become inaccessible?

No, because locally-installed certificates override pins.

Depends on how the app is implemented. Doesn't have to be that way at all, and shouldn't if properly pinned.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#92

Post by davidu »

tptacek wrote: post #89
danpalmer wrote: post #86

This is what HTTP Public Key Pinning (HPKP) protects against. It allows a server to specify the only set of certificates that a browser should accept. Meaning that MITM'ing is impossible, without a valid cert in the chain of one of the advertised trusted certificates from the server. Chrome, Firefox, Opera, Chrome for Android, and the Android stock browser all support it. I'm not sure how they intend to circumvent th…

No, it isn't. Locally installed certificates override pins; if they didn't, HPKP browsers wouldn't be deployable inside large companies that have regulatory requirements to monitor traffic from their own desktops, and there would be no benefit, because an adversary who can install software or reconfigure your machine can defeat pins in a variety of other less transparent ways. HPKP is great, but it doesn't address th…

As an aside, this is one of the reasons why I believe locally installed certificates overriding pinning has a quickly eroding shelf life... At some point, something bad will happen like this (or malware-based) and Chrome will raise their hand and say, "sorry enterprises, no more MITM at all, even for locally installed certificates."

After that, IE and Firefox will follow and crypto will no longer be so trivially subverted by enterprise organizations.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#93

Post by briandear »

Sleaker wrote: post #33
zokier wrote: post #23

Makes me wonder how long such policy would last if Google, Facebook, and Microsoft would ignore traffic from Kazakhtelecom MITM server (or just drop the whole Kazakhtelecom IP address space). Of course I'm not saying that they should do that.

Actually they really should. As soon as major networks start saying NO is when governments change, I think this is one of the few times where this kind of pressure would be mostly good.

And it wouldn't work. You've apparently have never been stuck inside China. I was there for a few years and it was brutal, network wise. Local companies just replace what can't be accessed from the outside.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#94

Post by ascendantlogic »

davidu wrote: post #72

Google, Facebook, Yahoo, Microsoft, Salesforce, Box, Dropbox, Twitter, etc. could have a very strong influence on changing this if they banded together to respond to this in some way. The government might be doing what they think is right, but public backlash can change policy almost overnight. We saw this in the US recently with SOPA/PIPA. The "Internet" response was unprecedented. The people of Kazakhstan can achie…

Because having the NSA snoop on them is clearly preferable.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#95

Post by untothebreach »

coldcode wrote: post #76

If all of their https traffic is compromised, would we not be able to break all of their financial traffic remotely?

Not necessarily, it just means that Kazakh citizens will have a root cert installed on their machine that will allow the government to MITM their https connections. The connection between the MITM and the client will be encrypted (just with the government-controlled cert instead of the server's cert), and the MITM will have an encrypted connection to the server. I suppose it is possible that the MITM could make an unencrypted connection to the server, but I don't know a good reason for the government to do that.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#96

Post by danpalmer »

tptacek wrote: post #89
danpalmer wrote: post #86

This is what HTTP Public Key Pinning (HPKP) protects against. It allows a server to specify the only set of certificates that a browser should accept. Meaning that MITM'ing is impossible, without a valid cert in the chain of one of the advertised trusted certificates from the server. Chrome, Firefox, Opera, Chrome for Android, and the Android stock browser all support it. I'm not sure how they intend to circumvent th…

No, it isn't. Locally installed certificates override pins; if they didn't, HPKP browsers wouldn't be deployable inside large companies that have regulatory requirements to monitor traffic from their own desktops, and there would be no benefit, because an adversary who can install software or reconfigure your machine can defeat pins in a variety of other less transparent ways. HPKP is great, but it doesn't address th…

Ah, Thanks for clearing that one up! As much as I dislike it, that reasoning does make sense.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#98

Post by tptacek »

davidu wrote: post #92
tptacek wrote: post #89

Earlier quoted context omitted.

No, it isn't. Locally installed certificates override pins; if they didn't, HPKP browsers wouldn't be deployable inside large companies that have regulatory requirements to monitor traffic from their own desktops, and there would be no benefit, because an adversary who can install software or reconfigure your machine can defeat pins in a variety of other less transparent ways. HPKP is great, but it doesn't address th…

As an aside, this is one of the reasons why I believe locally installed certificates overriding pinning has a quickly eroding shelf life... At some point, something bad will happen like this (or malware-based) and Chrome will raise their hand and say, "sorry enterprises, no more MITM at all, even for locally installed certificates." After that, IE and Firefox will follow and crypto will no longer be so trivially subv…

That's another arms race Chrome will lose, because the market for the kinds of enterprise configuration management and "host protection" tools that could override this policy exists and is very lucrative. Chrome would simply be begging enterprise security companies to release products to fuck up their browser.

I disagree with you.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#99

Post by minimuffins »

davidu wrote: post #90
1ris wrote: post #80

Earlier quoted context omitted.

What should these companies responses be? And why should the kazach goverment care? They'd prefer if the poeple used russian (or kazach) copy cats like vkontakte anyway.

The government preference isn't important, citizen preference is. As to what they can do... it's a range from info to painful, but they can choose a range of options from serving up interstitials in a localized language that explains the issues, problems, and privacy and security implications... all the way to deny service. If the citizens demand access to those services, or find it offensive that their privacy and s…

You're talking like Kazakhstan is a functional democracy. http://exiledonline.com/the-massacre-everyone-ignored-70-str...

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#100

Post by orf »

dujiulun2006 wrote: post #28
kaizendad wrote: post #6

I really appreciate how they're doing this. The Chinese built up an amazing infrastructure for the Great Firewall; the Kazakhs just say "install our cert!" The Chinese spend billions and have to stay ahead of all of their citizens' clever new ideas at all times; the Kazakhs spend a few hundred and just need to point guns at their citizens until they install a cert. Sure, it's going to be difficult to enforce, but it…

Chinese govt is also capable of doing this. Best part? We even have our trusted* root certificate! Could this get any "better"? Sure! We can even MITM all the OUTGOING https traffic if we want! #GitHubDDoS * Recently un-trusted by Apple and Mozilla. https://support.apple.com/en-us/HT204938

To be fair they really fucked up a couple of stages of that GitHub DDOS and made it trivial to stop.
Post reply on HN