Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MITM on HTTPS traffic in Kazakhstan

bugzilla.mozilla.org

Post reply on HN
Print view View original

31–40 of 471 posts

Re: MITM on HTTPS traffic in Kazakhstan

#31

Post by trazire »

marmaduke wrote: post #19
mholt wrote: post #15

Would someone with network access in Kazakhstan check if Caddy's MITM detector catches this please? https://caddyserver.com/docs/mitm-detection - or https://mitm.watch (Cloudflare's unofficial deployment of the same tech). If it does not, could you file a bug report with a complete packet capture (and exact browser version - multiple browsers are preferred)? https://github.com/caddyserver/caddy/issues (Edit: Reported…

Theoretical quedtion: would a VPN in Kazakhstan allow you to test this?

No, as the certificates are user installed. The Bugzilla and other threads are about distrusting that user certificate.

Re: MITM on HTTPS traffic in Kazakhstan

#32

Post by cj »

privateSFacct wrote: post #22

They should just put a red dot on the browser bar somewhere indicating a non-normal root cert is being used (this would also help in dev / test scenarios).

This would be fantastic.

Also, it would be great if there were a "red dot" style warning when you manually click "Proceed anyway" while viewing a https page with an invalid certificate (currently, the browser remembers the "Proceed anyway" decision and accepts the invalid cert after the initial acceptance of the warning)

Re: MITM on HTTPS traffic in Kazakhstan

#33

Post by tcd »

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

We need new measures to not allow these certificates to be installed unless they're verified, or at least the OS shows a massive giant warning "DO NOT DO THIS unless you accept this cert gives $identity access to all your data".

Seems a very solvable problem.

Re: MITM on HTTPS traffic in Kazakhstan

#34

Post by saagarjha »

jedberg wrote: post #23
privateSFacct wrote: post #22

They should just put a red dot on the browser bar somewhere indicating a non-normal root cert is being used (this would also help in dev / test scenarios).

That would help people who already know what a root cert is, but it's well known that most people ignore any indicator in a URL bar. Even "smart people" ignore them. Do you actually check the lock status of every site you visit?

Most browsers have made the lack of a "lock" quite evident to end users.

Re: MITM on HTTPS traffic in Kazakhstan

#35

Post by [deleted] »

marmaduke wrote: post #19
mholt wrote: post #15

Would someone with network access in Kazakhstan check if Caddy's MITM detector catches this please? https://caddyserver.com/docs/mitm-detection - or https://mitm.watch (Cloudflare's unofficial deployment of the same tech). If it does not, could you file a bug report with a complete packet capture (and exact browser version - multiple browsers are preferred)? https://github.com/caddyserver/caddy/issues (Edit: Reported…

Theoretical quedtion: would a VPN in Kazakhstan allow you to test this?

[deleted]

Re: MITM on HTTPS traffic in Kazakhstan

#36

Post by filleokus »

LeifCarrotson wrote: post #27
coldpie wrote: post #20

Earlier quoted context omitted.

When you connect to a website via HTTPS, your browser downloads the certificate from that website and validates it by checking that the website's certificate was cryptographically signed by an entity that the browser trusts. If the certificate is valid, then you can assume that your data will only be decrypt-able by the website owner, so the connection is secure. Your browser will display a happy green banner showing…

> What Kazakhstan has done is create their own root certificate and asked people who live there to install it in their browsers. Is this voluntary? If I bring a device into the country without this certificate (or if the local removes it from their machine) do things go back to normal?

Going back to normal, i.e the browser saying that the presented certificate is invalid, yes. But you will not be able to browse anything over a HTTPS connection. (Or do other stuff over PKI based TLS, i.e downloading software updates etc.)

Re: MITM on HTTPS traffic in Kazakhstan

#38

Post by strictfp »

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

This is why I'm always advocating for political engagement for fighting these kind of issues. It's not exactly hard for a government to ban or forbid circumventing their monitoring. It does take time, but they're about to catch up.

Re: MITM on HTTPS traffic in Kazakhstan

#39

Post by everdrive »

nickysielicki wrote: post #30

Warning: what follows is completely baseless speculation, and let's concede that right off the bat. Who's to say that this isn't happening in the US as well? The US has invested billions of dollars in dragnet surveillance that is allegedly useless for anything other than metadata in the context of HTTPS. Is it out of the question to ask whether our secret courts could issue gag orders and claim that national security…

>Who's to say that this isn't happening in the US as well?

No one can say it because you just claimed it's all secret and can't be proven.

Re: MITM on HTTPS traffic in Kazakhstan

#40

Post by AWildC182 »

tcd wrote: post #33
jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

We need new measures to not allow these certificates to be installed unless they're verified, or at least the OS shows a massive giant warning "DO NOT DO THIS unless you accept this cert gives $identity access to all your data". Seems a very solvable problem.

Corporations also do this so they can scan traffic for data exfil.
Post reply on HN