Love the Orwellian Newspeak: a "National Security Certificate" to protect people accessing "foreign resources"... If you don't know anything about the subject it really sounds like they're doing you a favor.
[deleted]
Kazakhstan to MitM all HTTPS traffic starting Jan 1
111–120 of 378 posts
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#112Earlier quoted context omitted.
Next step: steganography
Steganography needs vast quantities of cover data. You're increasing the bandwidth costs dramatically when you recommend steganography for everything.
Steganography needs vast quantities of cover data.
Porn? Perhaps the world's smut peddlers will become beacons of freedom and civil disobedience? (Sounds like a Neal Stephenson book.)
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#113Makes me wonder how long such policy would last if Google, Facebook, and Microsoft would ignore traffic from Kazakhtelecom MITM server (or just drop the whole Kazakhtelecom IP address space). Of course I'm not saying that they should do that.
It would probably have to be the entire IP address space, since they could transparently source NAT on the MITM server to make it look like it's coming from the user's IP.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#114Earlier quoted context omitted.
No, it isn't. Locally installed certificates override pins; if they didn't, HPKP browsers wouldn't be deployable inside large companies that have regulatory requirements to monitor traffic from their own desktops, and there would be no benefit, because an adversary who can install software or reconfigure your machine can defeat pins in a variety of other less transparent ways. HPKP is great, but it doesn't address th…
You used the words install software for the second time and makes me wonder if the citizens of Khazakstan will be force to install an executable or just a certificate, because you make it sound a lot more scary than it looks like or I maybe I did not fully understand the repercussions.
It's pretty trivial to detect if a browser trusts your CA with client side javascript. Such javascript could be injected into HTTP pages and throw up a div covering the page until the certificate is installed (instructions provided, of course).
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#115Google, Facebook, Yahoo, Microsoft, Salesforce, Box, Dropbox, Twitter, etc. could have a very strong influence on changing this if they banded together to respond to this in some way. The government might be doing what they think is right, but public backlash can change policy almost overnight. We saw this in the US recently with SOPA/PIPA. The "Internet" response was unprecedented. The people of Kazakhstan can achie…
Google, Facebook, Yahoo, etc tried this in China and failed. It inconvenienced the people, but it's not going to cause a popular uprising. In the west, you forget that guns and the threat of raw violence by the government are a very real deterrent
Kazakhstan isn't going to produce a Baidu, but I'm sure Yandex and VK would be happy to fill a void and play along with their rules. And in the end, people just have less access to unfiltered news about the outside world. It's a losing plan.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#116Google, Facebook, Yahoo, Microsoft, Salesforce, Box, Dropbox, Twitter, etc. could have a very strong influence on changing this if they banded together to respond to this in some way. The government might be doing what they think is right, but public backlash can change policy almost overnight. We saw this in the US recently with SOPA/PIPA. The "Internet" response was unprecedented. The people of Kazakhstan can achie…
> The people of Kazakhstan can achieve the same outcome.
Highly unlikely. From Wikipedia: In April 2015, Nazarbayev was re-elected with almost 98% of the vote.
That kind of tells the whole story - people are "behind" this (or rather no-one dares contradict the authorities). That country is basically owned by the Family and resistance is pretty much futile.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#117This is what HTTP Public Key Pinning (HPKP) protects against. It allows a server to specify the only set of certificates that a browser should accept. Meaning that MITM'ing is impossible, without a valid cert in the chain of one of the advertised trusted certificates from the server. Chrome, Firefox, Opera, Chrome for Android, and the Android stock browser all support it. I'm not sure how they intend to circumvent th…
Could kazakhstan take "national security cert" traffic, crack it and then apply a different, globally trusted cert? Couldnt they also strip the public-key-pins header from incoming traffic?
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#118Google, Facebook, Yahoo, Microsoft, Salesforce, Box, Dropbox, Twitter, etc. could have a very strong influence on changing this if they banded together to respond to this in some way. The government might be doing what they think is right, but public backlash can change policy almost overnight. We saw this in the US recently with SOPA/PIPA. The "Internet" response was unprecedented. The people of Kazakhstan can achie…
> The people of Kazakhstan can achieve the same outcome. Highly unlikely. From Wikipedia: In April 2015, Nazarbayev was re-elected with almost 98% of the vote. That kind of tells the whole story - people are "behind" this (or rather no-one dares contradict the authorities). That country is basically owned by the Family and resistance is pretty much futile.
[deleted]
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#119Earlier quoted context omitted.
The government preference isn't important, citizen preference is. As to what they can do... it's a range from info to painful, but they can choose a range of options from serving up interstitials in a localized language that explains the issues, problems, and privacy and security implications... all the way to deny service. If the citizens demand access to those services, or find it offensive that their privacy and s…
You're talking like Kazakhstan is a functional democracy. http://exiledonline.com/the-massacre-everyone-ignored-70-str...
Let's not forget when they bossed around some Italian secret services, police and administration underlings to arrest and deport the wife and child of a Kazakh dissident: http://www.ft.com/cms/s/0/0d35c07c-e57f-11e2-ad1a-00144feabd...
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#120And everyone made fun of Netflix for implementing a secure protocol on top of http. Suddenly that seems really useful for people in Kazakhstan. http://techblog.netflix.com/2014/10/message-security-layer-m... https://github.com/Netflix/msl
Until next week when GFWoKazhakhstan blocks all traffic using the Netflix protocol. Unless the traffic is steganographically hidden, uncontrollable traffic will be simply killed.