Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kazakhstan to MitM all HTTPS traffic starting Jan 1

telecom.kz

Post reply on HN
Print view View original

321–330 of 378 posts

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#321

Post by nathan_f77 »

andrewstuart2 wrote: post #8
airza wrote: post #3

So like, what's the plan for people visiting Kazakhstan here? Install some rando's SSL certificate in your trust store or just not be allowed to access the internet?

They're likely only intercepting known https traffic (port 443). If you use a VPN and tunnel all traffic you probably won't have any issues. If a nation-state with the resources of China has come up with a system that can still be (albeit nontrivially) bypassed then I would imagine Kazakhstan will have a much-less-sophisticated first iteration.

I lived in Kazakhstan for a few months, and I think they're already blocking VPN traffic with deep packet inspection. I tried a number of different services, including setting up my own on Digital Ocean.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#323

Post by zurn »

patcheudor wrote: post #279
RKearney wrote: post #261

Earlier quoted context omitted.

Certificate pinning does not work with certificates that are installed in the devices trusted certificate store.

Certificate pinning is absolutely targeted at stopping the use of rogue root CA's installed in devices. OWASP does a pretty good job of covering the topic. https://www.owasp.org/index.php/Certificate_and_Public_Key_P...

You just linked to 20 screenfuls of text that explain pinning in general, without a single mention of "rogue".

The fact is that pinning as implemented in Chrome exempts installed CA's from pinning checks because they want to allow administrator-mandated MITM - apparently "market requirement" because it's a common practice in schools and workplaces in some countries that lack reasonable communications privacy legislation.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#324

Post by AnAfrican »

usrusr wrote: post #179
Drdrdrq wrote: post #155

Earlier quoted context omitted.

In other words: it doesn't matter who is voting, what matters is who is counting the votes.

Given the highly volatile ethnic mix of Kazakhstan and the lurking destabilizing effect of foreign interests longing for abundant mineral resources, a strong majority for stability over freedom is hardly surprising. Nonetheless, 98% seems very much out of this world. But with the "right" mix of fearmongering and early divide-and-conquer intervention when a moderate opposition ist starting to organize? Certainly not u…

I don't know why you're downvoted.

I agree a hundred percent. People from stable democracies tends to underestimate how afraid people can be of chaos and how easy it is for some goverment to associate democracy with chaos.

When a moderate opposition starts to organize, a non-moderate one (or one that takes advantage of ethnic fault lines) does too.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#325

Post by detaro »

rdtsc wrote: post #14

> secure protection of Kazakhstan users when using coded access protocols to foreign Internet resources. I guess "coded" here means VPN as well... Wonder how other countries' embassies will be connecting if they block all the encrypted connections? Everything through a satellite connection presumably.

> Wonder how other countries' embassies will be connecting if they block all the encrypted connections? Everything through a satellite connection presumably.

Or just getting official exceptions.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#326

Post by sukulaku »

marvy wrote: post #302
sukulaku wrote: post #300

Earlier quoted context omitted.

> There is no democracy so there is probably no way to resolve this grievance Just for the record, look to the US for a good example of how well democracy works for "resolving grievances". Occupy Wall Street protesters aired some grievances, and were beaten and tased into submission. The same happens anywhere, every time the citizenry actually demands something. It's kind of amazing how people still hold democracy as…

Beaten into submission? Maybe they tried that, but eventually what worked was that they were legislated into submission. They found some technicality for why they couldn't legally occupy that space, and everything went downhill fast after that. (I could be wrong. I wasn't paying much attention at the time.)

We can rest assured there were plenty of beatings and tasings involved - that's a big part of why some "people" become police officers in the first place.

But the point is that the same thing happens everywhere. Not that long ago, Hong Kong's people protested against China appointing their rulers. They were beaten and maced etc.

Brazilians protested against a massive waste of their money on The World Cup (or some such), and got swiftly brutalized by the police. Venezuelans protested economic destruction etc, and got brutalized.

You see, as long as people just endure whatever bullshit their rulers are inflicting on them, the rulers don't have to give a fuck about them. But when people actually resist, they are violently repressed.

Otherwise the masses might start entertaining the notion that maybe they don't have to just take all the bullshit bureaucracy, massive looting/exploitation, surveillance and abuse they're subjected to after all, and their rulers definitely don't want that to happen.

The whole point of being a ruler is exploiting your subjects. Surveillance and brutality are mostly just a part of what it takes to maintain your rule over them.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#330

Post by aorth »

adm_hn wrote: post #329

It seems they removed the page

Indeed. Even more strange is that they are handling it with a (temporary) redirect on that specific article.

  $ http --print h http://telecom.kz/en/news/view/18729
  HTTP/1.1 302 Moved Temporarily
  Connection: keep-alive
  Content-Length: 154
  Content-Type: text/html
  Date: Thu, 03 Dec 2015 08:41:31 GMT
  Location: http://telecom.kz/en
  Server: nginx
Post reply on HN