21–30 of 78 posts
I was wondering when Github was going to start supporting HSTS and 2-Factor Auth. I'm betting that it gets bumped in priority after this event. Nothing like an incident to move along security requirements! http://dev.chromium.org/sts https://www.duosecurity.com/features
Does anyone have any theories why China would use a self signed certificate when it's very indiscreet? A lot of users will just click through if given the opportunity (around 60% in chrome before new security measures prevented it[2]), but I doubt many users with truly sensitive private repos would do this.
[1] https://twitter.com/GreatFireChina/status/295236912594186240...
[2] http://www.imperialviolet.org/2012/07/19/hope9talk.html
[3] https://twitter.com/chenshaoju/status/295139636718743552/pho...
I was wondering when Github was going to start supporting HSTS and 2-Factor Auth. I'm betting that it gets bumped in priority after this event. Nothing like an incident to move along security requirements! http://dev.chromium.org/sts https://www.duosecurity.com/features
2FA serves as an annoyance to phishers, but whoever is doing this network attack has direct access to your session cookie.
To clarify, this looks more like someone turning off SSL access to GitHub than a proper MITM attack in the traditional sense. The certificate in that link is just a self-signed certificate, not something signed by a CA: Issuer: C=US, ST=Some-State, O=github.com, OU=github.com, CN=github.com Subject: C=US, ST=Some-State, O=github.com, OU=github.com, CN=github.com So your browser will warn you that you are not making a…
Appreciate your insight - thanks for weighing in on this.
To clarify, this looks more like someone turning off SSL access to GitHub than a proper MITM attack in the traditional sense. The certificate in that link is just a self-signed certificate, not something signed by a CA: Issuer: C=US, ST=Some-State, O=github.com, OU=github.com, CN=github.com Subject: C=US, ST=Some-State, O=github.com, OU=github.com, CN=github.com So your browser will warn you that you are not making a…
This seems really sloppy for China. Without further proof, I don't think it was the govt.
This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…
Spoofing GitHub's SSL certificate is a step in the direction of inserting espionage-style backdoors, as GitHub permits HTTPS read-only checkouts of repositories. I'm not suggesting that this will be free of problems, given how particular Git is about checksums, nor am I certain what methods they would use to acquire SSH commit access for altering repository contents to affect the rest of the world. Still, it's absolu…
I was wondering when Github was going to start supporting HSTS and 2-Factor Auth. I'm betting that it gets bumped in priority after this event. Nothing like an incident to move along security requirements! http://dev.chromium.org/sts https://www.duosecurity.com/features
It sucks my client will be able to say he was right about now allowing source code to be hosted on github. (We ended up setting up a gitlab box and it works just as well)
How do we know that this isn't just a hijack of a Chinese isps dns server or something similar? Maybe the same that happened to Goolge Morocco just a couple of days ago ( http://arabcrunch.com/2013/01/breaking-google-morocco-google... ).
- the Chinese gov't is trying to identify users/developers of train-ticket-purchasing bots [1]
- they are is interested in capturing some intellectual property contained in private repos
- it's just an exercise to watch & learn how computer-literate users circumvent a MITM attack
Given the recent Github blockade, I'd go with the first.