MITM on HTTPS traffic in Kazakhstan • Hacker News Board

Re: MITM on HTTPS traffic in Kazakhstan

#161

Post by Avamander » Thu, Jul 18, 2019, 7:51 PM UTC

vbezhenar wrote: post #86

cmroanirgo wrote: post #70

Earlier quoted context omitted.

Will oscp stapling be able to be used to detect "something fishy" going on, because in that case the root ca wouldn't actually match. Do browsers compare the oscp root with the root of the current chain? Actually, if it's mitm it's "all bets are off" isn't it, because the KZ government can filter that it out the proxied response? Still, if oscp can assist at all, it's probably worth it that the browsers check for mis…

Browsers always trust manually installed CA roots, because that scenario is used by many corporations to monitor their traffic. OCSP, HPKP, etc won't help.

Not when the cert has been previously CT and Staple preloaded I suspect?

Re: MITM on HTTPS traffic in Kazakhstan

#162

Post by mtgx » Thu, Jul 18, 2019, 7:54 PM UTC

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

I was certain I read a few years ago that Google would mandate that all OEMs would be forced to use a single unified certificate list, which I thought at the time was a way to pre-empt this sort of thing. But I can't find any new info about that anywhere. I only found an article about how to add new certificates on new Android versions in 2019, so I guess you can still change them.

I wonder if Google changed its mind about this once Sundar Pichai took over and then gave Project Dragonfly the greenlight.

Re: MITM on HTTPS traffic in Kazakhstan

#163

Post by lostmsu » Thu, Jul 18, 2019, 7:56 PM UTC

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

The solution to that problem was invented and reinvented hundreds of years ago. It is called gunpowder.

Re: MITM on HTTPS traffic in Kazakhstan

#164

Post by arpa » Thu, Jul 18, 2019, 7:57 PM UTC

yholio wrote: post #126

Can we, endpoints outside Kazakhstan, detect when a MITM client is connected and serve a boiler plate message "Untrusted connection"? If enough high level sites do this (Google, Cloudflare, Wikipedia etc) it might force the hand of the government since they are the ones effectively breaking the internet.

No, mitm is not easily detected on server side. It's a transparent proxy. You could start serving these messages to whole KZ ip range, though.

Re: MITM on HTTPS traffic in Kazakhstan

#165

Post by cpach » Thu, Jul 18, 2019, 7:58 PM UTC

JaRail wrote: post #142

I'm surprised at comments in the bug threads suggesting they do nothing. The idea being that fighting this would force governments to fork/change browsers, ultimately being a worse experience for users. Seems like betraying people's trust is a pretty bad user experience. There will always be a fight over privacy. Giving up to a foreign government is a terrible idea. It would absolutely just let the problem spread and…

If a government mandates its citizens to install the government’s own root certificate, then it’s not that easy to find a long-term technological solution. The problem here is not a technical one, IMHO. The problem is that the government of Kazakhstan is not respecting the freedom of its people.

Point in case: In 2018, Kazakhstan ranked #144 in the Economist Intelligence Unit’s Democracy Index. Countries such as China, Cuba and Belarus had a better ranking. [See https://en.wikipedia.org/wiki/Democracy_Index#Democracy_Inde...]

IMO what’s needed is first and foremost more democracy in Kazakhstan. That’s not something that Firefox can solve.

With that said, perhaps anti-surveillance technology can assist the affected users. Maybe Tor. I’ve heard about some other, similar project but I can’t recall its name right now.

[Edit: These where the anti-censorship applications I was thinking of: https://www.psiphon3.com/ and https://getlantern.org/. Can’t vouch for their security though.]

Re: MITM on HTTPS traffic in Kazakhstan

#166

Post by skela224 » Thu, Jul 18, 2019, 7:58 PM UTC

cesarb wrote: post #150

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

One of our ("tech people") main failures was that, while we made a heavy push for server authentication, we didn't make a similarly strong push for client authentication. With client certificates, MITM like that is not possible, unless the server also trusts the MITM CA to authenticate its clients (and uses a CA for the client certificates in the first place, instead of a direct mapping between users and their certif…

How would the client certificates be distributed to users in Kazakhstan?

Re: MITM on HTTPS traffic in Kazakhstan

#167

Post by GordonS » Thu, Jul 18, 2019, 7:59 PM UTC

vbezhenar wrote: post #86

cmroanirgo wrote: post #70

Earlier quoted context omitted.

Will oscp stapling be able to be used to detect "something fishy" going on, because in that case the root ca wouldn't actually match. Do browsers compare the oscp root with the root of the current chain? Actually, if it's mitm it's "all bets are off" isn't it, because the KZ government can filter that it out the proxied response? Still, if oscp can assist at all, it's probably worth it that the browsers check for mis…

Browsers always trust manually installed CA roots, because that scenario is used by many corporations to monitor their traffic. OCSP, HPKP, etc won't help.

There are more benign uses too - many organisations run an internal PKI, and installing their root CA prevents employees' browsers from displaying warnings about untrusted certificates when accessing internal web apps/sites.

Re: MITM on HTTPS traffic in Kazakhstan

#168

Post by wedn3sday » Thu, Jul 18, 2019, 7:59 PM UTC

Florin_Andrei wrote: post #157

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

> It never ends. Yeah. Fangs vs shells. Microbes vs white cells. It's just the way this universe works. The struggle is eternal. Probably built into the root parameters of the Big Bang, if you could somehow trace it that far back in time and causality (which you probably can't, I dunno).

If this struggle ever ended, we would just find another struggle, its in our nature.

Re: MITM on HTTPS traffic in Kazakhstan

#169

Post by FabHK » Thu, Jul 18, 2019, 8:00 PM UTC

The pertinent page [1] of a local ISP, Kcell, is interesting - very devious.

> Kcell JSC informs its customers of the need to install Security Certificate on personal devices capable of connecting to the Internet

> Due to the increase of identity and personal data theft, including stealing money from bank accounts, introduced a security certificate as an effective tool to protect the country’s information space from hackers, online fraudsters and other types of cyber threats.

And some FAQs are hilarious (as in hilariously devious):

> What happens if I do not install the Security Certificate? You may have problems accessing the Internet.

> Will installation of the Security Certificate affect the protection of my personal data? The security certificate has no access to your personal data.

Yeah, true that, literally, but you forgot to mention something there...

[1] https://www.kcell.kz/en/product/3585/658, might have to switch to EN in top right corner

Re: MITM on HTTPS traffic in Kazakhstan

#170

Post by arpa » Thu, Jul 18, 2019, 8:01 PM UTC

Actually, a dns caa record could be of use in this scenario to at least alert the client that the traffic has been intercepted. Then again it is trivial to intercept and rewrite plain DNS requests and dns over https would also be subject to the same https mitm intercept... Maybe certificate pinning was a right idea.