The Great Cannon has been deployed again • Hacker News Board

Re: The Great Cannon has been deployed again

#271

Post by mminer237 » Fri, Dec 06, 2019, 6:01 PM UTC

cryptozeus wrote: post #156

mminer237 wrote: post #98

Earlier quoted context omitted.

Although Baidu does still default to HTTP, the Chinese government has the root certificates for every Chinese certificate authority. It can MITM traffic for anybody in China, even over HTTPS, so that wouldn't solve the problem.

Wow really? Any source for this ? That is like everyone can lock their house but gov has the master key.

I suppose I probably overstated the situation a bit. The PRC National Intelligence Law ( http://cs.brown.edu/courses/csci1800/sources/2017_PRC_Nation... ) requires, "Any organization or citizen shall support, assist and cooperate with the state intelligence work...", and China was observed making its own certificates for foreign sites before this ( https://news.ycombinator.com/item?id=5124784 ), but there's no direct evidence that China actually has all the root certificates currently or has used them maliciously. Of course, the law requires citizens to preserve secrecy and Westerners can't observe what China is doing, so that wouldn't be unexpected.

Re: The Great Cannon has been deployed again

#272

Post by [deleted] » Fri, Dec 06, 2019, 6:02 PM UTC

LandR wrote: post #64

pkilgore wrote: post #7

So if the cannon is created using the great firewall, how does the Chinese government establish any sort of plausible argument that this isn't state-sponsored activity? Do they just not care? Some day soon a war will not be started with an assassins bullet but with a tool like this. I wonder when we start looking at them the same way?

[flagged]

[deleted]

Re: The Great Cannon has been deployed again

#273

Post by indemnity » Fri, Dec 06, 2019, 6:02 PM UTC

rahuldottech wrote: post #207

yumraj wrote: post #89

Can/shouldn't the rest of the world create a Greater firewall to block the traffic from China? Let China enjoy it's solitude and we'll enjoy our openness.

Yeah except we will effectively be cutting off _all_ outside information from the Cinese citizens, who already have to face incredible amounts of censorship. Cut them off completely, and we will never find out about all the human rights violations taking place in their country, and their government will be able to brainwash its citizens even more easily.

Their problem to solve, clearly they don’t care enough to do so.

Re: The Great Cannon has been deployed again

#274

Post by smabie » Fri, Dec 06, 2019, 6:03 PM UTC

jMyles wrote: post #263

greggman2 wrote: post #241

Earlier quoted context omitted.

Unfortunately there's a giant category of devices that can't serve TLS. Like pretty much every consumer router in existence that you connect to through a webpage. Someone needs to come up with a solution for that. Ideally one that works with free and open source projects and not just well funded companies.

> Unfortunately there's a giant category of devices that can't serve TLS. Like pretty much every consumer router in existence that you connect to through a webpage. Come on now. Of course those devices can use TLS - they just can't do so in the capricious constraints imposed by the system of "certificate authorities". It's not a fundamental limitation of the technology. If we were using something like noise protocol,…

I'm not familiar with this problem, could someone explain? Thanks!

Re: The Great Cannon has been deployed again

#275

Post by ghostly_s » Fri, Dec 06, 2019, 6:04 PM UTC

DyslexicAtheist wrote: post #254

This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…

I don't quite understand the mechanism after reading the article. Is the attacker (presumably the PRC) MITM'ing these CDN resources at the infrastructure level? If they had exploits in place within these CDNs (presumably within the PRC's capabilities) HTTPS wouldn't help, no?

Re: The Great Cannon has been deployed again

#276

Post by ct520 » Fri, Dec 06, 2019, 6:05 PM UTC

and then the hacker news cannon took down att's site..

Re: The Great Cannon has been deployed again

#277

Post by emilfihlman » Fri, Dec 06, 2019, 6:07 PM UTC

degenerate wrote: post #249

dfawcus wrote: post #236

That page generates no response for me, https://archive.is/I1WO6 does.

Thanks. For others using CTRL+F to find this link, some keywords... [ archive, site down, 404, error page, mirror ] Edit: better/cleaner version: https://outline.com/8BBX3b

Probably want to add the actual error code of 504 gateway timed out timeout

Re: The Great Cannon has been deployed again

#278

Post by jstummbillig » Fri, Dec 06, 2019, 6:08 PM UTC

TheRealPomax wrote: post #267

upofadown wrote: post #218

Browsers really have to be a lot more skeptical about the code they run. Running code should not be able to randomly attack any IP address on the internet. Code from non-TLS pages should not be able to run at all. Perhaps that should also apply to code loaded from 3rd party sites. Connecting to a web page should not be consent to allow the operators of that web page to make my computer/phone do whatever they want on…

This sounds like a knee-jerk reaction that doesn't take into consideration the ramifactions of the suggested policy. It won't stop DDoS attacks, because those exist _because the internet exists_ and unless you dismantle the very concept of interconnected "everyone can reach everyone" networking, all you're doing is locking down access to more and more people until only technical experts or the people with enough mone…

This, on the other end of the spectrum, seems overly and naively liberal, when not being paired with a workable solution to the massive body of education required to provide adequate technical sophistication to (what has to be most of) 8 billion people.

Re: The Great Cannon has been deployed again

#279

Post by cc81 » Fri, Dec 06, 2019, 6:09 PM UTC

wnoise wrote: post #261

cc81 wrote: post #122

Earlier quoted context omitted.

I'm not defending China at all, they have tons of shitty policies. I'm just saying it is nothing like the holocaust and it is pretty absurd when people do those kind of comparisons. It reminds me of just before the Iraq invasion when the propaganda was at it's highest (Freedom fries and Dixie Chicks). If I again compare with the US as an example even if people don't like that. You have had many hundred if not thousan…

> I'm just saying it is nothing like the holocaust and it is pretty absurd when people do those kind of comparisons. It's clearly not exactly the same as the Holocaust. But it's disingenuous to say it's nothing like the Holocaust either, because there are a lot of similarities.

Do you think they are more similar to the Holocaust than the US internment camps?

Re: The Great Cannon has been deployed again

#280

Post by mminer237 » Fri, Dec 06, 2019, 6:09 PM UTC

jefftk wrote: post #107

mminer237 wrote: post #95

Earlier quoted context omitted.

The Chinese government has the root certificates for every Chinese certificate authority. It can MITM traffic for any citizen, even over HTTPS.

What makes this attack powerful is not that sites within China can be shut down (the government can already do that) but that sites outside of China can be tricked into DDOSing other sites outside of China. Which is why this attack only works over HTTP.

What I mean is that China can just force a CA to give the CPC its root certificate and then just intercept and edit any HTTPS responses to Chinese citizens and resign them as secure.