Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

Post by bumblebeard » Tue, May 30, 2017, 4:10 AM UTC

beefsack wrote: post #34

zeta0134 wrote: post #15

Earlier quoted context omitted.

Oh, huh! I missed that entirely, now I'm curious too. HTTPS should make that difficult, but China has been known to employ all sorts of weird shenanigans-- perhaps they're running a "trusted' MitM as part of the great firewall? I know that certain companies (like Google and Microsoft) will actively censor themselves to continue to operate within China, but I figured Wikipedia would be against that practice on princip…

Nitpick: Google opted to pull out of mainland China instead of self-censoring. They moved Chinese operations to Hong Kong, but operate uncensored there.

Post by schoen » Tue, May 30, 2017, 4:20 AM UTC

kijin wrote: post #60

schoen wrote: post #54

Earlier quoted context omitted.

There is a concern dating back many years that a government will mandate that UAs trust a particular government-controlled CA (that eventually, but maybe not at first, openly performs MITMs). This is one reason that browsers really want to keep control of their root programs and not be mandated by governments to include any particular trusted roots -- including to maintain a remedy against roots that do appear to del…

They wouldn't "routinely" abuse their root to monitor large populations. That would be too obvious and result in near-immediate loss of their precious root. What's more dangerous, and much more likely, is that they might use forged certificates against specific individuals for a short period of time, for example, to intercept login credentials. The attack will go unnoticed as long as they also block the corresponding…

Post by manquer » Tue, May 30, 2017, 4:42 AM UTC

kijin wrote: post #60

schoen wrote: post #54

Earlier quoted context omitted.

There is a concern dating back many years that a government will mandate that UAs trust a particular government-controlled CA (that eventually, but maybe not at first, openly performs MITMs). This is one reason that browsers really want to keep control of their root programs and not be mandated by governments to include any particular trusted roots -- including to maintain a remedy against roots that do appear to del…

They wouldn't "routinely" abuse their root to monitor large populations. That would be too obvious and result in near-immediate loss of their precious root. What's more dangerous, and much more likely, is that they might use forged certificates against specific individuals for a short period of time, for example, to intercept login credentials. The attack will go unnoticed as long as they also block the corresponding…

Post by [deleted] » Tue, May 30, 2017, 4:54 AM UTC

chimeracoder wrote: post #66

awinter-py wrote: post #33

Can an expert comment on side-channel attacks on HTTPS and whether they're less viable on HTTP/2? My assumption is that because wikipedia has a known plaintext and a known link graph it's plausible to identify pages with some accuracy and either block them or monitor who's reading what. I also assume that the traffic profile of editing looks different from viewing.

> My assumption is that because wikipedia has a known plaintext and a known link graph it's plausible to identify pages with some accuracy At least in theory, the latest versions of TLS should not be vulnerable to a known plaintext attack. TLS also is capable of length-padding, which would reduce the attack surface here as well for an eavesdropper. My understanding is that HTTP/2 makes it even more difficult to const…

Post by wodenokoto » Tue, May 30, 2017, 6:05 AM UTC

shpx wrote: post #62

It won't last, at least for China. Their government is working on a clone of wiki, scheduled for 2018[0]. Once that's done they'll likely completely ban the original. Wikipedia publishes database dumps every couple of days[1]. So it shouldn't be that expensive for smaller governments to create and host their own censored mirror. You'd maintain a list of banned and censored articles, then pull from wikipedia once a mo…