> a positive effect
Any numbers/figures?
Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship
51–60 of 126 posts
Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship
#52TIL: HTTPS encrypts the URL.
For all those wo are not aware what HTTPS encrypts:
HTTPs encrypts basically the whole protocol, this includes your request (the URL, your fingerprint -- e.g. browser, plugins installed, preferred languages) and the response (the content, type of the response (text, video, audio file), and some other not some important things).
What HTTPs does not encrypt is the domain and ip. The domain is leaked through DNS. DNSSec will not help either because it will not encrypt the DNS request. It rather signs it so that you can be sure it is authentic (not tempered with) but everyone can read it. This includes the wifi hotspot you use, your ISP, your government and anyone who tampers with the wires (theoretically even your neighbor and nearby people if you use mobile data since the connection from your device to your ISP is not really strong[1]).
Even if you would encrypt the DNS traffic (or you use just use the host's ip directly), the person who intercepts your traffic could just build a database with IP addresses that correspond to DNS entries (or do a reverse lookup, however, not every IP address has a reverse lookup configured to the domain you are visiting).
In wikipedia's example, this can still be pretty bad. For instance, if an oppressive government realizes that you visit wikipedia version of a particular language pretty frequently (compared to the rest of the population), they might make assumptions about you and profile you. When you visit the German wikipedia site, you are actually visiting de.wikipedia.org instead of en.wikipedia.org which can be intercepted and seen.
This gets worse for static file servers which serve different images at different subdomains (e.g. static512.domain.tld). So, if a DNS request is made to static523, static123, static721, and static132, an attack might be able to guess which article you are reading (or narrow down the choice) because their will not be many articles which have images served by those particular file servers. Thankfully wikipedia does not do that. Everything is served through upload.wikimedia.org but newpapers/forums, etc might not do that or they even have a unique domain for that article (e.g. embedded chart/video, which comes from a unique their party and is loaded automatically).
So all in all, HTTPs is pretty good but you still leave a lot of metadata (the DNS requests are just the tip of the iceberg) that can be used to learn a lot about you. If you want to be safe, use Tor or a VPN. If you use a VPN be aware that you just shift the trust from your current location to another one (so that the VPN provider, their ISP, and the government where the VPN server is located can read all those metadata, which might be not a big deal or even worse, depending where you actually life. Furthermore some VPNs have been known to be broken easily and your ISP/government still sees that you are using a VPN or even Tor).
[1]: One exception is LTE internet but you could still downgrade the connection to 3G or edge to intercept the domain
Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship
#53TIL: HTTPS encrypts the URL.
I think it's a fun/educational process to interact with some daemons over telnet. You can telnet into port 80 and create an HTTP request, for instance.
Certification negotiation happens before the GET request happens, which means that the "URL" (or, rather, everything after the domain) is encrypted.
You can also see some of this process with curl. So:
curl -vvv https://www.google.com/Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship
#54Earlier quoted context omitted.
do you have any examples of China issuing a certificate that all browsers trust? I've never seen or heard of this (at least across all browsers), so I find this unlikely.
https://security.googleblog.com/2015/03/maintaining-digital-... "On Friday, March 20th, we became aware of unauthorized digital certificates for several Google domains. The certificates were issued by an intermediate certificate authority apparently held by a company called MCS Holdings. This intermediate certificate was issued by CNNIC."
There is a concern dating back many years that a government will mandate that UAs trust a particular government-controlled CA (that eventually, but maybe not at first, openly performs MITMs). This is one reason that browsers really want to keep control of their root programs and not be mandated by governments to include any particular trusted roots -- including to maintain a remedy against roots that do appear to deliberately facilitate MITMs.
Although there have been lots of concerns about CNNIC, I don't believe that the Chinese government currently either (1) routinely uses CNNIC to perform MITMs for censorship or mass surveillance purposes, or (2) purports to require UAs to trust CNNIC or another Chinese root in order to be used by Chinese users. I'm happy to be corrected if someone knows otherwise.
Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship
#55TIL: HTTPS encrypts the URL.
For all those wo are not aware what HTTPS encrypts: HTTPs encrypts basically the whole protocol, this includes your request (the URL, your fingerprint -- e.g. browser, plugins installed, preferred languages) and the response (the content, type of the response (text, video, audio file), and some other not some important things). What HTTPs does not encrypt is the domain and ip. The domain is leaked through DNS. DNSSec…
> What HTTPs does not encrypt is the domain and ip. The domain is leaked through DNS.
Currently also with SNI.
https://en.wikipedia.org/wiki/Server_Name_Indication
This is important for some censorship circumvention schemes and also because some people have suggested that encrypting SNI is useless because DNS leaks the hostname [however, not necessarily along the same network path!!], while some people have also suggested that encrypting DNS queries is useless because SNI leaks the hostname.
Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship
#56Earlier quoted context omitted.
Oh, huh! I missed that entirely, now I'm curious too. HTTPS should make that difficult, but China has been known to employ all sorts of weird shenanigans-- perhaps they're running a "trusted' MitM as part of the great firewall? I know that certain companies (like Google and Microsoft) will actively censor themselves to continue to operate within China, but I figured Wikipedia would be against that practice on princip…
I think china blocks zh.wikipedia.org but all other languages are not blocked.
I just tested a few pages and it looks like you are right.
Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship
#57I just wonder what UK government has against German metal bands
Not, strictly speaking, the UK government. The Internet Watch Foundation, a non-governmental organisation, placed the article/image in question on its blacklist, a list which most major UK ISPs use (notable exceptions at the time were the UK universities' and military networks IIRC).
AFAIK, whether or not the image is actually illegal under English law is somewhat unclear (the definition of "indecent" is rather woolly), though it's certainly a poor choice for an album cover.
Edit: "to its blacklist" -> "on"; added "a non-governmental organisation"
Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship
#58Earlier quoted context omitted.
because the artwork is of a nude 10 year old.
oh that makes more sense to me
To be fair to the Scorpions, quote from Wikipedia...original concept for song
'...Time is the virgin killer. A kid comes into the world very naive, they lose that naiveness and then go into this life losing all of this getting into trouble. That was the basic idea about all of it' Different times... https://en.wikipedia.org/wiki/Virgin_Killer
Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship
#59Earlier quoted context omitted.
But can't they just download the Wikipedia backup, purge the articles they don't like, and redirect the DNS lookup to a local copy? To the average citizen, it won't look much different than going to actual Wikipedia.
This is feasible, assuming the government is willing to pay for the hosting.
As well as forge an SSL certificate for *.wikipedia.org.
Last time I checked, Wikipedia had HSTS enabled. So trying to forge their DNS without also forging their SSL certificate would be equivalent to total censorship for anybody who has previously visited Wikipedia.
Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship
#60Earlier quoted context omitted.
https://security.googleblog.com/2015/03/maintaining-digital-... "On Friday, March 20th, we became aware of unauthorized digital certificates for several Google domains. The certificates were issued by an intermediate certificate authority apparently held by a company called MCS Holdings. This intermediate certificate was issued by CNNIC."
There is a concern dating back many years that a government will mandate that UAs trust a particular government-controlled CA (that eventually, but maybe not at first, openly performs MITMs). This is one reason that browsers really want to keep control of their root programs and not be mandated by governments to include any particular trusted roots -- including to maintain a remedy against roots that do appear to del…
They wouldn't "routinely" abuse their root to monitor large populations. That would be too obvious and result in near-immediate loss of their precious root.
What's more dangerous, and much more likely, is that they might use forged certificates against specific individuals for a short period of time, for example, to intercept login credentials. The attack will go unnoticed as long as they also block the corresponding HPKP reporting URL (if the targeted site uses HPKP at all).