81–90 of 471 posts
Earlier quoted context omitted.
Most browsers have made the lack of a "lock" quite evident to end users.
If they look and care. The comment you replied to asserts that most people don't. I certainly don't. If HN didn't have the lock in the url bar (no https), it would have zero impact on my behavior. I had to look just now to even know if there was one.
Earlier quoted context omitted.
We need new measures to not allow these certificates to be installed unless they're verified, or at least the OS shows a massive giant warning "DO NOT DO THIS unless you accept this cert gives $identity access to all your data". Seems a very solvable problem.
Corporations also do this so they can scan traffic for data exfil.
The best solution would be to blacklist rouge SSL certs.
I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…
Will oscp stapling be able to be used to detect "something fishy" going on, because in that case the root ca wouldn't actually match. Do browsers compare the oscp root with the root of the current chain? Actually, if it's mitm it's "all bets are off" isn't it, because the KZ government can filter that it out the proxied response? Still, if oscp can assist at all, it's probably worth it that the browsers check for mis…
I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…
to be fair some of us told from the beginning that making all user used to trust the green check would have caused this sort of trust fatigue to the point the majority would have stopped bothering with the actual certificate content and trust chain, and you can search my history highlighting this very issue in relation to let's encrypt, it was a social issue from the very beginning and I got downvoted heavily and rep…
Earlier quoted context omitted.
But we are in a better place than before. Without HTTPS everywhere and governments needing to ask people to install new root certs, we would not have learned about this Kazakhstan MITM issue.
Yep - without HTTPS everywhere, governments would have been silently able to snoop on Internet traffic without anyone knowing.
But all a government has to do is embed within the endpoint, post-decryption. "Or else."
I have custom root certs for internal dev sites for my company. That's fine, but I'd like to add the root with a caveat that I control saying "I trust this root for *.mycompany.com,mycompany.org", but that I know means they wouldn't be able to proxy "mybank.com". I don't think Firefox or Chrome can do that can it?
Earlier quoted context omitted.
SSH doesn't depend on certificate authorities, it's up to you to manage your own keys, each end point also has a uniquely generated signature which avoids MITM after first time auth (including by taking over domains). This is a HTTPS only issue and fundamentally it's the same problem as control over domains (ease of manipulation through centralisation).
So that means apps like Instagram are safe to chat in?
As far as I know, both the apps you mentioned use HTTPS. However, apps have the option of doing what's called Certificate Pinning.
That's when the application ignore OS/User trust settings about certificates, and just allows a list of hardcoded certificates / certificates signed by a hardcoded CA. Akin to how SSH works (kind of...).
If I remember correctly both Telegram and Instagram have pinned their certificates, which would probably block all network communication but not allow for a MITM attack, even if the user installed the KZ root certificate.