Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kazakhstan to MitM all HTTPS traffic starting Jan 1

telecom.kz

Post reply on HN
Print view View original

221–230 of 378 posts

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#221

Post by nfd »

kazakh wrote: post #213

Kazakh here. Fuck, what do we do? Any suggestions other than trying to raise awareness? To give some context, the reason why they are getting away with such brute methods is that the most people wouldn't understand the full implication. I would be surprised if this would prove difficult to enforce - the first thing an ordinary person would do when, say, Facebook wouldn't load is to call up the Kazakhtelecom's support…

Raise awareness, spread the word about Tor. If they start running attacks against Tor, start an uproar. And pitch Tor as an elementary security measure; say "do this to make your communications more secure." It isn't perfect, but maybe it's better than nothing?

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#222

Post by voltagex_ »

Elhana wrote: post #129
egeozcan wrote: post #10

Earlier quoted context omitted.

> it's going to be difficult to enforce I guess it's just a matter of dropping every connection that you can't MITM, no?

You don't have to. Proxy handles the request and just gives response back to you signed with national cert. If you don't install it, your browser will just start complaining about every site. At least that is how Bluecoat ProxySG[1] works at my employee. [1] https://bto.bluecoat.com/webguides/proxysg/security_first_st...

Funny story, most of the machines / servers at my workplace weren't vulnerable to Heartbleed - but ProxySG was. AFAIK they built their own OS from scratch, too.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#223

Post by JoshTriplett »

tobltobs wrote: post #197
JoshTriplett wrote: post #188

Earlier quoted context omitted.

A National Security Letter will not prevent the certificate authority from being blacklisted when detected, and there are at least some legal precedents for warrants (though not necessarily for NSLs) that could challenge a warrant if complying with it would effectively destroy the business (given that the business itself is not the subject of the warrant). If that isn't the definition of an "unreasonable burden", not…

"A National Security Letter will not prevent the certificate authority from being blacklisted " Sure it will, just send another NSL to the blacklisting instance. And I do not understand that going to jail instantly is a smaller burden for you than living with the small risk getting caught. Do you really believe the NSA or any of those other patriots do not have a few of the private keys for the certificates you trust…

> Sure it will, just send another NSL to the blacklisting instance.

Instances, plural, including both browsers and various cross-check mechanisms (pinning, certificate transparency, etc). Likely too many people required for operational security.

Not saying it couldn't be done, but it certainly couldn't be done lightly or often, and even then it would produce significant risk of exposure. It certainly couldn't be effectively used for widespread traffic interception.

> And I do not understand that going to jail instantly is a smaller burden for you than living with the small risk getting caught.

As mentioned, there exists legal precedent that a warrant/subpoena for information from a third party can't compel that third-party to provide arbitrarily large amounts of aid or to impose an undue burden. Findings of "undue burden" have been upheld for burdens far smaller than "this has a risk of destroying the entire business".

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#224

Post by gf1 »

Could this be used by the Kazakh government to sign malware/spying packages and install them on their citizens' machines? Sounds like a super easy way to open that backdoor.

Or is this a different type of cert? I'm thinking along the lines of what Dell and Lenovo were yelled at for (although those were easy to rip off, but the government could possibly serve as the malicious actor here).

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#226

Post by pdkl95 »

tptacek wrote: post #89
danpalmer wrote: post #86

This is what HTTP Public Key Pinning (HPKP) protects against. It allows a server to specify the only set of certificates that a browser should accept. Meaning that MITM'ing is impossible, without a valid cert in the chain of one of the advertised trusted certificates from the server. Chrome, Firefox, Opera, Chrome for Android, and the Android stock browser all support it. I'm not sure how they intend to circumvent th…

No, it isn't. Locally installed certificates override pins; if they didn't, HPKP browsers wouldn't be deployable inside large companies that have regulatory requirements to monitor traffic from their own desktops, and there would be no benefit, because an adversary who can install software or reconfigure your machine can defeat pins in a variety of other less transparent ways. HPKP is great, but it doesn't address th…

> Locally installed certificates override pins.

Which is a blatant security risk, which should be fixed immediately.

> wouldn't be deployable inside large companies that have regulatory requirements to monitor traffic from their own desktops

I guess they don't use ssh?

This claim is complete nonsense, because you are conflating the installing of a certificate with a capability to override HPKP. All those businesses need is a way to add an exception to HPKP. This is no more difficult that any other IT-managed configuration.

The bug here is the assumption that installing a certificate always means HPKP should be overridden. This assumption is patently not universally true, as this Kazakhstan situation demonstrates.

> no benefit

Why is it that so many people seem to forget about the concept of Defense In Depth when one of the layers of protection is attacked?

A physical-key analogy: there is a decent chance the lock on your home's front door can be opened trivially with a bump key[1], which is an attack against the entire class of traditional pin-and-tumbler locks. The many homes that have such a lock can be entered in seconds. Does this mean that they shouldn't bother locking their front door? No - while it might be a good idea to invest in a better lock, forcing someone to bump the lock has benefits. Someone trying to enter your house might not have the right tool. If they do carry a bump key, that could have legal consequences ("burglar's tools").

Layered defenses help to reduce attack surface and raise the attack cost.

> less transparent

I fail to see how forcing an attacker to patch binaries or otherwise work around HPKP. Doing so will leave clear evidence that the system has been tampered with. On the other hand, a proper certificate has a small amount of plausible deniability.

> it doesn't address this problem

It doesn't solve the problem, but it should be a speed-bump that makes the attack harder, raising the cost of MitM.

[1] https://en.wikipedia.org/wiki/Lock_bumping

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#227

Post by mhandley »

Idiocy such as this is a strong argument for the use of PAKE rather than CA-based authentication. No need to trust anyone other than the site you're trying to connect to: https://en.wikipedia.org/wiki/Password-authenticated_key_agr...

TLDR: Basically, you prove to the website/mail server/sshd that you know your password, while the site simultaneously proves to you that they also know your password (and hence are actually the site you're trying to connect to), all without actually sending the password in either direction. The password is then used to bootstrap symmetric encryption keys.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#228

Post by jtome »

nfd wrote: post #221
kazakh wrote: post #213

Kazakh here. Fuck, what do we do? Any suggestions other than trying to raise awareness? To give some context, the reason why they are getting away with such brute methods is that the most people wouldn't understand the full implication. I would be surprised if this would prove difficult to enforce - the first thing an ordinary person would do when, say, Facebook wouldn't load is to call up the Kazakhtelecom's support…

Raise awareness, spread the word about Tor. If they start running attacks against Tor, start an uproar. And pitch Tor as an elementary security measure; say "do this to make your communications more secure." It isn't perfect, but maybe it's better than nothing?

I suspect Kazakhstan doenst have the resources to mount attacks against tor unless they can pay some western company to do it for them. Blocking it is a somewhat different matter.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#229

Post by nualartlee »

metalliqaz wrote: post #218
ansible wrote: post #177

Earlier quoted context omitted.

If I had the free time, I'd create a cryptographic protocol running on top of telnet that looked like someone playing a MUD. For email, you'd encrypt data to have it look like regular prose. So you'd only get a few bits per English word, but that would be sufficient for short messages. Could also make use of extra spaces in between words. The real trick with that would be to take an existing document, and alter it to…

There aren't enough MUD players to make it inconspicuous.

Cat pictures and steganography.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#230

Post by tankenmate »

pdappollonio wrote: post #88
henryaj wrote: post #5

"telecom.kz wants to use your location." NOPE

I wonder why that website needs your location... After all it's just a news article / press release.

I suspect although this might have some minor use to track users outside Kazakhstan, it's real use is to track web site visitors from within Kazakhstan.
Post reply on HN