Kazakhstan to MitM all HTTPS traffic starting Jan 1 • Hacker News Board

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#371

Post by ilaksh » Fri, Dec 04, 2015, 4:26 PM UTC

mike_hearn wrote: post #189

ocschwar wrote: post #49

Wondering about a turtles-all-the-way solution: A web-socket based protocol that opens up a new SSL session with non-MITM'd certificates. So you'd open up the snoop-me HTTPS/1.1 connection, do some GETs, then say "GET /busy, yo", and start what looks like a video-chat conversation that is in fact a regular SSL connection with uncompromised certs. (some protocol) over SSL over Web-Socket over bad-SSL over TCP/IP

You can't solve political problems with cryptography, much though the software engineering industry may wish it were so. Ultimately, though it will be very hard to accept, crypto may be on the way out as a technology with any political impact. Governments currently accept the rapid increase in SSL because none of the politicians or regulators understand that it's possible to disable it at a country level, and nobody…

Use a crypto that doesn't rely on authority.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#372

Post by sukulaku » Sat, Dec 05, 2015, 12:28 PM UTC

marvy wrote: post #368

sukulaku wrote: post #326

Earlier quoted context omitted.

We can rest assured there were plenty of beatings and tasings involved - that's a big part of why some "people" become police officers in the first place. But the point is that the same thing happens everywhere. Not that long ago, Hong Kong's people protested against China appointing their rulers. They were beaten and maced etc. Brazilians protested against a massive waste of their money on The World Cup (or some suc…

I'd like to point out one difference: as far as I know, in the US police are never given orders to hurt protesters. In theory, they can even get in trouble for doing so. In the other countries you listed, this was official policy. In any case, my point was that in the Occupy Wall Street case, these things occurred, but they are not what caused the final blow. The final blow was a court ruling that said they have to c…

> as far as I know, in the US police are never given orders to hurt protesters. In theory, they can even get in trouble for doing so. In the other countries you listed, this was official policy.

Well, they don't need orders to hurt protesters. Some of them will actively seek out opportunities for doing so, because that's what they signed up for. Those would be the psychopaths, by the way.

Yes, in theory they can get in trouble for hurting people, but in practice we all know they don't.

> The final blow was a court ruling that said they have to clear out. (The wording was a bit more subtle, but that's what Wikipedia is for.)

I have no clue if that's accurate, but it sure would have been convenient for Wall Street.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#373

Post by xg15 » Sun, Dec 06, 2015, 1:04 AM UTC

BuildTheRobots wrote: post #363

xg15 wrote: post #145

Correct me if I'm wrong, but doesn't android display a rather ennerving "someone might be spying on you" warning when custom root certs are installed? I'm looking forward to the reactions when every (android-using) citizen of the country student gets that warning.

I installed some custom roots onto 4.4.2 the other night to MiTM some apps. I saw no obvious warnings at all.

I was referring to this: https://code.google.com/p/android/issues/detail?id=62644

I'm not sure how the current status of that warning is, however.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#374

Post by xg15 » Sun, Dec 06, 2015, 10:46 AM UTC

mike_hearn wrote: post #192

xg15 wrote: post #145

Correct me if I'm wrong, but doesn't android display a rather ennerving "someone might be spying on you" warning when custom root certs are installed? I'm looking forward to the reactions when every (android-using) citizen of the country student gets that warning.

Why? They would have already installed the root cert themselves and they'd know perfectly well that they are being spied on. It'd just be another annoying warning bar for them.

They installed the cert because they've been told to and because likely "the internet doesn't work" when they don't. But that doesn't imply they know what a root certificate actually does or what the consequences of adding new root certs are.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#375

Post by tripzilch » Mon, Dec 07, 2015, 4:25 PM UTC

tremon wrote: post #337

cbr wrote: post #267

Earlier quoted context omitted.

Sorry, no: Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. -- https://www.chromium.org/Home/chromium-security/security-faq...

How does "Chrome does not perform pin validation" translate to "This is not what pinning defends against"? The fact that Chrome ships with a broken implementation does not imply the concept is broken.

You are right of course, but there are apparently a whole lot of people of the opinion that since Chrome was (one of the?) first apps implementing some sort of pinning, that this is de facto what certificate pinning "is".

I don't really agree with that, but it's IMO more useful to acknowledge the confusion, than having an argument about whether Chrome really does pinning or even gets to de facto define pinning or not, since this isn't even about Chrome :)

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#376

Post by tremon » Wed, Dec 09, 2015, 9:55 AM UTC

tripzilch wrote: post #375

tremon wrote: post #337

Earlier quoted context omitted.

How does "Chrome does not perform pin validation" translate to "This is not what pinning defends against"? The fact that Chrome ships with a broken implementation does not imply the concept is broken.

You are right of course, but there are apparently a whole lot of people of the opinion that since Chrome was (one of the?) first apps implementing some sort of pinning, that this is de facto what certificate pinning "is". I don't really agree with that, but it's IMO more useful to acknowledge the confusion, than having an argument about whether Chrome really does pinning or even gets to de facto define pinning or not…

I get your point. The notion of designating a broken implementation as "the standard" makes me queasy, ever since IE6 happened.

But still, I would have much preferred if the GP would have started their comment with "yes, but" instead of "sorry, no". That would have made the distinction much clearer.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#377

Post by lhopki01 » Fri, Dec 11, 2015, 4:50 PM UTC

duncan_bayne wrote: post #365

lhopki01 wrote: post #351

Earlier quoted context omitted.

A foreign coup is a valid response to nationalisation?

I'm not sure. But nationalisation is certainly a violation of rights. Of course, I'd be interested to see how those assets were set up in the first place - my bet would be during a non-rights-respecting period of colonialism. How far back do you go? (Serious question).

You go to when the country got a democratically elected government.

As for nationalisation is certainly a violation of rights do you hold that all eminent domain is a violation of rights? IE if the government wants to build a road and uses compulsory purchase orders it's a violation of rights?

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#378

Post by duncan_bayne » Fri, Dec 11, 2015, 8:39 PM UTC

lhopki01 wrote: post #377

duncan_bayne wrote: post #365

Earlier quoted context omitted.

I'm not sure. But nationalisation is certainly a violation of rights. Of course, I'd be interested to see how those assets were set up in the first place - my bet would be during a non-rights-respecting period of colonialism. How far back do you go? (Serious question).

You go to when the country got a democratically elected government. As for nationalisation is certainly a violation of rights do you hold that all eminent domain is a violation of rights? IE if the government wants to build a road and uses compulsory purchase orders it's a violation of rights?

Yes. It's possible to do such things in non rights violating ways. For example, buying options on properties and exercising them when a route is made.