Kazakhstan to MitM all HTTPS traffic starting Jan 1

Post by antocv » Thu, Dec 03, 2015, 8:58 AM UTC

zurn wrote: post #323

patcheudor wrote: post #279

Earlier quoted context omitted.

Certificate pinning is absolutely targeted at stopping the use of rogue root CA's installed in devices. OWASP does a pretty good job of covering the topic. https://www.owasp.org/index.php/Certificate_and_Public_Key_P...

You just linked to 20 screenfuls of text that explain pinning in general, without a single mention of "rogue". The fact is that pinning as implemented in Chrome exempts installed CA's from pinning checks because they want to allow administrator-mandated MITM - apparently "market requirement" because it's a common practice in schools and workplaces in some countries that lack reasonable communications privacy legislat…

Post by samat » Thu, Dec 03, 2015, 9:42 AM UTC

Post by vbezhenar » Thu, Dec 03, 2015, 9:57 AM UTC

nathan_f77 wrote: post #321

andrewstuart2 wrote: post #8

Earlier quoted context omitted.

They're likely only intercepting known https traffic (port 443). If you use a VPN and tunnel all traffic you probably won't have any issues. If a nation-state with the resources of China has come up with a system that can still be (albeit nontrivially) bypassed then I would imagine Kazakhstan will have a much-less-sophisticated first iteration.

I lived in Kazakhstan for a few months, and I think they're already blocking VPN traffic with deep packet inspection. I tried a number of different services, including setting up my own on Digital Ocean.

Post by tremon » Thu, Dec 03, 2015, 10:27 AM UTC

cbr wrote: post #267

infinity0 wrote: post #266

Earlier quoted context omitted.

You are confused. This is exactly what pinning defends against.

Sorry, no: Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. -- https://www.chromium.org/Home/chromium-security/security-faq...

Post by pmlnr » Thu, Dec 03, 2015, 10:44 AM UTC

patcheudor wrote: post #301

asymmetric wrote: post #291

Earlier quoted context omitted.

Down-right demand? With what authority? It sounds like you're confusing these corporations for governments, as if they had to enforce your human rights..

The authority of the free market. Did web PKI develop because of governments? No. In fact, quite the contrary. Similarly, if consumers are educated and aware of the weaknesses of current cryptography controls in light of new threats such as governments requiring the installation of their own root CA so they can middle the connection, maybe they'll drive demand for better controls, controls which already exist.