MITM on HTTPS traffic in Kazakhstan • Hacker News Board

Re: MITM on HTTPS traffic in Kazakhstan

#461

Post by y0ghur7_xxx » Sat, Jul 20, 2019, 8:10 AM UTC

markovbot wrote: post #46

y0ghur7_xxx wrote: post #7

Earlier quoted context omitted.

There is a Name Constraints extension in X.509[1] that does exactly that, but to my knowledge no browser implements it. [1] https://tools.ietf.org/html/rfc5280#section-4.2.1.10

and that would have to be baked into the CA certificate, not specified when the CA is trusted. I dont want my browser to ask the CA what it's allowed to do, i want to tell it what it's allowed to do

It has to be baked into the CA, so that a browser vendor can check it before inclusion. If the CA specifies domains it is not allowed to sign certificates for, it will not be included.

Re: MITM on HTTPS traffic in Kazakhstan

#462

Post by gnull » Sat, Jul 20, 2019, 9:21 AM UTC

nurbo wrote: post #361

A fellow from Kazakhstan here. Banning this certificate or at least warning the users against using it WILL help a lot. Each authoritarian regime is authoritarian in its own way. Kazakhstan doesn't have a very strong regime, especially since the first president resigned earlier this year. When people protest strongly against something, the government usually backs down. For example, a couple of years ago the governme…

I totally agree with your point. Blocking this certificate in major browsers or warning users would be of great use.

But there is a minor remark I have to make here. I'm sure you were talking about citizens of Kazakhstan, when you used the word "Kazakhs". The word "Kazakh" actually denotes an ethnicity, not a citizenship. And although Kazakhs are predominant ethnicity in Kazakhstan (~65% of the population), there are many others, and it's incorrect to call them Kazakhs.

Wikipedia suggests "Kazakhstani" as a English term for Kazakhstan citizens. I also saw other people using the word "Kazakhstanians". Maybe one of these two would be a better choice than "Kazakhs".

Re: MITM on HTTPS traffic in Kazakhstan

#463

Post by vbezhenar » Sat, Jul 20, 2019, 2:06 PM UTC

noragami wrote: post #439

Hijacking the comment for better visibility. After getting some backlash, the government has already backed down. They claim that installing the certificate is entirely voluntary. https://rus.azattyq.org/a/30064788.html They have been talking about this stuff for some years, though. It will get implemented at some point. I have a feeling it was one of their "test trials": can we boil the frog yet, or do we have to he…

They are not backing down, they just saying meaningless words. My wife phone is MITMed right now and she can't open facebook, for example. How is it voluntary?

Re: MITM on HTTPS traffic in Kazakhstan

#464

Post by wnscooke » Sat, Jul 20, 2019, 3:09 PM UTC

gnull wrote: post #462

nurbo wrote: post #361

A fellow from Kazakhstan here. Banning this certificate or at least warning the users against using it WILL help a lot. Each authoritarian regime is authoritarian in its own way. Kazakhstan doesn't have a very strong regime, especially since the first president resigned earlier this year. When people protest strongly against something, the government usually backs down. For example, a couple of years ago the governme…

I totally agree with your point. Blocking this certificate in major browsers or warning users would be of great use. But there is a minor remark I have to make here. I'm sure you were talking about citizens of Kazakhstan, when you used the word "Kazakhs". The word "Kazakh" actually denotes an ethnicity, not a citizenship. And although Kazakhs are predominant ethnicity in Kazakhstan (~65% of the population), there are…

But he actually could have been talking primarily about Kazakhs in Kazakhstan, so nothing wrong there.

Re: MITM on HTTPS traffic in Kazakhstan

#465

Post by Avamander » Sat, Jul 20, 2019, 4:12 PM UTC

michaelt wrote: post #430

Avamander wrote: post #161

Earlier quoted context omitted.

Not when the cert has been previously CT and Staple preloaded I suspect?

If a user manually imports a CA, it bypasses protections like CT [1]. This is a feature specifically designed to allow MITM for corporate proxies. Always seemed like a misfeature to me, but all the browsers do it. [1] https://chromium.googlesource.com/chromium/src/+/master/net/...

Sounds ridiculous that even when a site host specifically says they want things Stapled and CTd are ignored like that.

Re: MITM on HTTPS traffic in Kazakhstan

#466

Post by schoen » Sat, Jul 20, 2019, 9:53 PM UTC

mdhardeman wrote: post #213

schoen wrote: post #4

Earlier quoted context omitted.

No, although the root itself could be scoped that way with an X.509 name constraint. But if you add the root then I believe there's no browser policy to otherwise limit the names for which it can be trusted.

Actually true root certs when evaluated by the browsers will have their name constrains within the root certificate themselves ignored. Modern browsers do respect name constraints of intermediate issuing certificates.

Thanks for the correction!

Re: MITM on HTTPS traffic in Kazakhstan

#467

Post by worldofmatthew » Sun, Jul 21, 2019, 6:01 PM UTC

isostatic wrote: post #438

worldofmatthew wrote: post #203

Earlier quoted context omitted.

You might be able to make intranet.company-name.tld and have a parking page on the company-name.tld and use that to get a wildcard cert that can be used for the internal pages.

Which you distribute to thousands of people on tens of thousands of devices?

With this you would have a vaild cert for your intranet aka no need to install a self-signed one.

Re: MITM on HTTPS traffic in Kazakhstan

#468

Post by GordonS » Sun, Jul 21, 2019, 6:52 PM UTC

viraptor wrote: post #409

the_duke wrote: post #395

Earlier quoted context omitted.

Then just use a wildcard cert.

Wildcard certs are a security ops nightmare. You really don't want to throw the private key for that around to every small project, and you need some good, automated way of rolling them across multiple services. Doable, but if you can avoid this, it's a better to avoid.

This 100x - in just about any organisation of any size, if you use a single wildcard cert for all internal services, then it's inevitable that the private key will end up in the hands of an employee that shouldn't have it.

Re: MITM on HTTPS traffic in Kazakhstan

#469

Post by huttarla » Tue, Jul 23, 2019, 4:59 PM UTC

gnull wrote: post #462

nurbo wrote: post #361

A fellow from Kazakhstan here. Banning this certificate or at least warning the users against using it WILL help a lot. Each authoritarian regime is authoritarian in its own way. Kazakhstan doesn't have a very strong regime, especially since the first president resigned earlier this year. When people protest strongly against something, the government usually backs down. For example, a couple of years ago the governme…

I totally agree with your point. Blocking this certificate in major browsers or warning users would be of great use. But there is a minor remark I have to make here. I'm sure you were talking about citizens of Kazakhstan, when you used the word "Kazakhs". The word "Kazakh" actually denotes an ethnicity, not a citizenship. And although Kazakhs are predominant ethnicity in Kazakhstan (~65% of the population), there are…

While technically this is true, it is rare (and sounds nerdy) for English speakers who are familiar with Kazakhstan to actually use the word "Kazakhstani" or especially "Kazakhstanian." The word "Kazakh" is used informally to refer to natives or citizens of Kazakhstan when the meaning is clear from the context. Similar to how "Americans" (which could arguably refer to any North or South American) is used instead of "U.S. citizens." Or "Saudis." At least that was my experience from living in K'stan for 4 years in the '90's.

Re: MITM on HTTPS traffic in Kazakhstan

#470

Post by gnull » Wed, Jul 24, 2019, 9:34 AM UTC

huttarla wrote: post #469

gnull wrote: post #462

Earlier quoted context omitted.

I totally agree with your point. Blocking this certificate in major browsers or warning users would be of great use. But there is a minor remark I have to make here. I'm sure you were talking about citizens of Kazakhstan, when you used the word "Kazakhs". The word "Kazakh" actually denotes an ethnicity, not a citizenship. And although Kazakhs are predominant ethnicity in Kazakhstan (~65% of the population), there are…

While technically this is true, it is rare (and sounds nerdy) for English speakers who are familiar with Kazakhstan to actually use the word "Kazakhstani" or especially "Kazakhstanian." The word "Kazakh" is used informally to refer to natives or citizens of Kazakhstan when the meaning is clear from the context. Similar to how "Americans" (which could arguably refer to any North or South American) is used instead of "…

I didn't know that. I'm not a native English speaker. If this is actually an established way to informally address Kazakhstan citizens in English, then it's OK, I do not object.

But I'm still skeptical about it. I think in my own speech I'll stick to "Kazakhstanian" (despite the word "Kazakh" is so much easier to type). Because I'm just used to make distinction between words "Kazakh" and "Kazakhstanian" when I speak Kazakh and Russian languages (most popular ones in Kazakhstan).