Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MITM on HTTPS traffic in Kazakhstan

bugzilla.mozilla.org

Post reply on HN
Print view View original

151–160 of 471 posts

Re: MITM on HTTPS traffic in Kazakhstan

#151

Post by hombre_fatal »

saagarjha wrote: post #81
hombre_fatal wrote: post #60

Earlier quoted context omitted.

If they look and care. The comment you replied to asserts that most people don't. I certainly don't. If HN didn't have the lock in the url bar (no https), it would have zero impact on my behavior. I had to look just now to even know if there was one.

The goal is to make it evident when there isn't one.

Well, Chrome does make it evident. That wasn't my point. My point, and the point of the comment above, is that it doesn't matter to almost anyone.

If HN still wasn't using https, we'd still be here. Virtually nobody really cares day to day.

Re: MITM on HTTPS traffic in Kazakhstan

#152

Post by vkou »

worldofmatthew wrote: post #100
vkou wrote: post #66

Earlier quoted context omitted.

Doing so will make the internet (In Kazakhstan) unusable, because everywhere you go, you will see an 'untrusted cert' warning.

Sometimes stuff likes this needs doing in order to show how bad MITM is.

Okay, say you live in Kazakhstan. You stop using the Internet.

Do you think the government will care?

Re: MITM on HTTPS traffic in Kazakhstan

#153

Post by CobrastanJorji »

Bluecobra wrote: post #135
ignoramous wrote: post #122

Earlier quoted context omitted.

> Now "us techies" have to find a new technical solution to a very social problem. Cert pinning does mitigate it for apps, doesn't it? The end-user doesn't need to really worry abt rouge root CAs, if my understanding is right. Traditional VPNs, P2P VPNs, Tor as a Proxy (decentralised net? dat/i2p/freenet/ipfs) could solve it generally across various use-cases, of which, VPNs are already mainstream.

Not necessarily. We have rolled out SSL inspection at my company and have to exclude certain apps (e.g. Dropbox, Google Drive) or else they won't work. The FW just blocks the connection and the user gets a SSL/TLS error.

Sure, but then instead of the government saying "hey, run this thing or else your app won't work," they can only say "your app doesn't work now." Spying on you is still prevented.

Re: MITM on HTTPS traffic in Kazakhstan

#154

Post by TeMPOraL »

StreamBright wrote: post #143
a3n wrote: post #88

Earlier quoted context omitted.

Sarcasm? Not sure. But all a government has to do is embed within the endpoint, post-decryption. "Or else."

Not only that but they can happily MITM HTTPS as well. Not all the HTTPS sites use certificate pinning or HSTS.

It's a tough problem because certificate pinning kills a lot of legitimate use patterns; it's not something I'd like to see being the default everywhere.

Re: MITM on HTTPS traffic in Kazakhstan

#155

Post by skybrian »

taviso wrote: post #102
privateSFacct wrote: post #22

They should just put a red dot on the browser bar somewhere indicating a non-normal root cert is being used (this would also help in dev / test scenarios).

This is actually the subject of some debate, believe it or not, there is a good argument against it. Here is the crux of the issue, many TLS middleware providers install their own root certificate for network monitoring, data loss prevention, security scanning and so on. I personally would like them to stop doing that or at least make it obvious to end users it's happening. However, in order to modify the root store,…

Companies will typically want their employees to know they are being monitored for legal reasons (as well as deterrence), so it seems like they'd have no reason to want to hide this?

Maybe clicking on the red dot could show a page with company policy.

Re: MITM on HTTPS traffic in Kazakhstan

#156

Post by darkpuma »

lame-robot-hoax wrote: post #92
mholt wrote: post #15

Would someone with network access in Kazakhstan check if Caddy's MITM detector catches this please? https://caddyserver.com/docs/mitm-detection - or https://mitm.watch (Cloudflare's unofficial deployment of the same tech). If it does not, could you file a bug report with a complete packet capture (and exact browser version - multiple browsers are preferred)? https://github.com/caddyserver/caddy/issues (Edit: Reported…

So uh, should I be concerned at all if my connection came back as a likely MITM from my home network in the US? Or is it most likely a false positive caused by my firewall or something? I tested it both off a VPN and on a VPN from my iPhone yet still had the same result both times.

On this machine I get "likely" in firefox, "unlikely" in a firefox private window and "unlikely" in chrome. Not sure what to make of that.

(Also all of the installed extensions are also enabled in private mode. I know that changed recently so I checked. Also the certs the browers claim I'm getting in all three scenarios seem to be the same...)

Re: MITM on HTTPS traffic in Kazakhstan

#157

Post by Florin_Andrei »

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

> It never ends.

Yeah. Fangs vs shells. Microbes vs white cells.

It's just the way this universe works. The struggle is eternal. Probably built into the root parameters of the Big Bang, if you could somehow trace it that far back in time and causality (which you probably can't, I dunno).

Re: MITM on HTTPS traffic in Kazakhstan

#158

Post by v8engine »

lame-robot-hoax wrote: post #92
mholt wrote: post #15

Would someone with network access in Kazakhstan check if Caddy's MITM detector catches this please? https://caddyserver.com/docs/mitm-detection - or https://mitm.watch (Cloudflare's unofficial deployment of the same tech). If it does not, could you file a bug report with a complete packet capture (and exact browser version - multiple browsers are preferred)? https://github.com/caddyserver/caddy/issues (Edit: Reported…

So uh, should I be concerned at all if my connection came back as a likely MITM from my home network in the US? Or is it most likely a false positive caused by my firewall or something? I tested it both off a VPN and on a VPN from my iPhone yet still had the same result both times.

It was antivirus in my case. It has web scan feature that MITMs https sites locally. Disabling the feature made it "MITM unlikely".

Re: MITM on HTTPS traffic in Kazakhstan

#159

Post by pcwalton »

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

I'm less pessimistic. The practical result of this is likely just going to be more business for the cottage industry of Great Firewall VPNs, which already compete with one another in traffic obfuscation against an adversary far more sophisticated than the government of Kazakhstan. Thankfully, this is currently a case in which the incentives of the market happen to align well with the goals of defeating censorship.

Re: MITM on HTTPS traffic in Kazakhstan

#160

Post by [deleted] »

vbezhenar wrote: post #86
cmroanirgo wrote: post #70

Earlier quoted context omitted.

Will oscp stapling be able to be used to detect "something fishy" going on, because in that case the root ca wouldn't actually match. Do browsers compare the oscp root with the root of the current chain? Actually, if it's mitm it's "all bets are off" isn't it, because the KZ government can filter that it out the proxied response? Still, if oscp can assist at all, it's probably worth it that the browsers check for mis…

Browsers always trust manually installed CA roots, because that scenario is used by many corporations to monitor their traffic. OCSP, HPKP, etc won't help.

[deleted]
Post reply on HN