Is MITM, as described in this article, using sslkeylogfile possible on Chrome for Android?
Spying on HTTPS
31–40 of 121 posts
Re: Spying on HTTPS
#32Honest question, is it possible to have chrome disable the functionality to export the SSL private key? IE on that notification is there a button to deny the stream?
What private key?
Again, these are _secret_ keys. That's why the word SECRET n capital letters appears in that output at the end. Symmetric cryptography is used to actually transport data, and so it uses secret keys. These are agreed between client and server for each session and by getting a copy of them you can read (and in principle modify) the data as it passes between them. A private key would be a key that only one party knows.
The notification is a reminder that this is an unsupported configuration of the browser software, useful for developers but not really intended for your garbage "Anti-virus" software to try to hook into. Just remove/ disable the AV?
Re: Spying on HTTPS
#33> monster in the middle (MITM) That’s not what it stands for. There’s nothing sexist about using an acronym the same way everyone else does.
Gender neutral and more accurate, it might not be how everyone else uses it but you got the meaning, no?
I would like person-in-the-middle attack, but unfortunately PITM would not be recognized as well as MITM. And in fact, it seems that we shouldn't really care so much that a person is in the middle, so we might be better off saying "in-the-middle attack" (ITM) anyway.
Today, "man-in-the-middle" sounds familiar but I wonder if in a few decades, saying "man" instead of "person" or "human" will bear more meaning than today, and if expressions like this will sound needlessly confusing and off-topic, like, "How being a man specifically is any relevant? Is there something special to men, relevant to the attack? Why should we care?" (though people would probably understand the history aspect of it; this would still require extra effort).
Languages has been evolving and there is nothing special about MITM that would make this particular expression immutable. We already got gender neutral pronouns in English, for which we are seeing a wide adoption now, and new pronouns feel like a pretty big change, much bigger than an evolution of the MITM expression.
Re: Spying on HTTPS
#34Honest question, is it possible to have chrome disable the functionality to export the SSL private key? IE on that notification is there a button to deny the stream?
Chrome isn't exporting the private key. It's importing the key you give it. Idk for what that is useful besides Virus Scanners, but personally I would like my browser to make its own key and never leak it or accept new ones.
> Chrome isn't exporting the private key. It's importing the key you give it.
No. It is _exporting_ the _secret_ key.
It can't import the key, in many modern key agreement schemes neither client nor server gets to dictate the keys used, if you used a fixed or predictable value instead of a random one you just give up your security, you gain nothing. So the keys are (and should be) random for each session.
Re: Spying on HTTPS
#35Earlier quoted context omitted.
I have seen it in at least one other project: https://blog.cloudflare.com/monsters-in-the-middleboxes/ , https://github.com/cloudflare/mitmengine I think it's equally understandable, and monster is objectively a more fun word. Seems like not a big deal?
It shifts the narrative to demonize MITM. Ironic seeing a Cloudflare link, given that they are MITMing all traffic. You are not a monster if you are doing it, it's corporations who are monsters if they try to prevent you from doing it and you are fighting for freedom from them. So it's freedom-in-the-middle.
It depends on the point of view and the situation.
If you are a free software developer reverse-engineering a graphics driver, you sure want to be able to intercept the traffic between the graphics card and the CPU (I don't do driver development so I might be completely off, but I hope you get the point anyway).
However, if you are having a conversation with a secret source, you want this freedom to not be intercepted.
Re: Spying on HTTPS
#36Last I checked, Wireshark can't be configured to decrypt a TLS 1.3 session (at least not yet).
Version 3.0.2 works fine to decrypt TLS 1.3
I'm using it right now, in fact, as I work on adding TLS 1.3 support to FreeBSD's kernel TLS
Re: Spying on HTTPS
#37Last I checked, Wireshark can't be configured to decrypt a TLS 1.3 session (at least not yet).
Time to check again, Wireshark can consume TLS 1.3 keys from a client or server to decrypt the session using the environment variable described here. I'm not actually sure which version you need, maybe 2.6 or later?
Re: Spying on HTTPS
#38Honest question, is it possible to have chrome disable the functionality to export the SSL private key? IE on that notification is there a button to deny the stream?
That's a good question. It seems like Chrome may be able to clear the environment variable so the TLS libraries don't see it.
Re: Spying on HTTPS
#39Earlier quoted context omitted.
Gender neutral and more accurate, it might not be how everyone else uses it but you got the meaning, no?
"Man in the middle" is not only an established concept it also is self-explanatory. Furthermore calling intercepters "monsters" is also a highly insensitive thing to do, if we're going to play the virtue signaling card. All this quixotism towards grammar and language is very stupid and pointless.
> "Man in the middle" is not only an established concept it also is self-explanatory.
Being comprehensible and established does not make it "good" (sure, this is a relative notion).
I get your point of view about calling the interceptors "monster", but we are calling the whole process an "attack", this could already be considered a judgment call with this reasoning.
Monster are not necessarily evil though. A myth that Monsters, Inc is actively trying to debunk :-)
> All this quixotism towards grammar and language is very stupid and pointless.
Many non-ignorant people think differently, so you need to argue here. Saying they are doing a stupid and pointless thing will not convince them.
Re: Spying on HTTPS
#40Earlier quoted context omitted.
> That's the ISP's problem. No. It is the user's problem, created by the ISP. > Mine doesn't do that. Otherwise put: "It isn't a problem for me, so why is anyone working on the issue instead of something that I do care about" > I trust it more than Google, at any rate. Fair enough. Though for many, choosing not to use Google properties is a lot easier than choosing not to use an ISP that they don't entirely trust.
How do I choose not to use Google properties, including their ad services, analytics, captcha, maps, etc? Is there at least a comprehensive list of their domains, if I choose to block it all (despite that rendering half the web unusable)?
Host list that lists every one of their domains with ip 0.0.0.0