Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MITM on HTTPS traffic in Kazakhstan

bugzilla.mozilla.org

Post reply on HN
Print view View original

281–290 of 471 posts

Re: MITM on HTTPS traffic in Kazakhstan

#281

Post by technion »

vbezhenar wrote: post #238
GordonS wrote: post #167

Earlier quoted context omitted.

There are more benign uses too - many organisations run an internal PKI, and installing their root CA prevents employees' browsers from displaying warnings about untrusted certificates when accessing internal web apps/sites.

That would be a bad use IMO. Letsencrypt solves any need for legitimate certificates.

I don't think it's a bad use. When I logon to my SAN or UPS web interfaces, I don't want to type https://ups01.publicDNSdomain.com, and visit a site with a CT logged certificate. It's an absolutely internal thing and every Active Directory domain already has an (ideally) non-externally resolved DNS domain setup for use. You've already got an internal CA and deployed your own root because there's a series of Microsoft services that work best this way, so it makes a lot of sense to continue to use rather than trying to introduce Lets Encrypt in this scenario.

Re: MITM on HTTPS traffic in Kazakhstan

#282

Post by vbezhenar »

technion wrote: post #281
vbezhenar wrote: post #238

Earlier quoted context omitted.

That would be a bad use IMO. Letsencrypt solves any need for legitimate certificates.

I don't think it's a bad use. When I logon to my SAN or UPS web interfaces, I don't want to type https://ups01.publicDNSdomain.com , and visit a site with a CT logged certificate. It's an absolutely internal thing and every Active Directory domain already has an (ideally) non-externally resolved DNS domain setup for use. You've already got an internal CA and deployed your own root because there's a series of Microsof…

You don't have to serve that website publicly or even set up DNS records. You only need to set up DNS verification to serve one public TXT record for letsencrypt. Everything else could be internal. Letsencrypt certifies that you own domain. You can do anything with that domain.

Re: MITM on HTTPS traffic in Kazakhstan

#283

Post by mdhardeman »

bcoates wrote: post #271
mdhardeman wrote: post #255

Earlier quoted context omitted.

That's fair, but the country doing this will just fork an open-source browser and make it their official browser.

Sure. "don't use Kazakhfox, it's malware, we've submitted definitions to the AV databases" isn't a hard sell for your 99%+ audience. Malware forks of open source projects (and closed-source software!) are not a new problem.

Except they are a new problem when the use of them is mandated by a nation-state.

Re: MITM on HTTPS traffic in Kazakhstan

#284

Post by blackflame7000 »

mdhardeman wrote: post #235
zrm wrote: post #229

Earlier quoted context omitted.

Ethernet can carry protocols other than IPv4. IPv6 is one of them, but there were at one time a whole slew of them, like IPX and Appletalk. But ISPs don't carry them, so they're effectively blocked and have largely died out, and everything uses IPv4 or IPv6. Even if you want to use Appletalk today, you encapsulate in IPv4 or IPv6. There are also a whole bunch of IP transport protocols other than TCP and UDP, but fire…

I'll be 40 years old later this year. I've been interested in communications and communications protocols since I was about 12. I've been a software developer with a focus on network communications for over 15 years. I'm well aware of all that you've said. My point was, they get TLS interception down, and they capture what they want from a target of interest. When they look closely at your traffic and decide all thes…

In that case, the old field of steganography might become useful. Embed illegal content within legal content and figure out another means of sharing the decryption scheme.

Re: MITM on HTTPS traffic in Kazakhstan

#285

Post by vbezhenar »

cat199 wrote: post #276
vbezhenar wrote: post #238

Earlier quoted context omitted.

That would be a bad use IMO. Letsencrypt solves any need for legitimate certificates.

> Letsencrypt solves any need for legitimate certificates. ... unless you want any private keys to be personally signed and or generated by bob & alice over in security after checking some boxes in an internal audit form, or any other number of company-internal schemes involving signing and encryption of business-specific data

You're generating private key securely. You're generating CSR which contains public key and signed by that private key and now you need to move that CSR from private location to a public location. But that's not bad, it does not contain anything that could be compromised and your private key is kept safe. Then you're using letsencrypt to issue that certificate using that CSR and keep using that CSR (it does not expire) to renew certificate. All that time private key is kept in safety and is only used by your webserver. Letsencrypt allows you to generate legitimate certificate for internal websites without any compromise on security.

The only use-case that's not possible with Letsencrypt is to issue certificate for IP address.

Re: MITM on HTTPS traffic in Kazakhstan

#286

Post by dmix »

unilynx wrote: post #250
dmix wrote: post #53

Earlier quoted context omitted.

It’s far harder if you have a major tech industry to push back and the whole massive security risk this exposes big corporations to. Which is something Kazakhstan must not have much of. This is also terrible for foreign investment and attracting business. It also makes foreign intelligence’s job easier.

You’ve got their priorities mixed up. Staying in power is more important than foreign investment if you’re an authoritarian government. What’s the point of growing the economic pie if you’re not in a position to profit from it ? Now if you’re a politician in a democracy, you know it may be all over in about 8 years, so it’s more your interest to cosy up to the companies

It’s rare for a politician to only work 4yrs at the policy making level. Most of them are career politicians these days or retired wealthy people, not people with regular jobs giving politics a shot. Yet they all seem to be wealthy in the US, even after years of public service, regardless of their overt stance on business politically. Which is something the big firms can always rely on.

Re: MITM on HTTPS traffic in Kazakhstan

#287

Post by vbezhenar »

layoutIfNeeded wrote: post #257
vbezhenar wrote: post #238

Earlier quoted context omitted.

That would be a bad use IMO. Letsencrypt solves any need for legitimate certificates.

Lol. Sure, company sysadmins will run certbot on their mainframes.

There are plenty of clients for letsencrypt, including even Bash ones. That should not be a problem.

Re: MITM on HTTPS traffic in Kazakhstan

#288

Post by filleokus »

Does these MITM-middleware softwares usually verify the cert presented by the server? If not, I guess this could be used to double-MITM the user?

If someone manages to redirect traffic by e.g DNS spoof to some server which presents a self-signed certificate for e.g Facebook.com, the government-MITM would just sign that as being Facebook.com.

Re: MITM on HTTPS traffic in Kazakhstan

#290

Post by aembleton »

mdhardeman wrote: post #222
baq wrote: post #216

Earlier quoted context omitted.

for all we know NSA may already be doing that all the time, and they're only the worst of the good guys.

Modern browsers require that leaf certificates which are issued in a chain which descends from a built in publicly trusted root include "certificate transparency" information. This means that the certificate has been published in numerous public logs and so would be discovered. No doubt the NSA intercepts all kinds of things, but they're not doing it with TLS MITM technology (at least not without further additional h…

That is, assuming that your downloaded copy of Firefox contains these root certificates and not some different ones.
Post reply on HN