Earlier quoted context omitted.
Corporations also do this so they can scan traffic for data exfil.
Is that a new word I should know?
It's a shortened version of "exfiltration"
MITM on HTTPS traffic in Kazakhstan
61–70 of 471 posts
Re: MITM on HTTPS traffic in Kazakhstan
#62I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…
Technology enables policies both good and not so good. This is just another example of that.
what good?
Re: MITM on HTTPS traffic in Kazakhstan
#63Have other governments requested their citizens to install country specific CAs? For some reason, I thought China already employed this practice (although I guess they wouldn't need to, as they just tend to block everything that isn't government approved).
Re: MITM on HTTPS traffic in Kazakhstan
#64I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…
Technology enables policies both good and not so good. This is just another example of that.
The goal here is to validate that one is communicating with whom they think they are. That's as pure a technical goal as you can get. Oddly this is still an unsolved problem on the internet. BTW any solution to this problem will be attacked or shot down by governments and companies around the world.
Re: MITM on HTTPS traffic in Kazakhstan
#65They should just put a red dot on the browser bar somewhere indicating a non-normal root cert is being used (this would also help in dev / test scenarios).
Something like this is in FF 68. Not a red dot, but an indication when you click the padlock.
Re: MITM on HTTPS traffic in Kazakhstan
#66The best solution would be to blacklist rouge SSL certs.
Doing so will make the internet (In Kazakhstan) unusable, because everywhere you go, you will see an 'untrusted cert' warning.
Re: MITM on HTTPS traffic in Kazakhstan
#67I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…
Maybe this sort of interruption is manageable when half of your 18 million people are rural and the economy isn't heavily dependent on internet traffic. Try doing this in a more urban populated country and you will see a much different outcome.
Re: MITM on HTTPS traffic in Kazakhstan
#68Warning: what follows is completely baseless speculation, and let's concede that right off the bat. Who's to say that this isn't happening in the US as well? The US has invested billions of dollars in dragnet surveillance that is allegedly useless for anything other than metadata in the context of HTTPS. Is it out of the question to ask whether our secret courts could issue gag orders and claim that national security…
Earlier this would probably have been a somewhat plausible solution, but not even then for mass scale surveillance.
Assume NSA et. al had access to trusted CA private keys, then they could generate certificates for arbitrary domains which would be trusted by clients. But if they MITM'ed _all_ connections (or even a large portion) surely someone would have noticed, like in the DigiNotar case [0].
But it's even harder (or better) now, with the advent of Certificate Transparency. Since browsers check certificates, periodically, against the CT logs which would fail for forged certificates [1].
However, stealing private keys from companies themselves is a practice that I can imagine happening on a small scale, like the Realtek signing keys for Stuxnet [2]. But doing that on a large scale is not really sustainable.
[0]: https://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudule... [1]: https://security.stackexchange.com/questions/190096/how-will... [2]: https://en.wikipedia.org/wiki/Stuxnet#Windows_infection
Re: MITM on HTTPS traffic in Kazakhstan
#69I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…
to be fair some of us told from the beginning that making all user used to trust the green check would have caused this sort of trust fatigue to the point the majority would have stopped bothering with the actual certificate content and trust chain, and you can search my history highlighting this very issue in relation to let's encrypt, it was a social issue from the very beginning and I got downvoted heavily and repeatedly because apparently "techies" can't be bothered with exceptions and failure modes once a catch all solution is found
but the warning signs were all there i.e. https://news.ycombinator.com/item?id=17298747#17304077
Re: MITM on HTTPS traffic in Kazakhstan
#70I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…
Will oscp stapling be able to be used to detect "something fishy" going on, because in that case the root ca wouldn't actually match. Do browsers compare the oscp root with the root of the current chain?
Actually, if it's mitm it's "all bets are off" isn't it, because the KZ government can filter that it out the proxied response?
Still, if oscp can assist at all, it's probably worth it that the browsers check for mismatch (if they don't already)
Edit: typos