This is bad because we don't like it when a foreign government infringes on foreign citizens' rights, but it may also be good (in a limited sense) because it might bring a whole lot more public scrutiny (from all countries and their citizens) towards the issue...
MITM on HTTPS traffic in Kazakhstan
171–180 of 471 posts
Re: MITM on HTTPS traffic in Kazakhstan
#172I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…
Except I look at the linked mailing list and you already get "us techies" arguing "uh yeah but uhm this isn't so different from the corporate CA intercept thing right so let's not blacklist it uhm".
What the fuck.
Re: MITM on HTTPS traffic in Kazakhstan
#173I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…
I'm less pessimistic. The practical result of this is likely just going to be more business for the cottage industry of Great Firewall VPNs, which already compete with one another in traffic obfuscation against an adversary far more sophisticated than the government of Kazakhstan. Thankfully, this is currently a case in which the incentives of the market happen to align well with the goals of defeating censorship.
The way that a real authoritarian government entity would handle that is...
An agency is tasked with doing random sample captures of randomly selected target internet connections.
Inventory all the types of traffic being exchanged.
Flag anything that isn't obvious plaintext or already being MiTM'ed for analysis follow up.
Implement new blocking rules or interception implementation for each flow that isn't already being intercepted.
Re: MITM on HTTPS traffic in Kazakhstan
#174Earlier quoted context omitted.
Sarcasm? Not sure. But all a government has to do is embed within the endpoint, post-decryption. "Or else."
Not only that but they can happily MITM HTTPS as well. Not all the HTTPS sites use certificate pinning or HSTS.
What root cert would they us for that?
Re: MITM on HTTPS traffic in Kazakhstan
#175I blame, in part, TLS 1.3, E-SNI, and DoH for this.
Previously, a government could monitor what site a user is visiting just by looking at the TLS session startup. Even if it is hosted on a cloud provider and 100 different sites are hosted from the same IP, they could look at the TLS-SNI data in the plain text to choose to interrupt and block the connection.
A fallback would be to manipulate DNS queries and force all DNS queries to be directed to official DNS resolvers. But DoH makes that far harder to control.
This is a bluff being called. Tech said "If we make it so that they have to spend all this money and build a massive scale intercept that actively participates in each TLS session, they won't buy into the cost."
Costs keep going down for this sort of thing. Now there are large organizations and governments willing to work on this stuff.
Re: MITM on HTTPS traffic in Kazakhstan
#176I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…
One of our ("tech people") main failures was that, while we made a heavy push for server authentication, we didn't make a similarly strong push for client authentication. With client certificates, MITM like that is not possible, unless the server also trusts the MITM CA to authenticate its clients (and uses a CA for the client certificates in the first place, instead of a direct mapping between users and their certif…
Using CAs to authenticate clients is subject to the same attack. They block communication from any client that won't disclose its private key to the MITM box or use it to encrypt/sign whatever the MITM requires it to.
You can't have security if you have a MITM that says "compromise your endpoint or we block you" and you concede to that. The only real solutions are either political or making the encrypted traffic look like some permitted traffic. (Or using a different network.)
Re: MITM on HTTPS traffic in Kazakhstan
#177Earlier quoted context omitted.
I'm less pessimistic. The practical result of this is likely just going to be more business for the cottage industry of Great Firewall VPNs, which already compete with one another in traffic obfuscation against an adversary far more sophisticated than the government of Kazakhstan. Thankfully, this is currently a case in which the incentives of the market happen to align well with the goals of defeating censorship.
The way that a real authoritarian government entity would handle that is... An agency is tasked with doing random sample captures of randomly selected target internet connections. Inventory all the types of traffic being exchanged. Flag anything that isn't obvious plaintext or already being MiTM'ed for analysis follow up. Implement new blocking rules or interception implementation for each flow that isn't already bei…
In essence, what happens is they implement a "if we can't see it, you can't see it" policy.
Re: MITM on HTTPS traffic in Kazakhstan
#178Re: MITM on HTTPS traffic in Kazakhstan
#179Earlier quoted context omitted.
So that means apps like Instagram are safe to chat in?
Not necessarily. As far as I know, both the apps you mentioned use HTTPS. However, apps have the option of doing what's called Certificate Pinning. That's when the application ignore OS/User trust settings about certificates, and just allows a list of hardcoded certificates / certificates signed by a hardcoded CA. Akin to how SSH works (kind of...). If I remember correctly both Telegram and Instagram have pinned thei…
I think all Facebook apps do this, and probably most major apps from big companies. I tried to do some research on what requests the Facebook app was making on my phone and it was pretty difficult to get it to allow me to use Charles proxy (when I installed the cert on my phone the app just stopped working) because of the certificate pinning. The only way this would work is if the government created their own FB, etc. app and somehow distributed it.
Re: MITM on HTTPS traffic in Kazakhstan
#180Earlier quoted context omitted.
This is actually the subject of some debate, believe it or not, there is a good argument against it. Here is the crux of the issue, many TLS middleware providers install their own root certificate for network monitoring, data loss prevention, security scanning and so on. I personally would like them to stop doing that or at least make it obvious to end users it's happening. However, in order to modify the root store,…
In this case though, it seems like the government has no problem with telling people they're being monitored. The fact that they're willing to tell people to install a TLS certificate is indicative of that. I think companies in the US are legally required to provide similar disclosure when monitoring their employees, so I don't see why they'd have a problem with a persistent indicator like that.
I'm curious how many people would realise that installing a root certificate implies the government wants to spy on their traffic.
It's going to be a lot fewer than the people who'd be able to understand they'd need to do X to keep the internet working.