Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kazakhstan to MitM all HTTPS traffic starting Jan 1

telecom.kz

Post reply on HN
Print view View original

121–130 of 378 posts

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#121

Post by tptacek »

cwyers wrote: post #110
tptacek wrote: post #98

Earlier quoted context omitted.

That's another arms race Chrome will lose, because the market for the kinds of enterprise configuration management and "host protection" tools that could override this policy exists and is very lucrative. Chrome would simply be begging enterprise security companies to release products to fuck up their browser. I disagree with you.

Or someone just forks Chromium and releases Chromium For Enterprise.

Which again helps nobody, because forks of Chromium will inevitably lag on security fixes.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#122

Post by fleitz »

akie wrote: post #34

Love the Orwellian Newspeak: a "National Security Certificate" to protect people accessing "foreign resources"... If you don't know anything about the subject it really sounds like they're doing you a favor.

When you replace Certificate with Letter we understand how dedicated our governments are to our well being.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#124

Post by nullpage »

danpalmer wrote: post #86

This is what HTTP Public Key Pinning (HPKP) protects against. It allows a server to specify the only set of certificates that a browser should accept. Meaning that MITM'ing is impossible, without a valid cert in the chain of one of the advertised trusted certificates from the server. Chrome, Firefox, Opera, Chrome for Android, and the Android stock browser all support it. I'm not sure how they intend to circumvent th…

It is a little more complicated than that. If you start doing MITM on https connections where pinning is involved, typically those sites / apps will just stop working as they don't trust the CA for the cert that is injected during the MITM. So yes it 'protects' you, but it does so by not letting you access that page / app. Chrome (and I'm sure most other browsers / apps) can have their pins overriden by user installed root CA's (which is what they are pressuring people to do in this scenario).

You can read more about how Google does certificate pinning here: https://www.imperialviolet.org/2011/05/04/pinning.html

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#125

Post by mtgx »

bpodgursky wrote: post #115
davidu wrote: post #72

Google, Facebook, Yahoo, Microsoft, Salesforce, Box, Dropbox, Twitter, etc. could have a very strong influence on changing this if they banded together to respond to this in some way. The government might be doing what they think is right, but public backlash can change policy almost overnight. We saw this in the US recently with SOPA/PIPA. The "Internet" response was unprecedented. The people of Kazakhstan can achie…

Google, Facebook, Yahoo, etc tried this in China and failed. It inconvenienced the people, but it's not going to cause a popular uprising. In the west, you forget that guns and the threat of raw violence by the government are a very real deterrent Kazakhstan isn't going to produce a Baidu, but I'm sure Yandex and VK would be happy to fill a void and play along with their rules. And in the end, people just have less a…

And BlackBerry tried in Pakistan and "succeeded" - at least in delaying the shutdown of its servers by another month.

It's easier to do it in countries where "freedom" was the status quo and then the government decides to do something like that. China isn't exactly a free country to begin with, and the Great Firewall was older than Google in China.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#126

Post by airza »

atmosx wrote: post #45
airza wrote: post #3

So like, what's the plan for people visiting Kazakhstan here? Install some rando's SSL certificate in your trust store or just not be allowed to access the internet?

Install the certificate, then route all your connections through a tunnel. Multiple options are available like openvpn, shuttle[1], etc.. [1] https://github.com/apenwarr/sshuttle/

I assumed that they would refuse to serve traffic that they couldn't decrypt with this certificate.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#127

Post by NoGravitas »

RyanZAG wrote: post #83

Woah, it can't be stressed how bad this is. If this succeeds, other countries will definitely follow! If it can be shown to work, it will be demanded that this be implemented by pretty much everyone for difficult to deny political reasons (terrorists, children, crime, etc) This feels like the first bullet in a new war that will occur in every parliament world wide.

It is already par for the course in the enterprise world (both public and private sector), for difficult to deny political/economic reasons.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#128

Post by iofj »

exelius wrote: post #60
tptacek wrote: post #40

Earlier quoted context omitted.

If the protocol is delivered over HTTP and runs in Javascript DOM context, it will be straightforward for an adversary that MITMs all traffic to defeat it.

Pretty sure that Netflix loads a Flash client (or some other trusted code module) to prevent this. But you're right; the browser isn't secure enough to enable client-side encryption over HTTP as it would be trivial to MITM and sideload JS code to defeat it.

That's the problem with "client-side encryption". It doesn't work because the provider also has the power to replace the code with no say from you.

And it's not very detectible because they do it all the time.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#129

Post by Elhana »

egeozcan wrote: post #10
kaizendad wrote: post #6

I really appreciate how they're doing this. The Chinese built up an amazing infrastructure for the Great Firewall; the Kazakhs just say "install our cert!" The Chinese spend billions and have to stay ahead of all of their citizens' clever new ideas at all times; the Kazakhs spend a few hundred and just need to point guns at their citizens until they install a cert. Sure, it's going to be difficult to enforce, but it…

> it's going to be difficult to enforce I guess it's just a matter of dropping every connection that you can't MITM, no?

You don't have to. Proxy handles the request and just gives response back to you signed with national cert. If you don't install it, your browser will just start complaining about every site. At least that is how Bluecoat ProxySG[1] works at my employee.

[1] https://bto.bluecoat.com/webguides/proxysg/security_first_st...

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#130

Post by yuhong »

davidu wrote: post #92
tptacek wrote: post #89

Earlier quoted context omitted.

No, it isn't. Locally installed certificates override pins; if they didn't, HPKP browsers wouldn't be deployable inside large companies that have regulatory requirements to monitor traffic from their own desktops, and there would be no benefit, because an adversary who can install software or reconfigure your machine can defeat pins in a variety of other less transparent ways. HPKP is great, but it doesn't address th…

As an aside, this is one of the reasons why I believe locally installed certificates overriding pinning has a quickly eroding shelf life... At some point, something bad will happen like this (or malware-based) and Chrome will raise their hand and say, "sorry enterprises, no more MITM at all, even for locally installed certificates." After that, IE and Firefox will follow and crypto will no longer be so trivially subv…

Someone suggested using a special icon in the address bar to denote this kind of thing.
Post reply on HN