In China now. Ping to github is 280ms. The cert I receive is valid. So either they stepped up the game or it isn't universal.
Even the Chinese gov does A/B testing.
Github SSL replaced by self-signed certificate in China
61–70 of 78 posts
Re: Github SSL replaced by self-signed certificate in China
#62Firstly, thanks to GitHub using HSTS on github.com (although not www.github.com), the certificate error will be fatal in Chrome and (I believe, but haven't checked) Firefox as long as you have visited GitHub previously. (It's not preloaded HSTS so it would have to be learnt from a previous, unattacked connection.) I know that the unbypassable errors for some sites upset the more technically minded people, but I think…
didn't know of HSTS, thanks. where would one keep up with stuff like that other than keeping up with new rfc's?
I maintain a complete guide to SSL/TLS deployment:
SSL/TLS Deployment Best Practices https://www.ssllabs.com/projects/best-practices/
Re: Github SSL replaced by self-signed certificate in China
#63This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…
> It's weird that they start with Github.
I don't think it's safe to assume that they started with Github.
Re: Github SSL replaced by self-signed certificate in China
#64How long ago did this start? I wonder if it has anything to do with some of the issues with Github I (and others) were noticing on Friday[0]
[0] https://twitter.com/davidbalbert/status/294941563673522176
Re: Github SSL replaced by self-signed certificate in China
#65Earlier quoted context omitted.
Agreed there's nothing in the data to directly suggest government involvement. It's only "sloppy," though, when conceptualized as a MITM. China does have an extensive history of censoring access to sites, and recently censored access to GitHub entirely IIRC. It could be that they decided to block SSL access, but allow HTTP access, and this is how they implemented that.
Everything in my bones (25 years, 中文研究, China research) tells me the China government is directly involved with this. China is corrupt beyond belief, and any smaller destabilization can lead to further problems. I agree that this may be a further extending of the "New Years train ticket" block on Github. It may also be new toying after the recent "experiment". Leaving Github without SSL inside China still makes troub…
How does your 25y China research made the Chinese character wrong?
It should be 中国研究 but you said 中文研究, which means Chinese text research.
Re: Github SSL replaced by self-signed certificate in China
#66Earlier quoted context omitted.
didn't know of HSTS, thanks. where would one keep up with stuff like that other than keeping up with new rfc's?
I maintain a complete guide to SSL/TLS deployment: SSL/TLS Deployment Best Practices https://www.ssllabs.com/projects/best-practices/
You may want to integrate some of the advice from here in your HSTS section:
http://coderrr.wordpress.com/2010/12/27/canonical-redirect-p...
It seems even github is susceptible to this. That is, for people who type www.github.com into their browser rather than github.com. They both did the redirect wrong, as well as left off HSTS of https://www.github.com.
Re: Github SSL replaced by self-signed certificate in China
#67It sucks my client will be able to say he was right about now allowing source code to be hosted on github. (We ended up setting up a gitlab box and it works just as well)
What exactly is he right about? China hasn't done anything that you can't do on a local WiFi connection. They grab the connection and put a self-signed cert to it. Security is still intact. The only way this hurts anyone is if they blindly trust all certificates, in which case they're screwed anyways.
I'm not saying he's right about anything -- he'd remind me of his preference to host inhouse.
Personally, I use a mix
Re: Github SSL replaced by self-signed certificate in China
#68What bugs me about stuff like this is that there will always be mercenaries, guys just like you and me that will do anything as long as it pays. The Chinese government wouldn't stand a chance if they had to do this stuff themselves. Mercenary coders are nothing new, we have them in every country (and sysadmins, companies and so on). But you have to wonder what goes on in their heads, what mindset would prompt you to…
We should be worried about mercenaries when it comes to malware, Russian botnets, and the like.
In the case of the Chinese government, I believe the bigger problem is patriots. They honestly believe that they are doing the Right Thing. So did the people who wrote Stuxnet.
Re: Github SSL replaced by self-signed certificate in China
#69In China now. Ping to github is 280ms. The cert I receive is valid. So either they stepped up the game or it isn't universal.
In a Hotel in Beijing. Ping around the same, Chrome does SSL and shows no error.
Re: Github SSL replaced by self-signed certificate in China
#70This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…
FWIW, I always try to remove the CNNIC root cert from my setups. It's not that hard to do (except for iOS devices) and I have never had an issue since I don't frequent sites that would be signed by CNNIC.