Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kazakhstan to MitM all HTTPS traffic starting Jan 1

telecom.kz

Post reply on HN
Print view View original

211–220 of 378 posts

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#211

Post by tomjen3 »

tptacek wrote: post #36
jakobdabo wrote: post #22

Google and Mozilla should blacklist the certificate once it's made public.

That would make people in the US feel better, but it wouldn't make any difference. If a country can force residents to install software or reconfigure their machines, there's nothing browser vendors can do to make those residents secure. Essentially, Kazakhstan owns (in both senses) the Internet-connected computers of all its residents, and it can do whatever it wants with them. It's also well within Kazakhstan's bud…

Can you name some examples of what they can do? Because other than release some sort of virus, which will be found in a matter of months, I don't think they can infect the entire country.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#212

Post by andreyf »

dujiulun2006 wrote: post #28
kaizendad wrote: post #6

I really appreciate how they're doing this. The Chinese built up an amazing infrastructure for the Great Firewall; the Kazakhs just say "install our cert!" The Chinese spend billions and have to stay ahead of all of their citizens' clever new ideas at all times; the Kazakhs spend a few hundred and just need to point guns at their citizens until they install a cert. Sure, it's going to be difficult to enforce, but it…

Chinese govt is also capable of doing this. Best part? We even have our trusted* root certificate! Could this get any "better"? Sure! We can even MITM all the OUTGOING https traffic if we want! #GitHubDDoS * Recently un-trusted by Apple and Mozilla. https://support.apple.com/en-us/HT204938

Was that trusted root cert ever misused? IIRC, it was un-trusted because they did not do their due diligence on how an issued sub-cert was being used by an Egyptian company.

What does the GitHub DDOS have to do with MITM attacks on https?

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#213

Post by kazakh »

Kazakh here. Fuck, what do we do? Any suggestions other than trying to raise awareness?

To give some context, the reason why they are getting away with such brute methods is that the most people wouldn't understand the full implication. I would be surprised if this would prove difficult to enforce - the first thing an ordinary person would do when, say, Facebook wouldn't load is to call up the Kazakhtelecom's support and the support guy would tell them to "press that button that says 'I trust this certificate'" and they would comply. There also hasn't been an uproar re government snooping into private citizens' communication, the kind that US had with Snowden etc., so a lot of people are likely to accept the "for your own security" talk at face value without much skepticism. It's also unlikely that even heightened awareness will inspire much backlash, as there is no real track record of grassroots organizing, even when the government tightens the screws. To its credit, the government has been quite skillful at balancing at just below the limit of pissing people off enough to make them go to the streets for the last twenty years (soaring oil prices in the last decade helped as well).

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#214

Post by andreyf »

api_or_ipa wrote: post #148
Quiark wrote: post #16

Wow, I feel really sorry for all Kzakhstan citizens. Also, this is a great example of 'rubber-hose cryptoanalysis' - who cares about 4096 RSA or whatnot if the government can just beat you until you oblige...

Kneecaps are always the easiest things to break.

Imagining this in heavy Russian accent: "Security as good as veekest link. And veekest link... is kneecaps. Har har har."

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#217

Post by jacquesm »

orf wrote: post #100
dujiulun2006 wrote: post #28

Earlier quoted context omitted.

Chinese govt is also capable of doing this. Best part? We even have our trusted* root certificate! Could this get any "better"? Sure! We can even MITM all the OUTGOING https traffic if we want! #GitHubDDoS * Recently un-trusted by Apple and Mozilla. https://support.apple.com/en-us/HT204938

To be fair they really fucked up a couple of stages of that GitHub DDOS and made it trivial to stop.

And they managed to shine the spotlight on a project in need of some tlc.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#218

Post by metalliqaz »

ansible wrote: post #177
ta0o0o0 wrote: post #133

Earlier quoted context omitted.

They can just block everything by default and only enable what they can decrypt. Maybe you could try tunelling encrypted data over HTTP, but heuristics could probably pick that up too.

If I had the free time, I'd create a cryptographic protocol running on top of telnet that looked like someone playing a MUD. For email, you'd encrypt data to have it look like regular prose. So you'd only get a few bits per English word, but that would be sufficient for short messages. Could also make use of extra spaces in between words. The real trick with that would be to take an existing document, and alter it to…

There aren't enough MUD players to make it inconspicuous.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#219

Post by voltagex_ »

pdappollonio wrote: post #88
henryaj wrote: post #5

"telecom.kz wants to use your location." NOPE

I wonder why that website needs your location... After all it's just a news article / press release.

setCityByIp() in Javascript. They seem to only be interested if your country code comes back as KZ. First use of the MapQuest geolocation APIs I've seen, too.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#220

Post by jacquesm »

dheera wrote: post #199
ta0o0o0 wrote: post #133

Earlier quoted context omitted.

They can just block everything by default and only enable what they can decrypt. Maybe you could try tunelling encrypted data over HTTP, but heuristics could probably pick that up too.

Well, in that case I'm just going to invent a TCP-over-cat-pictures VPN. Encode all the TCP packets in the subtle details of the fur and package everything up as innocent-looking HTTP GET requests. This realistically shouldn't be too hard to do with obfsproxy's already-built framework.

You're going to run out of cat pictures pretty quickly.
Post reply on HN