Kazakhstan to MitM all HTTPS traffic starting Jan 1
1–10 of 378 posts
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#2> The national security certificate will secure protection of Kazakhstan users when using coded access protocols to foreign Internet resources.
How is this protecting users? They are outright lying here, if I understand correctly. Also why are they asking for my location?
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#3So like, what's the plan for people visiting Kazakhstan here? Install some rando's SSL certificate in your trust store or just not be allowed to access the internet?
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#4> The national security certificate will secure protection of Kazakhstan users when using coded access protocols to foreign Internet resources. How is this protecting users? They are outright lying here, if I understand correctly. Also why are they asking for my location? http://i.imgur.com/fYKHRK1.png
Remember they have your location anyway from your IP address.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#5"telecom.kz wants to use your location."
NOPE
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#6I really appreciate how they're doing this. The Chinese built up an amazing infrastructure for the Great Firewall; the Kazakhs just say "install our cert!" The Chinese spend billions and have to stay ahead of all of their citizens' clever new ideas at all times; the Kazakhs spend a few hundred and just need to point guns at their citizens until they install a cert.
Sure, it's going to be difficult to enforce, but it should also be quite cheap.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#7> The national security certificate will secure protection of Kazakhstan users when using coded access protocols to foreign Internet resources. How is this protecting users? They are outright lying here, if I understand correctly. Also why are they asking for my location? http://i.imgur.com/fYKHRK1.png
Remember they have your location anyway from your IP address.
That makes it only more interesting. However, I assume, IP-based location isn't that granular?
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#8So like, what's the plan for people visiting Kazakhstan here? Install some rando's SSL certificate in your trust store or just not be allowed to access the internet?
They're likely only intercepting known https traffic (port 443). If you use a VPN and tunnel all traffic you probably won't have any issues.
If a nation-state with the resources of China has come up with a system that can still be (albeit nontrivially) bypassed then I would imagine Kazakhstan will have a much-less-sophisticated first iteration.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#9> The national security certificate will secure protection of Kazakhstan users when using coded access protocols to foreign Internet resources. How is this protecting users? They are outright lying here, if I understand correctly. Also why are they asking for my location? http://i.imgur.com/fYKHRK1.png
Remember they have your location anyway from your IP address.
They have a location, it may or may not be related to your location.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#10I really appreciate how they're doing this. The Chinese built up an amazing infrastructure for the Great Firewall; the Kazakhs just say "install our cert!" The Chinese spend billions and have to stay ahead of all of their citizens' clever new ideas at all times; the Kazakhs spend a few hundred and just need to point guns at their citizens until they install a cert. Sure, it's going to be difficult to enforce, but it…
> it's going to be difficult to enforce
I guess it's just a matter of dropping every connection that you can't MITM, no?