141–150 of 378 posts
Earlier quoted context omitted.
Actually they really should. As soon as major networks start saying NO is when governments change, I think this is one of the few times where this kind of pressure would be mostly good.
And it wouldn't work. You've apparently have never been stuck inside China. I was there for a few years and it was brutal, network wise. Local companies just replace what can't be accessed from the outside.
Slightly OT - if the bad guy can't fiddle with the trust store of your computer, whats his another methods of analysing a users traffic? Is https breakable by other means?
Everything is breakable, but some things take a really looong time to break. Governments might be able to break some weak https encryption, but not all.
Earlier quoted context omitted.
Install the certificate, then route all your connections through a tunnel. Multiple options are available like openvpn, shuttle[1], etc.. [1] https://github.com/apenwarr/sshuttle/
I assumed that they would refuse to serve traffic that they couldn't decrypt with this certificate.
[1] https://www.usenix.org/system/files/conference/usenixsecurit...
[2] https://www.torproject.org/projects/obfsproxy-instructions.h...
This is what HTTP Public Key Pinning (HPKP) protects against. It allows a server to specify the only set of certificates that a browser should accept. Meaning that MITM'ing is impossible, without a valid cert in the chain of one of the advertised trusted certificates from the server. Chrome, Firefox, Opera, Chrome for Android, and the Android stock browser all support it. I'm not sure how they intend to circumvent th…
No, it isn't. Locally installed certificates override pins; if they didn't, HPKP browsers wouldn't be deployable inside large companies that have regulatory requirements to monitor traffic from their own desktops, and there would be no benefit, because an adversary who can install software or reconfigure your machine can defeat pins in a variety of other less transparent ways. HPKP is great, but it doesn't address th…
Google, Facebook, Yahoo, Microsoft, Salesforce, Box, Dropbox, Twitter, etc. could have a very strong influence on changing this if they banded together to respond to this in some way. The government might be doing what they think is right, but public backlash can change policy almost overnight. We saw this in the US recently with SOPA/PIPA. The "Internet" response was unprecedented. The people of Kazakhstan can achie…
Nazarbayev, re-elected in a barely contested election to a fifth term on Sunday, was born to a peasant family. He trained as an engineer before rising through the ranks of the Kazakh Communist Party to head it in 1989 and was elected president on the eve of the Soviet breakup in 1991.
Since then, his power has become absolute, with resounding, but internationally criticised election victories in 1999, 2005 and 2011. There is no obvious succession plan in place and there are no clear alternatives to Nazarbayev's rule...
In 2011, however, a pay dispute in the oil sector turned violent with government troops shooting dead 15 protesters and injuring over a hundred
[source:] http://news.yahoo.com/nazarbayev-kazakhstans-moderniser-auth...
Wow, I feel really sorry for all Kzakhstan citizens. Also, this is a great example of 'rubber-hose cryptoanalysis' - who cares about 4096 RSA or whatnot if the government can just beat you until you oblige...
Woah, it can't be stressed how bad this is. If this succeeds, other countries will definitely follow! If it can be shown to work, it will be demanded that this be implemented by pretty much everyone for difficult to deny political reasons (terrorists, children, crime, etc) This feels like the first bullet in a new war that will occur in every parliament world wide.
This is what HTTP Public Key Pinning (HPKP) protects against. It allows a server to specify the only set of certificates that a browser should accept. Meaning that MITM'ing is impossible, without a valid cert in the chain of one of the advertised trusted certificates from the server. Chrome, Firefox, Opera, Chrome for Android, and the Android stock browser all support it. I'm not sure how they intend to circumvent th…
Even if pins overrode locally installed certificates, all they would have to do is to block all outgoing raw HTTPS traffic. All these browser-side security mechanisms can do is to refuse to initiate insecure connections (and inform the vendors about broken pins). They can't force a network that is actively designed to forbid private connections to allow them.