Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MITM on HTTPS traffic in Kazakhstan

bugzilla.mozilla.org

Post reply on HN
Print view View original

421–430 of 471 posts

Re: MITM on HTTPS traffic in Kazakhstan

#421

Post by oarsinsync »

bscphil wrote: post #307
stefan_ wrote: post #172

Earlier quoted context omitted.

Except I look at the linked mailing list and you already get "us techies" arguing "uh yeah but uhm this isn't so different from the corporate CA intercept thing right so let's not blacklist it uhm". What the fuck.

Actually, I don't see the issue here. It is literally the same thing as corps intercepting the connections of their employees or visitors. In fact I trust my employer even less than I trust the government. But I disagree with the response that says we should do nothing. In fact, corporate root certs should be blocked / ignored by the browser in the exact same way and for the exact same reason. The only exception shou…

> corporate root certs should be blocked / ignored by the browser in the exact same way and for the exact same reason ... technological solutions can't solve this issue 100%

Technological solutions can't solve this at all if the entire stack is controlled by the interested party.

In the case of government snooping, you (theoretically) own the end device being used for access. In the case of corporate snooping, you're using corporate owned and managed devices. There is absolutely no technological solution that exists that will prevent another person from building software for (or selling to) corporations who need to snoop on their employees. Considering the selling price of appliances that perform these services (e.g. Bluecoat's range), the cost of a browser is negligible in comparison.

I don't think it's fair to conflate a lack of privacy on corporate owned devices with a lack of privacy on your own personal devices.

Re: MITM on HTTPS traffic in Kazakhstan

#422

Post by bscphil »

LoSboccacc wrote: post #363
bscphil wrote: post #310

Earlier quoted context omitted.

I think you're missing one important detail: the idea behind the green padlock is that the average end user isn't technically capable of (or shouldn't have to) monitor all the details of their internet connections to make sure they're secure. If that basic intuition about users is correct, the solution is not to give up on this and force users to deal with the true complexity of the situation. The solution is for the…

if they can force a cert into your os trust store they can force a cert into your browser trust store, this solves some very specific issue but not this one.

That's why I said "store shipped with the browser". I don't think Kazakhstan has the ability to get Firefox to ship their root cert.

Re: MITM on HTTPS traffic in Kazakhstan

#423

Post by LoSboccacc »

bscphil wrote: post #422
LoSboccacc wrote: post #363

Earlier quoted context omitted.

if they can force a cert into your os trust store they can force a cert into your browser trust store, this solves some very specific issue but not this one.

That's why I said "store shipped with the browser". I don't think Kazakhstan has the ability to get Firefox to ship their root cert.

this is kinda rich under an article where they forced a cert into the is trust store. it takes the same amount of effort to get the cert into browser specific stores because these need to be editable and an installer get control of the system anyway

"it rather involves being already at the other end of this airtight d doorway"

the current page ask the user to run an installer, elevating privilege. there's nothing a browser can really do against that. DLL can be replaced and signatures can be tempered etc.

just because you said "ship them with the browse" doesn't make you magically right nor safe under the linked threat

Re: MITM on HTTPS traffic in Kazakhstan

#424

Post by reeves23423 »

nurbo wrote: post #361

A fellow from Kazakhstan here. Banning this certificate or at least warning the users against using it WILL help a lot. Each authoritarian regime is authoritarian in its own way. Kazakhstan doesn't have a very strong regime, especially since the first president resigned earlier this year. When people protest strongly against something, the government usually backs down. For example, a couple of years ago the governme…

In the meanwhile consider using Tor https://www.torproject.org . It has different transports transport plugins available if that will make the traffic look like regular traffic and not Tor traffic.

Re: MITM on HTTPS traffic in Kazakhstan

#425

Post by synackpse »

gnull wrote: post #103

What is interesting is that some local internet providers in Kazakhstan used to inject their own ads into http websites their users visit. I wonder if they will start doing the same with https now. I noticed this behaviour last February with Kazakhtelecom (telecom.kz) internet provider. When I opened an http website in my browser and started clicking randomly on the parts of the page which are usually not clickable,…

Hey there!

I had a similar experience with my ISP in Canada. Infact, I did a talk on how I worked out what was going on from a technology perspective: https://www.youtube.com/watch?v=_YeaYIPM-QI

If you want to conduct some testing, I'd be more than happy to help.

Re: MITM on HTTPS traffic in Kazakhstan

#426

Post by martingxx »

pornel wrote: post #406
vbezhenar wrote: post #400

Earlier quoted context omitted.

I really don't like the idea that some third forces would interfere with internal politics of my country. Browser should work according to technical standards, not according to what US citizens decided to be good or bad. If Firefox wants to forbid locally installed roots, I'm all for it, but implement it for everyone. That said, I don't see how government would step back. People are uninformed and generally passive,…

Encryption is political. The technical standards around HTTPS are politically motivated. The push for HTTPS everywhere, de-facto required TLS in HTTP/2, eSNI & DoH, were largely a response to the US government's mass surveillance. However, who makes these changes is interesting. It happened to be mostly developers in Five Eyes' countries acting against Five Eyes. Do we need to have elected representatives in browser…

I disagree that encryption is political. Fundamentally, it's a privacy and security mechanism and on its own it's no more political than locks, safes, paper shredders or curtains.

Because of the complex, un-intuitive nature of encryption, it mixed particularly badly with politics, and we're still suffering from the fallout of that now. (crypto wars 1)

Firefox and other application vendors who use those standards do end up being unavoidably slightly closer to politics (as demonstrated in this particular issue now), but I think Mozilla would do well to keep their goal simple - Protect user privacy where they can and explain to users when they can't.

A notice to the user like "You are using a key known to allow access to third parties" is just a fact and no more political than "the site you are visiting uses weak crypto standards" or similar.

Re: MITM on HTTPS traffic in Kazakhstan

#427

Post by reeves23423 »

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

It already exists https://www.torproject.org .

Re: MITM on HTTPS traffic in Kazakhstan

#428

Post by tomxor »

effie wrote: post #312
tomxor wrote: post #181

Earlier quoted context omitted.

> Giving up to a foreign government is a terrible idea. It would absolutely just let the problem spread and get worse. Their government isn't merley "snooping" on it's citizens due to a week chain of trust architecture and a lack of ethical clarity... it's requiring by law that it's citizens be snooped on and censored. In such a regime, a technological arms race is not going to change the legality of subverting their…

History contradicts you. There are examples from communist block where technological solutions that bypassed government restrictions helped to spread banned information.

I did not say it cannot help, I said it cannot change the legality of subverting the government, and so cannot subvert the government without simultaneously jeopardising citizens safety.

Re: MITM on HTTPS traffic in Kazakhstan

#429

Post by michaelt »

vbezhenar wrote: post #287
layoutIfNeeded wrote: post #257

Earlier quoted context omitted.

Lol. Sure, company sysadmins will run certbot on their mainframes.

There are plenty of clients for letsencrypt, including even Bash ones. That should not be a problem.

Letsencrypt only issues certs for publicly accessible hosts. If you've got a bunch of intranet servers / REST services / whatever that are firewalled from the public internet, you're out of luck.

Re: MITM on HTTPS traffic in Kazakhstan

#430

Post by michaelt »

Avamander wrote: post #161
vbezhenar wrote: post #86

Earlier quoted context omitted.

Browsers always trust manually installed CA roots, because that scenario is used by many corporations to monitor their traffic. OCSP, HPKP, etc won't help.

Not when the cert has been previously CT and Staple preloaded I suspect?

If a user manually imports a CA, it bypasses protections like CT [1]. This is a feature specifically designed to allow MITM for corporate proxies.

Always seemed like a misfeature to me, but all the browsers do it.

[1] https://chromium.googlesource.com/chromium/src/+/master/net/...

Post reply on HN