181–190 of 378 posts
Earlier quoted context omitted.
And it wouldn't work. You've apparently have never been stuck inside China. I was there for a few years and it was brutal, network wise. Local companies just replace what can't be accessed from the outside.
China had a large domestic Internet industry, though. KZ doesn't.
Earlier quoted context omitted.
No, just inject some JS that reads the required keys.
Okay, so it's (just) for reading the delivered data. Somehow I keep considering MitM a harmful attack (i.e. manipulating the data before it hits the user). My bad :)
Does it mean that using SSL the normal way will become impossible? I can't imagine this. How this can be enforced?
1) The only TLS connections that are let through are all MITM'd. 2) Every other TCP/UDP flow is checked for conformance with plain-text protocols (like HTTP), or far worse, simply for the level of entropy in the data. 3) A threat of legal action is made against anyone caught using secure crypto. Good luck beating that. The key here is that the "entropy detector" doesn't "really" need to work. It only needs to work we…
Earlier quoted context omitted.
There was no public uprising after Snowden in the US either ... Some will now say you can't compare this. They are right because what Kazakhstan is doing there looks amateurish.
For a while, I've been in the camp that the Snowden leaks were intentional and that he still works for the US. A rich work from home government contractor, with a smoking hot girlfriend, takes off with secrets and hides in Russia. His hot girlfriend is even allowed to join him. I think it's more likely the Snowden leaks were to show just how little Americans care. They're using that spy network to track reactions.
If we could rebuild the internet from scratch knowing that someone would try to do this, what measures could be put in place to make it impossible to MITM traffic (in other words, make it so the only option is to install monitoring software directly on the user's machine)? Is this something which even can be defeated with current cryptographic theory?
Earlier quoted context omitted.
These CAs have to follow specific rules and have external audit. MITM is prohibited by these rules: certificate authorities that participate or enable MITM are removed from root stores (example: https://en.wikipedia.org/wiki/DigiNotar ).
And sometimes the CAs might receive National Security Letters insisting on National Securtiy Certificates.
Wondering about a turtles-all-the-way solution: A web-socket based protocol that opens up a new SSL session with non-MITM'd certificates. So you'd open up the snoop-me HTTPS/1.1 connection, do some GETs, then say "GET /busy, yo", and start what looks like a video-chat conversation that is in fact a regular SSL connection with uncompromised certs. (some protocol) over SSL over Web-Socket over bad-SSL over TCP/IP
Ultimately, though it will be very hard to accept, crypto may be on the way out as a technology with any political impact. Governments currently accept the rapid increase in SSL because none of the politicians or regulators understand that it's possible to disable it at a country level, and nobody with any technical clue has been willing to point it out to them. But that situation isn't sustainable, as the Kazakh example shows. A sufficiently determined government won't care about minor details like user convenience. They'll just say "you either install our root cert, or you don't get to use the internet" and that's it. Game over. If even just one western country does it, the rest will all follow within a few years.
Earlier quoted context omitted.
No, just inject some JS that reads the required keys.
Okay, so it's (just) for reading the delivered data. Somehow I keep considering MitM a harmful attack (i.e. manipulating the data before it hits the user). My bad :)