MITM on HTTPS traffic in Kazakhstan

#1

Post by bzbarsky » Thu, Jul 18, 2019, 5:40 PM UTC

MITM on HTTPS traffic in Kazakhstan
bugzilla.mozilla.org

Re: MITM on HTTPS traffic in Kazakhstan

#2

Post by isostatic » Thu, Jul 18, 2019, 5:52 PM UTC

I have custom root certs for internal dev sites for my company. That's fine, but I'd like to add the root with a caveat that I control saying "I trust this root for *.mycompany.com,mycompany.org", but that I know means they wouldn't be able to proxy "mybank.com".

I don't think Firefox or Chrome can do that can it?

Re: MITM on HTTPS traffic in Kazakhstan

#3

Post by [deleted] » Thu, Jul 18, 2019, 5:53 PM UTC

[deleted]

Re: MITM on HTTPS traffic in Kazakhstan

#4

Post by schoen » Thu, Jul 18, 2019, 5:55 PM UTC

isostatic wrote: post #2

I have custom root certs for internal dev sites for my company. That's fine, but I'd like to add the root with a caveat that I control saying "I trust this root for *.mycompany.com,mycompany.org", but that I know means they wouldn't be able to proxy "mybank.com". I don't think Firefox or Chrome can do that can it?

No, although the root itself could be scoped that way with an X.509 name constraint. But if you add the root then I believe there's no browser policy to otherwise limit the names for which it can be trusted.

Re: MITM on HTTPS traffic in Kazakhstan

#5

Post by DarkContinent » Thu, Jul 18, 2019, 5:58 PM UTC

Could someone explain to me what this means and/or why it's bad?

Re: MITM on HTTPS traffic in Kazakhstan

#6

Post by burtonator » Thu, Jul 18, 2019, 5:59 PM UTC

isostatic wrote: post #2

I have custom root certs for internal dev sites for my company. That's fine, but I'd like to add the root with a caveat that I control saying "I trust this root for *.mycompany.com,mycompany.org", but that I know means they wouldn't be able to proxy "mybank.com". I don't think Firefox or Chrome can do that can it?

For root certain? But you can add your own self signed certs for domains an they can be wildcards.

You only need a root if you're issuing other keys.

Re: MITM on HTTPS traffic in Kazakhstan

#7

Post by y0ghur7_xxx » Thu, Jul 18, 2019, 6:01 PM UTC

isostatic wrote: post #2

I have custom root certs for internal dev sites for my company. That's fine, but I'd like to add the root with a caveat that I control saying "I trust this root for *.mycompany.com,mycompany.org", but that I know means they wouldn't be able to proxy "mybank.com". I don't think Firefox or Chrome can do that can it?

There is a Name Constraints extension in X.509[1] that does exactly that, but to my knowledge no browser implements it.

[1] https://tools.ietf.org/html/rfc5280#section-4.2.1.10

Re: MITM on HTTPS traffic in Kazakhstan

#8

Post by efxz » Thu, Jul 18, 2019, 6:01 PM UTC

DarkContinent wrote: post #5

Could someone explain to me what this means and/or why it's bad?

Internet provider will be able to read all your data in plaintext. Logins, passwords, anything you send.

Re: MITM on HTTPS traffic in Kazakhstan

#9

Post by iknowstuff » Thu, Jul 18, 2019, 6:01 PM UTC

DarkContinent wrote: post #5

Could someone explain to me what this means and/or why it's bad?

The government and ISPs will have access to everything people do on the internet in Kazakhstan.

Re: MITM on HTTPS traffic in Kazakhstan

#10

Post by acdha » Thu, Jul 18, 2019, 6:02 PM UTC

schoen wrote: post #4

isostatic wrote: post #2

I have custom root certs for internal dev sites for my company. That's fine, but I'd like to add the root with a caveat that I control saying "I trust this root for *.mycompany.com,mycompany.org", but that I know means they wouldn't be able to proxy "mybank.com". I don't think Firefox or Chrome can do that can it?

No, although the root itself could be scoped that way with an X.509 name constraint. But if you add the root then I believe there's no browser policy to otherwise limit the names for which it can be trusted.

On a tangent, do you know off-hand what browser support for name constraints is like? The last time I looked was a few years ago and at the time it wasn't well supported but if that's improved it'd be a good step for intermediate certs.