Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

motherboard.vice.com

Post reply on HN
Print view View original

11–20 of 126 posts

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#11

Post by Amulet- »

zeta0134 wrote: post #6
rocky1138 wrote: post #3

How do governments censor only parts of Wikipedia when the site is encrypted? How do they know which pages you are browsing if they can't see the URL?

That's just it; they can't! When you visit Wikipedia over HTTPS, the only thing actually visible in plain text is wikipedia.org, and that's only if your browser is using Server Name Identification (SNI). Since the rest of the request, including the URL is hidden, governments and other malicious agents between you and the server cannot actually see what pages you're requesting directly. They can only see that you are…

The article says

Although countries like China, Thailand and Uzbekistan were still censoring part or all of Wikipedia by the time the researchers wrapped up their study

The top comment might be asking about the "were still censoring part" of the article.

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#12

Post by ekarulf »

rocky1138 wrote: post #3

How do governments censor only parts of Wikipedia when the site is encrypted? How do they know which pages you are browsing if they can't see the URL?

Who says they can't see the URL? A sufficiently motivate government would probably be able to create forged certificates and mass interception isn't really out of the question. Especially with browsers homogenizing on fast ciphers AES-GCM/POLY-1305, I bet it's much more economical than you would think.

Cert Pinning or HPKP is one type of solution, but it's tricky to get right especially for a large site like wikipedia.

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#13

Post by iancarroll »

ekarulf wrote: post #12
rocky1138 wrote: post #3

How do governments censor only parts of Wikipedia when the site is encrypted? How do they know which pages you are browsing if they can't see the URL?

Who says they can't see the URL? A sufficiently motivate government would probably be able to create forged certificates and mass interception isn't really out of the question. Especially with browsers homogenizing on fast ciphers AES-GCM/POLY-1305, I bet it's much more economical than you would think. Cert Pinning or HPKP is one type of solution, but it's tricky to get right especially for a large site like wikipedi…

Even if this could happen, which is far from trivial, it would be almost immediately detected.

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#14

Post by MR4D »

varenc wrote: post #7
rocky1138 wrote: post #3

How do governments censor only parts of Wikipedia when the site is encrypted? How do they know which pages you are browsing if they can't see the URL?

Governments can't censor parts of Wikipedia when it's all encrypted, that's sort of the point of the article.

I wonder about this. If a government can hack into a server and steal the private encryption key, then they could just look like any other server in the server farm, right?

Given the recent Shadow Brokers release of the NSA tools, it seems to me that this was not only possible, but probable (not necessarily with Wikipedia, but any website).

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#15

Post by zeta0134 »

Amulet- wrote: post #11
zeta0134 wrote: post #6

Earlier quoted context omitted.

That's just it; they can't! When you visit Wikipedia over HTTPS, the only thing actually visible in plain text is wikipedia.org, and that's only if your browser is using Server Name Identification (SNI). Since the rest of the request, including the URL is hidden, governments and other malicious agents between you and the server cannot actually see what pages you're requesting directly. They can only see that you are…

The article says Although countries like China, Thailand and Uzbekistan were still censoring part or all of Wikipedia by the time the researchers wrapped up their study The top comment might be asking about the "were still censoring part" of the article.

Oh, huh! I missed that entirely, now I'm curious too. HTTPS should make that difficult, but China has been known to employ all sorts of weird shenanigans-- perhaps they're running a "trusted' MitM as part of the great firewall?

I know that certain companies (like Google and Microsoft) will actively censor themselves to continue to operate within China, but I figured Wikipedia would be against that practice on principal. Now I'm curious as to how it's done.

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#16

Post by Edmond »

zeta0134 wrote: post #6
rocky1138 wrote: post #3

How do governments censor only parts of Wikipedia when the site is encrypted? How do they know which pages you are browsing if they can't see the URL?

That's just it; they can't! When you visit Wikipedia over HTTPS, the only thing actually visible in plain text is wikipedia.org, and that's only if your browser is using Server Name Identification (SNI). Since the rest of the request, including the URL is hidden, governments and other malicious agents between you and the server cannot actually see what pages you're requesting directly. They can only see that you are…

For committed governments like China, TLS may just be an extra hurdle but they can get around it if they want. Basically China could simply implement a massive proxy that terminates TLS.

If your internet traffic is going to flow through infrastructure that a curious government owns, then you'll know that they're monitoring the traffic but there is no way to keep them from seeing what you're doing.

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#19

Post by enzolovesbacon » 

  Critics of this plan argued that this move would just result in more 
  total censorship of Wikipedia and that access to some information 
  was better than no information at all
I'm no critic of this plan but I still don't understand why this wouldn't result in more total censorship. Someone explain please?

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#20

Post by matt123 »

Edmond wrote: post #16
zeta0134 wrote: post #6

Earlier quoted context omitted.

That's just it; they can't! When you visit Wikipedia over HTTPS, the only thing actually visible in plain text is wikipedia.org, and that's only if your browser is using Server Name Identification (SNI). Since the rest of the request, including the URL is hidden, governments and other malicious agents between you and the server cannot actually see what pages you're requesting directly. They can only see that you are…

For committed governments like China, TLS may just be an extra hurdle but they can get around it if they want. Basically China could simply implement a massive proxy that terminates TLS. If your internet traffic is going to flow through infrastructure that a curious government owns, then you'll know that they're monitoring the traffic but there is no way to keep them from seeing what you're doing.

No, TLS is not vulnerable to a MITM unless a) your client trusts the certificates issued by the attacker, or b) the attacker successfully forges the certificate of the website you are trying to visit.

That is, assuming you don't click away your browser's security warning.

https://security.stackexchange.com/questions/8145/does-https...

Post reply on HN