Kazakhstan to MitM all HTTPS traffic starting Jan 1 • Hacker News Board

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#301

Post by patcheudor » Thu, Dec 03, 2015, 3:55 AM UTC

asymmetric wrote: post #291

patcheudor wrote: post #250

Earlier quoted context omitted.

What do you do? You immediately reach out to Apple, Google, Facebook, Twitter, Box, Dropbox, Tumblr, and any other popular platform which has mobile apps. You ask, or down-right demand they implement certificate pinning in their apps so they will fail when middled with the government provided certificate. This will in turn break access to those platforms via mobile apps which will result in very real and direct impac…

Down-right demand? With what authority? It sounds like you're confusing these corporations for governments, as if they had to enforce your human rights..

The authority of the free market. Did web PKI develop because of governments? No. In fact, quite the contrary. Similarly, if consumers are educated and aware of the weaknesses of current cryptography controls in light of new threats such as governments requiring the installation of their own root CA so they can middle the connection, maybe they'll drive demand for better controls, controls which already exist.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#302

Post by marvy » Thu, Dec 03, 2015, 4:01 AM UTC

sukulaku wrote: post #300

a12y wrote: post #245

Earlier quoted context omitted.

>Kazakh here. Fuck, what do we do? Any suggestions other than trying to raise awareness? Revolution or leaving the country are your only choices. There is no democracy so there is probably no way to resolve this grievance, and I doubt it would be anywhere near the top of list for most citizens. You can speak english and probably have computer skills, so I hope it would be possible for you to get out.

> There is no democracy so there is probably no way to resolve this grievance Just for the record, look to the US for a good example of how well democracy works for "resolving grievances". Occupy Wall Street protesters aired some grievances, and were beaten and tased into submission. The same happens anywhere, every time the citizenry actually demands something. It's kind of amazing how people still hold democracy as…

Beaten into submission? Maybe they tried that, but eventually what worked was that they were legislated into submission. They found some technicality for why they couldn't legally occupy that space, and everything went downhill fast after that. (I could be wrong. I wasn't paying much attention at the time.)

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#303

Post by ta0o0o0 » Thu, Dec 03, 2015, 4:09 AM UTC

duncan_bayne wrote: post #254

com_kieffer wrote: post #251

Earlier quoted context omitted.

The same way that Stuxnet destroying Iranian centrifuges was an act of war ?

Yes. Although I'd have thought that particular war would have started back with the hostage-taking in, what, 1979? I really don't understand relationships between States.

I'm not a West Hater by any means, but I'd say the war started when the US and the UK engineered a coup in Iran because Iran nationalized their oil industry (after the British oil company running it refused to be audited or to renegotiate terms).

https://en.wikipedia.org/wiki/1953_Iranian_coup_d'%C3%A9tat

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#304

Post by gideon_b » Thu, Dec 03, 2015, 4:31 AM UTC

Aww but there's a kitten. This must be innocent.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#305

Post by viraptor » Thu, Dec 03, 2015, 4:38 AM UTC

airza wrote: post #126

atmosx wrote: post #45

Earlier quoted context omitted.

Install the certificate, then route all your connections through a tunnel. Multiple options are available like openvpn, shuttle[1], etc.. [1] https://github.com/apenwarr/sshuttle/

I assumed that they would refuse to serve traffic that they couldn't decrypt with this certificate.

Not all traffic relies on certificates. Not all traffic relies on known PKI structures. Most known protocols this doesn't apply to: ssh, various vpns.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#306

Post by purplerabbit » Thu, Dec 03, 2015, 4:45 AM UTC

asymmetric wrote: post #291

patcheudor wrote: post #250

Earlier quoted context omitted.

What do you do? You immediately reach out to Apple, Google, Facebook, Twitter, Box, Dropbox, Tumblr, and any other popular platform which has mobile apps. You ask, or down-right demand they implement certificate pinning in their apps so they will fail when middled with the government provided certificate. This will in turn break access to those platforms via mobile apps which will result in very real and direct impac…

Down-right demand? With what authority? It sounds like you're confusing these corporations for governments, as if they had to enforce your human rights..

Authority is a self-made concept, and governments are just a type of corporation. Of course neither "has" to enforce your human rights, but if these corporations stood up for the people it would be good for everyone involved.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#307

Post by roywiggins » Thu, Dec 03, 2015, 4:51 AM UTC

peteretep wrote: post #273

kazakh wrote: post #213

Kazakh here. Fuck, what do we do? Any suggestions other than trying to raise awareness? To give some context, the reason why they are getting away with such brute methods is that the most people wouldn't understand the full implication. I would be surprised if this would prove difficult to enforce - the first thing an ordinary person would do when, say, Facebook wouldn't load is to call up the Kazakhtelecom's support…

> most people wouldn't understand the full implication So attack that. Tell a story. What does this allow the government to do? Could a jealous ex-lover who works for the government read their ex's messages? Could the local mayor find out if you've got a medical problem? Get an illustrator to draw these up as little comics. Make images that people can understand. This is a great example: http://www.wordstream.com/ima…

Keep the government out of our dick picks!

John Oliver: Government Surveillance https://youtu.be/XEVlyP4_11M?t=1518

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#308

Post by duncan_bayne » Thu, Dec 03, 2015, 5:08 AM UTC

ta0o0o0 wrote: post #303

duncan_bayne wrote: post #254

Earlier quoted context omitted.

Yes. Although I'd have thought that particular war would have started back with the hostage-taking in, what, 1979? I really don't understand relationships between States.

I'm not a West Hater by any means, but I'd say the war started when the US and the UK engineered a coup in Iran because Iran nationalized their oil industry (after the British oil company running it refused to be audited or to renegotiate terms). https://en.wikipedia.org/wiki/1953_Iranian_coup_d'%C3%A9tat

Whereas I'd say the problem was forced nationalisation.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#309

Post by Sleaker » Thu, Dec 03, 2015, 5:23 AM UTC

briandear wrote: post #93

Sleaker wrote: post #33

Earlier quoted context omitted.

Actually they really should. As soon as major networks start saying NO is when governments change, I think this is one of the few times where this kind of pressure would be mostly good.

And it wouldn't work. You've apparently have never been stuck inside China. I was there for a few years and it was brutal, network wise. Local companies just replace what can't be accessed from the outside.

What's worse being complicit or refusing to play by a governments rules?

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#310

Post by KirinDave » Thu, Dec 03, 2015, 5:25 AM UTC

RKearney wrote: post #261

patcheudor wrote: post #250

Earlier quoted context omitted.

What do you do? You immediately reach out to Apple, Google, Facebook, Twitter, Box, Dropbox, Tumblr, and any other popular platform which has mobile apps. You ask, or down-right demand they implement certificate pinning in their apps so they will fail when middled with the government provided certificate. This will in turn break access to those platforms via mobile apps which will result in very real and direct impac…

Certificate pinning does not work with certificates that are installed in the devices trusted certificate store.

Apps can certificate pin in 2 ways. One, they can directly inspect the certificate fingerprint and pin to a specific fingerprint (I chose this method for Level Money's product).

The other option is to examine and pin the signing certificate. This is more code and more prone to error, but makes your connection slighty more robus in the face of a compromised certificate.

And yes, both techniques work even if a cert in your root store has another certificate. Applications can simply refuse to function, but this has to be done on an ad hoc basis.