Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MITM on HTTPS traffic in Kazakhstan

bugzilla.mozilla.org

Post reply on HN
Print view View original

451–460 of 471 posts

Re: MITM on HTTPS traffic in Kazakhstan

#451

Post by vbezhenar »

Jwarder wrote: post #434
vbezhenar wrote: post #400

Earlier quoted context omitted.

I really don't like the idea that some third forces would interfere with internal politics of my country. Browser should work according to technical standards, not according to what US citizens decided to be good or bad. If Firefox wants to forbid locally installed roots, I'm all for it, but implement it for everyone. That said, I don't see how government would step back. People are uninformed and generally passive,…

I also think there is a risk that Mozilla if blocks the government certs then that would turn all Firefox users in the country into criminals. I'm all for security and privacy, but it is a rough choice between protecting users from surveillance by their authoritarian government or trying to make sure users can follow local laws.

I don't think that we are there. There are no laws to circumvent the bans and in fact a lot of users are using VPNs. The only measures our government is doing is technical ones: ban websites, install DPI, now they apparently plan to MITM on some (or all) connections. But I've never heard about anyone convinced of circumventing those measures. In fact I'm not aware that any similar law exists.

We could be there one day. But now the fight is purely technical. I'm, personally, going to set up dedicated server on online.net and setup proper and fast VPN for all my relatives and friends. I hope that other people would do the same.

Re: MITM on HTTPS traffic in Kazakhstan

#452

Post by cpach »

williamscales wrote: post #450
cpach wrote: post #396

Earlier quoted context omitted.

Allright. But they didn’t do it for all ~300M citizens though, did they?

https://en.m.wikipedia.org/wiki/Room_641A They did it to everyone whose traffic transited ATT's backbone

I haven’t immersed myself into the details of the Room 641A scandal, but it does indeed sound awful. I do not approve of the operations of NSA/Five Eyes.

But let my re-phrase my question like this: Do we have any evidence that NSA can perform MITM on TLS 1.3? Using a federal US CA would be one way, tricking a CA to issue fraudulent leaf certificates would be another, but as established elsewhere in this thread, both those ways are quite noisy. Attacking the endpoint is another way, but once Mallory does that, all bets are off.

Re: MITM on HTTPS traffic in Kazakhstan

#453

Post by Ajedi32 »

noragami wrote: post #439

Hijacking the comment for better visibility. After getting some backlash, the government has already backed down. They claim that installing the certificate is entirely voluntary. https://rus.azattyq.org/a/30064788.html They have been talking about this stuff for some years, though. It will get implemented at some point. I have a feeling it was one of their "test trials": can we boil the frog yet, or do we have to he…

Are you sure that's really them backing down, and not just a way to obfuscate the issue? Technically yes, installing the certificate is voluntary; it's just that if you don't install it you won't be able to access the internet anymore when the government starts MITMing your connections.

Re: MITM on HTTPS traffic in Kazakhstan

#454

Post by _nickwhite »

neves wrote: post #443
tialaramex wrote: post #411

Earlier quoted context omitted.

If a user trusts this root CA (~ "installs the certificate") then someone who controls the root can now make their MITM look like the real deal, because it's trusted. After all you've said you trust them. Whether you _should_ trust the authoritarian government of Kazakhstan is a policy issue. On its own the root does not magically intercept the traffic, so Kazakh ISPs will need to do a bunch of (potentially quite exp…

How do I know that NSA does not have one root certificate pre-installed in my browser?

The NSA doesn't need a root certificate installed on your computer if they already have the private keys to the root and/or intermediate CA providers.

Re: MITM on HTTPS traffic in Kazakhstan

#455

Post by stirfrykitty »

Ajedi32 wrote: post #453
noragami wrote: post #439

Hijacking the comment for better visibility. After getting some backlash, the government has already backed down. They claim that installing the certificate is entirely voluntary. https://rus.azattyq.org/a/30064788.html They have been talking about this stuff for some years, though. It will get implemented at some point. I have a feeling it was one of their "test trials": can we boil the frog yet, or do we have to he…

Are you sure that's really them backing down, and not just a way to obfuscate the issue? Technically yes, installing the certificate is voluntary; it's just that if you don't install it you won't be able to access the internet anymore when the government starts MITMing your connections.

Let's say they make it mandatory. Would it be possible for a group of people with one having unfettered access because, say, they cross the border all the time to a place that has full Internet, and they use wget to tar/gzip entire sites, places this on a server in a city, and provides access with a self-signed cert that everyone involved with knows about.

Or failing that, some kind of digital dead drop with the files. If this could be updated a few times a week, that's better than not having access to material that you don't want the government to know about. It has to be possible.

Re: MITM on HTTPS traffic in Kazakhstan

#456

Post by hi41 »

gnull wrote: post #103

What is interesting is that some local internet providers in Kazakhstan used to inject their own ads into http websites their users visit. I wonder if they will start doing the same with https now. I noticed this behaviour last February with Kazakhtelecom (telecom.kz) internet provider. When I opened an http website in my browser and started clicking randomly on the parts of the page which are usually not clickable,…

Dumb question as I don't understand this well.

If I visit https://gmail.com, I expect all traffic to be encrypted because my browser checks that gmail is indeed using encrypted connection. How is this getting intruded upon?

More importantly, suppose I checkin to a hotel in USA as I usually do and use the hotel's wifi. Would they be able to intrude into my connection to https://gmail.com?

Could someone please give me some clarity on this.

Re: MITM on HTTPS traffic in Kazakhstan

#457

Post by LinuxBender »

noragami wrote: post #439

Hijacking the comment for better visibility. After getting some backlash, the government has already backed down. They claim that installing the certificate is entirely voluntary. https://rus.azattyq.org/a/30064788.html They have been talking about this stuff for some years, though. It will get implemented at some point. I have a feeling it was one of their "test trials": can we boil the frog yet, or do we have to he…

Folks should also periodically get fingerprints of sites they often use and keep logs of them, so that you might notice if something changes.

example:

    openssl s_client -servername www.paypal.com -connect www.paypal.com:443 /dev/null | openssl x509 -fingerprint -noout -in /dev/stdin                                                 
    SHA1 Fingerprint=E8:20:7A:27:8C:BE:D4:D9:7F:44:32:89:E7:6B:13:DD:CE:58:50:F6
Perhaps put all the sites you visit into a text file and loop through them into a date based file or append with date stamps. If enough people did this, you could probably even spot when an entire region is doing something shady or a company was potentially compromised.

Re: MITM on HTTPS traffic in Kazakhstan

#458

Post by JoshTriplett »

LinuxBender wrote: post #457
noragami wrote: post #439

Hijacking the comment for better visibility. After getting some backlash, the government has already backed down. They claim that installing the certificate is entirely voluntary. https://rus.azattyq.org/a/30064788.html They have been talking about this stuff for some years, though. It will get implemented at some point. I have a feeling it was one of their "test trials": can we boil the frog yet, or do we have to he…

Folks should also periodically get fingerprints of sites they often use and keep logs of them, so that you might notice if something changes. example: openssl s_client -servername www.paypal.com -connect www.paypal.com:443 /dev/null | openssl x509 -fingerprint -noout -in /dev/stdin SHA1 Fingerprint=E8:20:7A:27:8C:BE:D4:D9:7F:44:32:89:E7:6B:13:DD:CE:58:50:F6 Perhaps put all the sites you visit into a text file and loo…

Also see https://www.eff.org/observatory and https://www.grc.com/fingerprints.htm

Re: MITM on HTTPS traffic in Kazakhstan

#459

Post by drexlspivey »

hi41 wrote: post #456
gnull wrote: post #103

What is interesting is that some local internet providers in Kazakhstan used to inject their own ads into http websites their users visit. I wonder if they will start doing the same with https now. I noticed this behaviour last February with Kazakhtelecom (telecom.kz) internet provider. When I opened an http website in my browser and started clicking randomly on the parts of the page which are usually not clickable,…

Dumb question as I don't understand this well. If I visit https://gmail.com , I expect all traffic to be encrypted because my browser checks that gmail is indeed using encrypted connection. How is this getting intruded upon? More importantly, suppose I checkin to a hotel in USA as I usually do and use the hotel's wifi. Would they be able to intrude into my connection to https://gmail.com ? Could someone please give m…

> How is this getting intruded upon?

The connection is still encrypted the whole purpose of certificates is to verify with WHO you are connected with. In the Kazakhstan case the government by installing a root certificate has the ability to impersonate gmail.

> More importantly, suppose I checkin to a hotel in USA as I usually do and use the hotel's wifi. Would they be able to intrude into my connection to https://gmail.com?

If the site you visit is over https you can be relatively certain that you are indeed establishing an encrypted connection with the domain owner. If it's plain http anyone sniffing in the same wifi can see and mess with your traffic

Re: MITM on HTTPS traffic in Kazakhstan

#460

Post by arpa »

knd775 wrote: post #433
arpa wrote: post #370

Earlier quoted context omitted.

If someone could enlighten me where i'm wrong, it'd be much more constructive than simply downvoting.

https://blog.cloudflare.com/monsters-in-the-middleboxes/ https://mitm.watch

Thank you. An interesting technique, but ultimately very easily bypassed with minor effort on interceptors' behalf.
Post reply on HN