Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MITM on HTTPS traffic in Kazakhstan

bugzilla.mozilla.org

Post reply on HN
Print view View original

261–270 of 471 posts

Re: MITM on HTTPS traffic in Kazakhstan

#261

Post by droithomme »

mkagenius wrote: post #194
break_the_bank wrote: post #124

Earlier quoted context omitted.

This is so bad. I'm from India and at my parents place we have the government run internet provider. They MITM and inject advertisements all the time showing annoying popups whenever you open an http link. I don't know how this is legal even.

> I don't know how this is legal even. Legality is secondary when you are punching up in a 3rd world country. (I am from India)

I'm in the US and I've caught my ISP doing MITM exploits over http (not https... so far). It's global and regular folks have absolutely no chance of knowing what is going on. Needs to be criminalized for any hope of resolution.

Re: MITM on HTTPS traffic in Kazakhstan

#262

Post by jrochkind1 »

mdhardeman wrote: post #205
zrm wrote: post #197

Earlier quoted context omitted.

> Flag anything that isn't obvious plaintext or already being MiTM'ed for analysis follow up. The failure being that the long tail of uncategorized data would be large . Do you have a good reference for what game state updates look like for every game on the internet? What about custom IoT device protocols? Every type of DRM used for media streaming? Document attachments of spreadsheets or database images containing…

They don't need to. In an authoritarian state, you just start blocking and breaking things. Everything you don't understand, you block. And then you make the user explain it to you and then if it's a use case you care about, you do the work to either decide it doesn't have any danger of carrying traffic you care about or build an intercept scheme for it.

> Everything you don't understand, you block. And then you make the user explain it to you and then if it's a use case you care about, you do the work to either decide it doesn't have any danger of carrying traffic you care about...

You say "authoritarian state", sounds to me like the network at many employers and institutions in the US!

Re: MITM on HTTPS traffic in Kazakhstan

#263

Post by marcosdumay »

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

It only becomes a social problem after the society gets the tools to know that the government is messing with their communications.

HTTPS is that tool. It is a social problem now, it was a technical problem problem just recently.

Re: MITM on HTTPS traffic in Kazakhstan

#264

Post by mdhardeman »

jedisct1 wrote: post #245
mdhardeman wrote: post #175

I blame, in part, TLS 1.3, E-SNI, and DoH for this. Previously, a government could monitor what site a user is visiting just by looking at the TLS session startup. Even if it is hosted on a cloud provider and 100 different sites are hosted from the same IP, they could look at the TLS-SNI data in the plain text to choose to interrupt and block the connection. A fallback would be to manipulate DNS queries and force all…

It's probably completely unrelated. DoH is easy to block. They can look at SNI and cut DoH connections. Being able to access all the content is far more valuable than hostnames.

We have E-SNI now, where SNI is encrypted. And you have DoH providers who'll use that.

And then massive CDNs will start to support it.

Some of them might even enable it, with encrypted SNI, on _every single listener on all of their IPs_.

DoH was designed to evolve into something nearly unblock able. Unless you active intercept 100%.

Which some people believed no one would pay up for or that it would be unscalable. This stuff only gets cheaper and easier.

Re: MITM on HTTPS traffic in Kazakhstan

#265

Post by 420codebro »

gnull wrote: post #103

What is interesting is that some local internet providers in Kazakhstan used to inject their own ads into http websites their users visit. I wonder if they will start doing the same with https now. I noticed this behaviour last February with Kazakhtelecom (telecom.kz) internet provider. When I opened an http website in my browser and started clicking randomly on the parts of the page which are usually not clickable,…

Very interesting. It would be neat to put a service together that could crawl a site from different restricted countries to observe / track what is injected (assuming they aren't just wanting to MITM for visibility).

Re: MITM on HTTPS traffic in Kazakhstan

#266

Post by thothamon »

mdhardeman wrote: post #235
zrm wrote: post #229

Earlier quoted context omitted.

Ethernet can carry protocols other than IPv4. IPv6 is one of them, but there were at one time a whole slew of them, like IPX and Appletalk. But ISPs don't carry them, so they're effectively blocked and have largely died out, and everything uses IPv4 or IPv6. Even if you want to use Appletalk today, you encapsulate in IPv4 or IPv6. There are also a whole bunch of IP transport protocols other than TCP and UDP, but fire…

I'll be 40 years old later this year. I've been interested in communications and communications protocols since I was about 12. I've been a software developer with a focus on network communications for over 15 years. I'm well aware of all that you've said. My point was, they get TLS interception down, and they capture what they want from a target of interest. When they look closely at your traffic and decide all thes…

I could split hairs and suggest that the browser accept the phony CA and simply use a secondary encryption layer on top of it, but that misses your point. A sufficiently clever evil government will see that you're doing something encryption-like and shoot you.

But, being "sufficiently clever" isn't all that easy. China has done a good job, but they're a very big country with a lot of resources and a lot of very smart people, and let's be honest, even as good as they are, anyone with a will to get that censored information will get it.

It costs a lot to censor people on the Internet. The goal of people like me is not to stop the most determined, intelligent censorship approaches, but rather to make them as expensive as possible to build and maintain.

My ideal is force governments to either accept the Internet without censorship, or almost completely disconnect from the Internet (and simultaneously deny their nations the competitive advantages that come with it). North Korea is a good model. They basically don't have Internet in North Korea. It's sad, but I can live with that; it's better than allowing an oppressive regime to benefit from the Internet while oppressing their citizens.

Re: MITM on HTTPS traffic in Kazakhstan

#267

Post by tptacek »

AndyMcConachie wrote: post #199

What makes everyone so sure this isn't happening everywhere already? The problem Kazakhstan had was that there was no existing CA they could already force to issue certs. So they had to make a new one. It would be foolish to assume that none of the many trust anchors your browser already trusts haven't already been compelled by your local government to do exactly this. Also, DANE and DNSSEC solves this problem.

Not only does it not solve this problem, it actually makes controls like this easier to deploy: Kazakhstan controls the keys for its own ccTLD, and will simply require people to use .kz variants of services (and require services to provide those to deploy in Kazakhstan). Many of the most popular sites in Kazakhstan, including Google, are already reached on .kz names.

Re: MITM on HTTPS traffic in Kazakhstan

#268

Post by u801e »

skela224 wrote: post #166
cesarb wrote: post #150

Earlier quoted context omitted.

One of our ("tech people") main failures was that, while we made a heavy push for server authentication, we didn't make a similarly strong push for client authentication. With client certificates, MITM like that is not possible, unless the server also trusts the MITM CA to authenticate its clients (and uses a CA for the client certificates in the first place, instead of a direct mapping between users and their certif…

How would the client certificates be distributed to users in Kazakhstan?

You could send them to the email address you used to register the account. Then install it in your browser's or OS' certificate store.

Re: MITM on HTTPS traffic in Kazakhstan

#269

Post by u801e »

zrm wrote: post #176
cesarb wrote: post #150

Earlier quoted context omitted.

One of our ("tech people") main failures was that, while we made a heavy push for server authentication, we didn't make a similarly strong push for client authentication. With client certificates, MITM like that is not possible, unless the server also trusts the MITM CA to authenticate its clients (and uses a CA for the client certificates in the first place, instead of a direct mapping between users and their certif…

Using CAs to authenticate clients is subject to the same attack. They block communication from any client that won't disclose its private key to the MITM box or use it to encrypt/sign whatever the MITM requires it to. You can't have security if you have a MITM that says "compromise your endpoint or we block you" and you concede to that. The only real solutions are either political or making the encrypted traffic look…

> Using CAs to authenticate clients is subject to the same attack.

You don't need to use a publicly available CA to verify client-side certificates. The server could use its own internal CA to sign CSRs from clients and send the reslting certificate back to the client via email or some other means.

Re: MITM on HTTPS traffic in Kazakhstan

#270

Post by mdhardeman »

zrm wrote: post #260
mdhardeman wrote: post #235

Earlier quoted context omitted.

I'll be 40 years old later this year. I've been interested in communications and communications protocols since I was about 12. I've been a software developer with a focus on network communications for over 15 years. I'm well aware of all that you've said. My point was, they get TLS interception down, and they capture what they want from a target of interest. When they look closely at your traffic and decide all thes…

You're proposing that the penalty for being suspected of subverting the firewall is death . In those cases you're going to want a highly refined system for avoiding detection, and it's also very important that one exist, because regimes that oppressive deserve to be opposed. Fortunately the more typical case isn't kidnapping and execution but only having your connection blocked, which creates a helpful feedback loop…

No disagreement here. What's being done is despicable.

Rather than death, if we look at the history of oppressive societies, the more likely outcome is a job offer, the kind they won't let you refuse but they'll make it so you don't want to refuse anyway. They find the clever people who are working around the filters and interception and hire them to be the watchers. They get perks like time to spend on a real private connection, etc. Meanwhile they are required to contribute to making the noose ever tighter.

Post reply on HN