MITM on HTTPS traffic in Kazakhstan • Hacker News Board

Re: MITM on HTTPS traffic in Kazakhstan

#181

Post by tomxor » Thu, Jul 18, 2019, 8:15 PM UTC

JaRail wrote: post #142

I'm surprised at comments in the bug threads suggesting they do nothing. The idea being that fighting this would force governments to fork/change browsers, ultimately being a worse experience for users. Seems like betraying people's trust is a pretty bad user experience. There will always be a fight over privacy. Giving up to a foreign government is a terrible idea. It would absolutely just let the problem spread and…

> Giving up to a foreign government is a terrible idea. It would absolutely just let the problem spread and get worse.

Their government isn't merley "snooping" on it's citizens due to a week chain of trust architecture and a lack of ethical clarity... it's requiring by law that it's citizens be snooped on and censored. In such a regime, a technological arms race is not going to change the legality of subverting their measures, and cannot help the masses without simultaneously jeopardising their safety.

Re: MITM on HTTPS traffic in Kazakhstan

#182

Post by terlisimo » Thu, Jul 18, 2019, 8:17 PM UTC

akersten wrote: post #132

Google, Mozilla, and Microsoft need to take a stand here and blacklist these certs. All of the efforts to move to HTTPS, and all of the rhetoric surrounding it, are just wasted time and empty words if we as a tech community allow this kind of behavior to go unchallenged. This sets such a dangerous precedent, and governments need to know that this kind of meddling will not be tolerated.

Hello,

To continue using internet, you need to install our government-provided fork of Firefox that doesn't blacklist our government-provided root cert.

regards, your Tele2

Re: MITM on HTTPS traffic in Kazakhstan

#183

Post by dwild » Thu, Jul 18, 2019, 8:17 PM UTC

snarf21 wrote: post #42

coldpie wrote: post #20

Earlier quoted context omitted.

When you connect to a website via HTTPS, your browser downloads the certificate from that website and validates it by checking that the website's certificate was cryptographically signed by an entity that the browser trusts. If the certificate is valid, then you can assume that your data will only be decrypt-able by the website owner, so the connection is secure. Your browser will display a happy green banner showing…

What prevents us from having to trust Verisign (or its employees) or a government warrant, etc. to not do the same? Can we leverage signed DNS records to add another layer of control needed? Do we also need encrypted DNS where we can choose who to trust? Are we stuck with the CA trust model?

The thing with certificate is that they not only add security, but they also act as a signature.

If Verisign deliver a certificate with the wrong domain, you'll be able to know that Verisign signed that certificate.

They could certainly say it was a mistake somewhere in the process, but that argument won't work for ever.

At one point sadly you need to trust someone. This model at least give you a way to prove that trust has been broken.

Re: MITM on HTTPS traffic in Kazakhstan

#184

Post by natch » Thu, Jul 18, 2019, 8:17 PM UTC

Would it be possible to also blackhole the domains used to host the bad CAs? Yes they could counter this but it would buy some time before browsers are updated.

Re: MITM on HTTPS traffic in Kazakhstan

#185

Post by mdhardeman » Thu, Jul 18, 2019, 8:17 PM UTC

austinheap wrote: post #129

At what point does this become an OFAC issue for browser vendors based in the states? I would be stunned if someone at Commerce isn't already circulating enforcement memos about this.

I think that's terribly optimistic. I think there are all kinds of people in the US government who would like to be able to point to a success story of a scheme like this, so that they'll have more ammunition in support of implementing it here.

As for whether designating that browser vendors can't distribute software to Kazakhstan, their government would just fork an open-source one, mod it to pre-include their MiTM cert, and force their citizens to use that.

Re: MITM on HTTPS traffic in Kazakhstan

#186

Post by z3t4 » Thu, Jul 18, 2019, 8:18 PM UTC

ignoramous wrote: post #122

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

> Now "us techies" have to find a new technical solution to a very social problem. Cert pinning does mitigate it for apps, doesn't it? The end-user doesn't need to really worry abt rouge root CAs, if my understanding is right. Traditional VPNs, P2P VPNs, Tor as a Proxy (decentralised net? dat/i2p/freenet/ipfs) could solve it generally across various use-cases, of which, VPNs are already mainstream.

I dont think pinning will work with for example letsencrypt. You can pin many certs but if you loose them all you are screwed. If you check your root cers you will likely find one from every major ISP in your country.

Re: MITM on HTTPS traffic in Kazakhstan

#187

Post by dgl » Thu, Jul 18, 2019, 8:18 PM UTC

oneplane wrote: post #125

gnull wrote: post #103

What is interesting is that some local internet providers in Kazakhstan used to inject their own ads into http websites their users visit. I wonder if they will start doing the same with https now. I noticed this behaviour last February with Kazakhtelecom (telecom.kz) internet provider. When I opened an http website in my browser and started clicking randomly on the parts of the page which are usually not clickable,…

I wonder if they also proxy stuff like the Google endpoints where chrome does key pinning, or if they whitelist those. I imagine other large systems like those of facebook (when using the app) and Apple are actively remembering what the keys are supposed to look like. That would mean that even a custom CA wouldn't allow carte blanche MITM.

Chrome will disable key pinning for CAs that are user installed rather than system provided (to support companies/schools who want to MITM for slightly less draconian reasons).

I do wonder if Chrome will go to requiring CAs for this purpose be deployed via something more “enterprise” (e.g. custom extensions on Windows need to deployed via group policy now).

Re: MITM on HTTPS traffic in Kazakhstan

#188

Post by worldofmatthew » Thu, Jul 18, 2019, 8:21 PM UTC

vkou wrote: post #152

worldofmatthew wrote: post #100

Earlier quoted context omitted.

Sometimes stuff likes this needs doing in order to show how bad MITM is.

Okay, say you live in Kazakhstan. You stop using the Internet. Do you think the government will care?

Think more towards break everything, as you would end up with out of date broowsers being used. This will have the side effect of causing almost the whole country to be vulnerable to attack.

Instability is the key.

Re: MITM on HTTPS traffic in Kazakhstan

#189

Post by lame-robot-hoax » Thu, Jul 18, 2019, 8:21 PM UTC

floatingatoll wrote: post #107

lame-robot-hoax wrote: post #92

Earlier quoted context omitted.

So uh, should I be concerned at all if my connection came back as a likely MITM from my home network in the US? Or is it most likely a false positive caused by my firewall or something? I tested it both off a VPN and on a VPN from my iPhone yet still had the same result both times.

Which ISP?

Cox cable but I just checked on my Fedora box and it came through as MITM unlikely so it looks like it’s just an oddity with iOS like mholt said.

Re: MITM on HTTPS traffic in Kazakhstan

#190

Post by lame-robot-hoax » Thu, Jul 18, 2019, 8:22 PM UTC

mholt wrote: post #149

lame-robot-hoax wrote: post #92

Earlier quoted context omitted.

So uh, should I be concerned at all if my connection came back as a likely MITM from my home network in the US? Or is it most likely a false positive caused by my firewall or something? I tested it both off a VPN and on a VPN from my iPhone yet still had the same result both times.

iOS is tricky because of its weird rules regarding TLS libraries and web views. If you are sure you haven't any rogue CA certs in your applicable trust stores, it's probably a false positive.

Yeah no CA certs as this is a personal phone, and I just checked from my Fedora box and it said MITM unlikely so guessing it’s just iOS being weird.