Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

motherboard.vice.com

Post reply on HN
Print view View original

121–126 of 126 posts

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#121

Post by theEXTORTCIST »

tony101 wrote: post #115
shif wrote: post #105

Earlier quoted context omitted.

The government could force pc manufacturers to deploy a root CA that they control and then do a MITM proxy to read everything the user is doing, they could also redirect wikipedia domain to another domain that just acts as a reverse proxy and deploy a legit cert on that other site

Most Wikipedia/Wikimedia domains have HSTS preloaded in browsers, preventing redirection without a valid certificate.

AFAIK HSTS doesn't break TLS MITM. A valid x509 certificate is generated by the attacker (using a Certificate Authority trusted by the victim's browser) for the domain the victim is visiting and all is well for both TLS sessions (ClientAttacker, AttackerServer). This all relies on the attacker having access to sign certs from the trusted CA.

Certificate pinning in the HTTPS client would mitigate TLS MITM (HPKP).

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#122

Post by Yizahi »

thriftwy wrote: post #98
Yizahi wrote: post #93

Earlier quoted context omitted.

Russia will follow soon. They already heavily editing Russian Wiki for "inconvenient" information.

Russian language definitely doesn't belong to Russian Federation the state but to a wide range of Russian-speaking people worldwide. If you see that somebody spins the Russian Wiki, you should definitely try to make it right to the extent suggested by Wikipedia norms.

Won't work, they are really closed in moderation. A few years ago they even renamed this article (https://en.wikipedia.org/wiki/Kievan_Rus%27) because they have identity crisis - they try to pose as the oldest part of slavic nations, the core nation and therefore must be obeyed (literally). So to shift the history they renamed the article to "Ancient Rus" to make people forget the Kiev part. (not the only thing they do of course)

As another exhibit: https://en.wikipedia.org/wiki/War_in_Donbass

This article in RU denies any involvement of Russia in Russian-Ukrainian war, however weird that may sound. They are either complicit or so deep in denial that it is impossible to talk to them about the war.

Currently Russian Wiki segment can't be trusted except for bare facts and non-political entries.

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#123

Post by giobox »

cyphar wrote: post #42
awinter-py wrote: post #33

Can an expert comment on side-channel attacks on HTTPS and whether they're less viable on HTTP/2? My assumption is that because wikipedia has a known plaintext and a known link graph it's plausible to identify pages with some accuracy and either block them or monitor who's reading what. I also assume that the traffic profile of editing looks different from viewing.

And one thing to note is that people generally don't randomly pad the length of articles, so it's not _very_ difficult to figure out what articles you might be reading -- even over TLS.

I've seen the theory that you could work out which pages are loaded from wikipedia over SSL by looking at other metrics like content length etc, but thanks to stuff like gzip compression, caching headers etc, this is much harder to exploit in practice. Plus there's the huge overhead of maintaining a database to link the frequently changing metrics back to the appropriate page on wikipedia. There's a great link somewhere (which of course I now can't find) where somebody prototyped this idea and found it really pretty hard to implement.

In the event this was even tried, it would presumably be trivial to defeat with injection of random content somewhere in the server responses anyway. This of course all assumes we can trust the root certificate authority though :P

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#124

Post by cyphar »

giobox wrote: post #123
cyphar wrote: post #42

Earlier quoted context omitted.

And one thing to note is that people generally don't randomly pad the length of articles, so it's not _very_ difficult to figure out what articles you might be reading -- even over TLS.

I've seen the theory that you could work out which pages are loaded from wikipedia over SSL by looking at other metrics like content length etc, but thanks to stuff like gzip compression, caching headers etc, this is much harder to exploit in practice. Plus there's the huge overhead of maintaining a database to link the frequently changing metrics back to the appropriate page on wikipedia. There's a great link somewh…

Yeah, good point. I presumed it would be a pain, but I never thought to see if someone actually tried it.

Though you shouldn't be compressing things over TLS. I think the only proper solution is to pad out all articles (and images) to the nearest 2kB or something so that you can't figure out the length (randomness can be thwarted by forcing refreshes).

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#125

Post by dbdr »

Yizahi wrote: post #122
thriftwy wrote: post #98

Earlier quoted context omitted.

Russian language definitely doesn't belong to Russian Federation the state but to a wide range of Russian-speaking people worldwide. If you see that somebody spins the Russian Wiki, you should definitely try to make it right to the extent suggested by Wikipedia norms.

Won't work, they are really closed in moderation. A few years ago they even renamed this article ( https://en.wikipedia.org/wiki/Kievan_Rus%27 ) because they have identity crisis - they try to pose as the oldest part of slavic nations, the core nation and therefore must be obeyed (literally). So to shift the history they renamed the article to "Ancient Rus" to make people forget the Kiev part. (not the only thing the…

> A few years ago they even renamed this article (https://en.wikipedia.org/wiki/Kievan_Rus%27) [...] to "Ancient Rus" to make people forget the Kiev part.

The russian version of that article is currently Киевская Русь [1] (Kievan Rus), though Дре́вняя Русь (Ancient Rus) is listed as a synonym. So it seems that specific change has been reverted, right?

[1] https://ru.wikipedia.org/wiki/%D0%9A%D0%B8%D0%B5%D0%B2%D1%81...

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#126

Post by Crontab »

Yizahi wrote: post #93
shpx wrote: post #62

It won't last, at least for China. Their government is working on a clone of wiki, scheduled for 2018[0]. Once that's done they'll likely completely ban the original. Wikipedia publishes database dumps every couple of days[1]. So it shouldn't be that expensive for smaller governments to create and host their own censored mirror. You'd maintain a list of banned and censored articles, then pull from wikipedia once a mo…

Russia will follow soon. They already heavily editing Russian Wiki for "inconvenient" information.

And probably England too - who has recently displayed some really disturbing desires to censor and control the Internet.
Post reply on HN