MITM on HTTPS traffic in Kazakhstan • Hacker News Board

Re: MITM on HTTPS traffic in Kazakhstan

#431

Post by tialaramex » Fri, Jul 19, 2019, 1:00 PM UTC

jasonh3 wrote: post #252

cesarb wrote: post #150

Earlier quoted context omitted.

One of our ("tech people") main failures was that, while we made a heavy push for server authentication, we didn't make a similarly strong push for client authentication. With client certificates, MITM like that is not possible, unless the server also trusts the MITM CA to authenticate its clients (and uses a CA for the client certificates in the first place, instead of a direct mapping between users and their certif…

Somewhat related: if there were a shared password between the client and server, Password Authenticated Key Exchange techniques [0] could offer protection even when the server CA was compromised. PAKEs use zero-knowledge proof techniques to assert that each side already had password material (and derive a key from it) without revealing what the actual password was if the other side didn't have it to begin with. In th…

It died for lack of interest, you can basically watch that happen at IETF 102 here:

https://youtu.be/mx40DSeoxnw?t=1230

TLS 1.3 was in some part an exercise in removing crap people thought might be a good idea in earlier versions, but then either never used or turned out to be a terrible idea but was notionally "optional" so you could say to keep using TLS but just disable that feature. So there is skepticism pre-existing in that room against the idea of just adding more stuff than might be cool unless it's clearly _needed_.

A feature that keeps six people in Kazakhstan (who happen to have manually pre-configured a PAKE) safe but everybody else is still screwed isn't the sort of impact TLS 1.3 was looking for.

Re: MITM on HTTPS traffic in Kazakhstan

#432

Post by bscphil » Fri, Jul 19, 2019, 1:17 PM UTC

LoSboccacc wrote: post #423

bscphil wrote: post #422

Earlier quoted context omitted.

That's why I said "store shipped with the browser". I don't think Kazakhstan has the ability to get Firefox to ship their root cert.

this is kinda rich under an article where they forced a cert into the is trust store. it takes the same amount of effort to get the cert into browser specific stores because these need to be editable and an installer get control of the system anyway "it rather involves being already at the other end of this airtight d doorway" the current page ask the user to run an installer, elevating privilege. there's nothing a b…

Alerting the user when a MITM certificate is active in the trust store is relying on a completely different threat model than "protect the entire operating system against state-mandated malware". I'm saying browsers should at least do the former. You seem to think that's pointless unless they also do the latter, but of course they can't do that. Some security of the trust store is better than no security.

Re: MITM on HTTPS traffic in Kazakhstan

#433

Post by knd775 » Fri, Jul 19, 2019, 1:18 PM UTC

arpa wrote: post #370

arpa wrote: post #164

Earlier quoted context omitted.

No, mitm is not easily detected on server side. It's a transparent proxy. You could start serving these messages to whole KZ ip range, though.

If someone could enlighten me where i'm wrong, it'd be much more constructive than simply downvoting.

https://blog.cloudflare.com/monsters-in-the-middleboxes/

https://mitm.watch

Re: MITM on HTTPS traffic in Kazakhstan

#434

Post by Jwarder » Fri, Jul 19, 2019, 1:22 PM UTC

vbezhenar wrote: post #400

nurbo wrote: post #361

A fellow from Kazakhstan here. Banning this certificate or at least warning the users against using it WILL help a lot. Each authoritarian regime is authoritarian in its own way. Kazakhstan doesn't have a very strong regime, especially since the first president resigned earlier this year. When people protest strongly against something, the government usually backs down. For example, a couple of years ago the governme…

I really don't like the idea that some third forces would interfere with internal politics of my country. Browser should work according to technical standards, not according to what US citizens decided to be good or bad. If Firefox wants to forbid locally installed roots, I'm all for it, but implement it for everyone. That said, I don't see how government would step back. People are uninformed and generally passive,…

I also think there is a risk that Mozilla if blocks the government certs then that would turn all Firefox users in the country into criminals. I'm all for security and privacy, but it is a rough choice between protecting users from surveillance by their authoritarian government or trying to make sure users can follow local laws.

Re: MITM on HTTPS traffic in Kazakhstan

#435

Post by peterwwillis » Fri, Jul 19, 2019, 1:32 PM UTC

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

The solution is to warn users that their security+privacy is compromised, and let them make their own informed choice. Techies don't often see that their own wishes shouldn't trump those of individuals (but maybe we're getting into politics now)

Another technical solution would have been to allow security without privacy. If the purpose of the government actions is just to monitor content, you can enable that without disabling security. The HTTP protocol could be modified to transmit checksums signed by a cert, so that a client can verify that content has not been modified, but that content can be (optionally) not encrypted, but still no content-injecting attacks can take place.

But privacy advocates don't like it, so the result is either you have total security + privacy (such as it is), or none at all.

Re: MITM on HTTPS traffic in Kazakhstan

#436

Post by noragami » Fri, Jul 19, 2019, 1:33 PM UTC

reeves23423 wrote: post #424

nurbo wrote: post #361

A fellow from Kazakhstan here. Banning this certificate or at least warning the users against using it WILL help a lot. Each authoritarian regime is authoritarian in its own way. Kazakhstan doesn't have a very strong regime, especially since the first president resigned earlier this year. When people protest strongly against something, the government usually backs down. For example, a couple of years ago the governme…

In the meanwhile consider using Tor https://www.torproject.org . It has different transports transport plugins available if that will make the traffic look like regular traffic and not Tor traffic.

Tor has been blocked here for the last 10 (or so) years. You have to find and add a couple of bridge servers to get it working, until they get blocked as well, of course.

Re: MITM on HTTPS traffic in Kazakhstan

#437

Post by TazeTSchnitzel » Fri, Jul 19, 2019, 1:33 PM UTC

martingxx wrote: post #426

pornel wrote: post #406

Earlier quoted context omitted.

Encryption is political. The technical standards around HTTPS are politically motivated. The push for HTTPS everywhere, de-facto required TLS in HTTP/2, eSNI & DoH, were largely a response to the US government's mass surveillance. However, who makes these changes is interesting. It happened to be mostly developers in Five Eyes' countries acting against Five Eyes. Do we need to have elected representatives in browser…

I disagree that encryption is political. Fundamentally, it's a privacy and security mechanism and on its own it's no more political than locks, safes, paper shredders or curtains. Because of the complex, un-intuitive nature of encryption, it mixed particularly badly with politics, and we're still suffering from the fallout of that now. (crypto wars 1) Firefox and other application vendors who use those standards do e…

Privacy is political.

Re: MITM on HTTPS traffic in Kazakhstan

#438

Post by isostatic » Fri, Jul 19, 2019, 1:43 PM UTC

worldofmatthew wrote: post #203

GordonS wrote: post #167

Earlier quoted context omitted.

There are more benign uses too - many organisations run an internal PKI, and installing their root CA prevents employees' browsers from displaying warnings about untrusted certificates when accessing internal web apps/sites.

You might be able to make intranet.company-name.tld and have a parking page on the company-name.tld and use that to get a wildcard cert that can be used for the internal pages.

Which you distribute to thousands of people on tens of thousands of devices?

Re: MITM on HTTPS traffic in Kazakhstan

#439

Post by noragami » Fri, Jul 19, 2019, 1:45 PM UTC

Hijacking the comment for better visibility. After getting some backlash, the government has already backed down. They claim that installing the certificate is entirely voluntary.

https://rus.azattyq.org/a/30064788.html

They have been talking about this stuff for some years, though. It will get implemented at some point. I have a feeling it was one of their "test trials": can we boil the frog yet, or do we have to heat the water up a bit more?

Re: MITM on HTTPS traffic in Kazakhstan

#440

Post by Grue3 » Fri, Jul 19, 2019, 2:09 PM UTC

bcoates wrote: post #243

syn0byte wrote: post #210

Earlier quoted context omitted.

"So do we make our flagship product useless for the entire country or not?" - The real question

Yes? This isn't that complicated. You break it, and when competitive browser X refuses to do so, you sell the idea that browser X is compromised for all users everywhere (not just in Kazakhstan) Stop thinking about the country with literally less than 1% of world internet users and start thinking of the reputational damage a less than charitable presentation of your collaboration with a totalitarian state against you…

Apple is openly collaborating with Chinese regime, including allowing the government to snoop on all Chinese traffic, yet they still have a high reputation for privacy. This just doesn't work, people don't give a shit about other countries.