Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MITM on HTTPS traffic in Kazakhstan

bugzilla.mozilla.org

Post reply on HN
Print view View original

141–150 of 471 posts

Re: MITM on HTTPS traffic in Kazakhstan

#141

Post by vbezhenar »

Ajedi32 wrote: post #130
vbezhenar wrote: post #71

I'm from Kazakhstan using the biggest Internet provider (Kazaktelecom) and that's not true for me. No MITM here. May be not yet. Also checked mobile provider (Activ) and no MITM here too. But I saw local news, so probably not fake, though I'm not sure if it'll be mobile internet only or all providers.

This comment on the mozilla.dev.security.policy mailing list says that right now it's only for users in the nation's capital: https://groups.google.com/d/msg/mozilla.dev.security.policy/... > At the moment, providers started to use the certificate in the capital of Kazakhstan - Nur-Sultan (ex. Astana). So it may not be nationwide yet.

> This comment on the mozilla.dev.security.policy mailing list says that right now it's only for users in the nation's capital

I'm from capital (Nur-Sultan, former Astana).

I just checked my wife's phone and apparently she got SMS. Funnily enough, her cellular internet now does not work at all. Probably rollout is not going easy.

Re: MITM on HTTPS traffic in Kazakhstan

#142

Post by JaRail »

I'm surprised at comments in the bug threads suggesting they do nothing. The idea being that fighting this would force governments to fork/change browsers, ultimately being a worse experience for users. Seems like betraying people's trust is a pretty bad user experience.

There will always be a fight over privacy. Giving up to a foreign government is a terrible idea. It would absolutely just let the problem spread and get worse.

I don't think Kazakhstan has the resources to replace outside online services. A move like this should simply result in them shooting themselves in the foot. This needs to be a firm line such that it's simply not practical for them to implement.

I understand that bugs/discussions should weigh both sides. And ultimately, we may need more than HTTPS. That's fine. The point is we don't just roll over and give up.

Re: MITM on HTTPS traffic in Kazakhstan

#143

Post by StreamBright »

a3n wrote: post #88
btown wrote: post #58

Earlier quoted context omitted.

Yep - without HTTPS everywhere, governments would have been silently able to snoop on Internet traffic without anyone knowing.

Sarcasm? Not sure. But all a government has to do is embed within the endpoint, post-decryption. "Or else."

Not only that but they can happily MITM HTTPS as well. Not all the HTTPS sites use certificate pinning or HSTS.

Re: MITM on HTTPS traffic in Kazakhstan

#144

Post by gnyman »

acdha wrote: post #110
jitbug wrote: post #79

Earlier quoted context omitted.

It must have been many many years ago, more than 10 at least. Any way to avoid or bypass name or path constraints would be considered a huge and monumental vulnerability today.

> It must have been many many years ago, more than 10 at least. You would be unduly optimistic — for example, Apple did not support them at least as recently as 2015 (see e.g. https://bugs.chromium.org/p/chromium/issues/detail?id=407093... ) and 10 years ago OpenSSL hadn't even shipped support upstream, plus however long it took your distribution to ship a major version upgrade to 1.0. I was hoping someone might have…

I am afraid I don't have better information on when but some anecdotal information about the state of it. I have done some limited testing and research for our own internal Root CA I got the impression it works nowadays.

I have not gotten as far as testing it in production but based on testing Safari and Chrome in https://nameconstraints.bettertls.com/ and creating our own name constrained cert and testing it with both OS X Curl and Linux Curl (OpenSSL) I am still of the impression it works.

Most other people seem to be sure that it does not though (for example in this discussion and here https://security.stackexchange.com/questions/95600/are-x-509...) so I am not sure if I missed something or if people are just not up to date.

Re: MITM on HTTPS traffic in Kazakhstan

#145

Post by taftster »

lone_haxx0r wrote: post #114

> I think this CA should be blacklisted by Mozilla and Firefox should not accept it at all even user installed it manually. > This will save privacy of all Internet users in Kazakhstan. No. This will mean that users would simply switch to chrome, edge, brave, ... , n + 1. In case all of them block this CA, the government will force people to install an older version or will patch any open source browser so that it wo…

Yes, exactly.

In the United States, for example, it's legal (even expected?) that corporations can install custom CAs into their user's browsers and prevent internet access to any browser without it installed. Is it Mozilla's job to prevent these CAs from being installed on user's workstations? Should Mozilla reject any certificate from Blue Snort, etc.?

Kazakhstan has likewise declared it legal (under their own sovereign legal authority) to prevent web access to its citizens without the required CA installed. Just like it's legal in the US for corporations to "spy" on their employees, it's legal in Kazakhstan for it to spy on its citizens.

Laws of Western countries do not extend into other sovereign nations, regardless of what one thinks of those laws. It's not Mozilla's job to get involved in this case.

> And finally, encryption doesn't solve violence.

Nor abuse of freedom by nation states, unfortunately.

Re: MITM on HTTPS traffic in Kazakhstan

#146

Post by Ajedi32 »

taviso wrote: post #102
privateSFacct wrote: post #22

They should just put a red dot on the browser bar somewhere indicating a non-normal root cert is being used (this would also help in dev / test scenarios).

This is actually the subject of some debate, believe it or not, there is a good argument against it. Here is the crux of the issue, many TLS middleware providers install their own root certificate for network monitoring, data loss prevention, security scanning and so on. I personally would like them to stop doing that or at least make it obvious to end users it's happening. However, in order to modify the root store,…

In this case though, it seems like the government has no problem with telling people they're being monitored. The fact that they're willing to tell people to install a TLS certificate is indicative of that.

I think companies in the US are legally required to provide similar disclosure when monitoring their employees, so I don't see why they'd have a problem with a persistent indicator like that.

Re: MITM on HTTPS traffic in Kazakhstan

#147

Post by mholt »

filleokus wrote: post #121
mholt wrote: post #15

Would someone with network access in Kazakhstan check if Caddy's MITM detector catches this please? https://caddyserver.com/docs/mitm-detection - or https://mitm.watch (Cloudflare's unofficial deployment of the same tech). If it does not, could you file a bug report with a complete packet capture (and exact browser version - multiple browsers are preferred)? https://github.com/caddyserver/caddy/issues (Edit: Reported…

I just tested with ExpressVPN via their Kazakhstan endpoint. On 46.244.29.XXX on the ISP A2B IP B.V. I don't seem to be MITM'ed at all, so I can't report anything about the MITM-detector.

Thanks for the report. Both I and Cloudflare[1] are interested in any updates. If you know your connection is being MITM'ed by your ISP or your government please do the test again if it is safe to do so.

[1]: https://twitter.com/grittygrease/status/1151921809417048064

Re: MITM on HTTPS traffic in Kazakhstan

#149

Post by mholt »

lame-robot-hoax wrote: post #92
mholt wrote: post #15

Would someone with network access in Kazakhstan check if Caddy's MITM detector catches this please? https://caddyserver.com/docs/mitm-detection - or https://mitm.watch (Cloudflare's unofficial deployment of the same tech). If it does not, could you file a bug report with a complete packet capture (and exact browser version - multiple browsers are preferred)? https://github.com/caddyserver/caddy/issues (Edit: Reported…

So uh, should I be concerned at all if my connection came back as a likely MITM from my home network in the US? Or is it most likely a false positive caused by my firewall or something? I tested it both off a VPN and on a VPN from my iPhone yet still had the same result both times.

iOS is tricky because of its weird rules regarding TLS libraries and web views. If you are sure you haven't any rogue CA certs in your applicable trust stores, it's probably a false positive.

Re: MITM on HTTPS traffic in Kazakhstan

#150

Post by cesarb »

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

One of our ("tech people") main failures was that, while we made a heavy push for server authentication, we didn't make a similarly strong push for client authentication. With client certificates, MITM like that is not possible, unless the server also trusts the MITM CA to authenticate its clients (and uses a CA for the client certificates in the first place, instead of a direct mapping between users and their certificates).
Post reply on HN