This is extremely relevant to my interests but I don't actually understand what's happening here. Part of that is the awkward translation. Can I get a more detailed description and/or some links to help me understand?
Thanks!
Kazakhstan to MitM all HTTPS traffic starting Jan 1
101–110 of 378 posts
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#102This is what HTTP Public Key Pinning (HPKP) protects against. It allows a server to specify the only set of certificates that a browser should accept. Meaning that MITM'ing is impossible, without a valid cert in the chain of one of the advertised trusted certificates from the server. Chrome, Firefox, Opera, Chrome for Android, and the Android stock browser all support it. I'm not sure how they intend to circumvent th…
No, it isn't. Locally installed certificates override pins; if they didn't, HPKP browsers wouldn't be deployable inside large companies that have regulatory requirements to monitor traffic from their own desktops, and there would be no benefit, because an adversary who can install software or reconfigure your machine can defeat pins in a variety of other less transparent ways. HPKP is great, but it doesn't address th…
You used the words install software for the second time and makes me wonder if the citizens of Khazakstan will be force to install an executable or just a certificate, because you make it sound a lot more scary than it looks like or I maybe I did not fully understand the repercussions.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#103Earlier quoted context omitted.
No, because locally-installed certificates override pins.
Depends on how the app is implemented. Doesn't have to be that way at all, and shouldn't if properly pinned.
Individual applications (not browsers) can of course hardcode pins that aren't overridden. Those applications will simply stop working in Kazakhstan.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#104Earlier quoted context omitted.
No, it isn't. Locally installed certificates override pins; if they didn't, HPKP browsers wouldn't be deployable inside large companies that have regulatory requirements to monitor traffic from their own desktops, and there would be no benefit, because an adversary who can install software or reconfigure your machine can defeat pins in a variety of other less transparent ways. HPKP is great, but it doesn't address th…
As an aside, this is one of the reasons why I believe locally installed certificates overriding pinning has a quickly eroding shelf life... At some point, something bad will happen like this (or malware-based) and Chrome will raise their hand and say, "sorry enterprises, no more MITM at all, even for locally installed certificates." After that, IE and Firefox will follow and crypto will no longer be so trivially subv…
Response from Chrome engineers I've heard is that they won't try to fight this, because anything intentionally overridden locally is already a game over.
If they block custom certificates, then malware will patch the process to disable the checks.
And in this case the Kazakh government could say "For your safety, the Chrome doesn't work with our Internet. Please use our Khrome instead".
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#105Earlier quoted context omitted.
As an aside, this is one of the reasons why I believe locally installed certificates overriding pinning has a quickly eroding shelf life... At some point, something bad will happen like this (or malware-based) and Chrome will raise their hand and say, "sorry enterprises, no more MITM at all, even for locally installed certificates." After that, IE and Firefox will follow and crypto will no longer be so trivially subv…
That's another arms race Chrome will lose, because the market for the kinds of enterprise configuration management and "host protection" tools that could override this policy exists and is very lucrative. Chrome would simply be begging enterprise security companies to release products to fuck up their browser. I disagree with you.
Part of me hopes you are right, because I don't like seeing Chrome/Google throw it's muscle around.
Part of me hopes you are wrong, because I think encryption and security don't need to be opposing forces and MITM isn't required for strong security (though maybe for good GRC and audit).
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#106Earlier quoted context omitted.
What should these companies responses be? And why should the kazach goverment care? They'd prefer if the poeple used russian (or kazach) copy cats like vkontakte anyway.
The government preference isn't important, citizen preference is. As to what they can do... it's a range from info to painful, but they can choose a range of options from serving up interstitials in a localized language that explains the issues, problems, and privacy and security implications... all the way to deny service. If the citizens demand access to those services, or find it offensive that their privacy and s…
> If the citizens demand access to those services, or find it offensive that their privacy and security is being violated and circumvented, they will take action.
Hah, right. They'll just file a complaint to their ombudsman and the Congress will take care of it.
No, this is Kazakhstan, not California. If citizens band up and demand something that the government is against, the police will crack down on their homes, arrest 15,000 people at random out of which only 10,000 or so will return to their homes (not necessarily alive), and the remaining 5,000 will rot in jail for high treason. And if they keep getting wise ideas, they'll send in the army.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#107If we could rebuild the internet from scratch knowing that someone would try to do this, what measures could be put in place to make it impossible to MITM traffic (in other words, make it so the only option is to install monitoring software directly on the user's machine)? Is this something which even can be defeated with current cryptographic theory?
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#108This is extremely relevant to my interests but I don't actually understand what's happening here. Part of that is the awkward translation. Can I get a more detailed description and/or some links to help me understand? Thanks!
I'm sure someone else can explain it better than me, but they want all of their citizens to install a certificate on all of their internet capable devices that will route all their traffic through the government so they can see all of it. It's a man in the middle attack on the entire population.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#109Earlier quoted context omitted.
That's another arms race Chrome will lose, because the market for the kinds of enterprise configuration management and "host protection" tools that could override this policy exists and is very lucrative. Chrome would simply be begging enterprise security companies to release products to fuck up their browser. I disagree with you.
Part of me hopes you are right, because I don't like seeing Chrome/Google throw it's muscle around. Part of me hopes you are wrong, because I think encryption and security don't need to be opposing forces and MITM isn't required for strong security (though maybe for good GRC and audit).
Key pinning you can't override locally is DRM.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#110Earlier quoted context omitted.
As an aside, this is one of the reasons why I believe locally installed certificates overriding pinning has a quickly eroding shelf life... At some point, something bad will happen like this (or malware-based) and Chrome will raise their hand and say, "sorry enterprises, no more MITM at all, even for locally installed certificates." After that, IE and Firefox will follow and crypto will no longer be so trivially subv…
That's another arms race Chrome will lose, because the market for the kinds of enterprise configuration management and "host protection" tools that could override this policy exists and is very lucrative. Chrome would simply be begging enterprise security companies to release products to fuck up their browser. I disagree with you.
Or someone just forks Chromium and releases Chromium For Enterprise.