Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MITM on HTTPS traffic in Kazakhstan

bugzilla.mozilla.org

Post reply on HN
Print view View original

361–370 of 471 posts

Re: MITM on HTTPS traffic in Kazakhstan

#361

Post by nurbo »

A fellow from Kazakhstan here.

Banning this certificate or at least warning the users against using it WILL help a lot.

Each authoritarian regime is authoritarian in its own way. Kazakhstan doesn't have a very strong regime, especially since the first president resigned earlier this year. When people protest strongly against something, the government usually backs down. For example, a couple of years ago the government withdrew their plans of lending lands to foreign governments after backlash from ordinary people. If Kazakhs knew about the implications of installing this certificate, they would have been on the streets already.

If Firefox, Chrome and/or Safari block this certificate, the people will show their dissatisfaction and the law will be revoked.

Sometimes the people in authoritarian countries need a little bit of support from organizations to fight for their rights. I really hope the browser organizations would help us here.

Re: MITM on HTTPS traffic in Kazakhstan

#362

Post by me551ah »

Firefox and Chrome updating their browsers to block these certificates won't also work, since the Kazak government can just fork Firefox and create their own browser which accepts their rogue certificate. And block all other browsers which don't.

Re: MITM on HTTPS traffic in Kazakhstan

#363

Post by LoSboccacc »

bscphil wrote: post #310
LoSboccacc wrote: post #69

Earlier quoted context omitted.

to be fair some of us told from the beginning that making all user used to trust the green check would have caused this sort of trust fatigue to the point the majority would have stopped bothering with the actual certificate content and trust chain, and you can search my history highlighting this very issue in relation to let's encrypt, it was a social issue from the very beginning and I got downvoted heavily and rep…

I think you're missing one important detail: the idea behind the green padlock is that the average end user isn't technically capable of (or shouldn't have to) monitor all the details of their internet connections to make sure they're secure. If that basic intuition about users is correct, the solution is not to give up on this and force users to deal with the true complexity of the situation. The solution is for the…

if they can force a cert into your os trust store they can force a cert into your browser trust store, this solves some very specific issue but not this one.

Re: MITM on HTTPS traffic in Kazakhstan

#364

Post by darkhorn »

isostatic wrote: post #2

I have custom root certs for internal dev sites for my company. That's fine, but I'd like to add the root with a caveat that I control saying "I trust this root for *.mycompany.com,mycompany.org", but that I know means they wouldn't be able to proxy "mybank.com". I don't think Firefox or Chrome can do that can it?

> CAA creates a DNS mechanism that enables domain name owners to whitelist CAs that are allowed to issue certificates for their hostnames.

https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-c...

Re: MITM on HTTPS traffic in Kazakhstan

#367

Post by LoSboccacc »

mdhardeman wrote: post #173
pcwalton wrote: post #159

Earlier quoted context omitted.

I'm less pessimistic. The practical result of this is likely just going to be more business for the cottage industry of Great Firewall VPNs, which already compete with one another in traffic obfuscation against an adversary far more sophisticated than the government of Kazakhstan. Thankfully, this is currently a case in which the incentives of the market happen to align well with the goals of defeating censorship.

The way that a real authoritarian government entity would handle that is... An agency is tasked with doing random sample captures of randomly selected target internet connections. Inventory all the types of traffic being exchanged. Flag anything that isn't obvious plaintext or already being MiTM'ed for analysis follow up. Implement new blocking rules or interception implementation for each flow that isn't already bei…

> An agency is tasked with doing random sample captures

not really, we know exactly what the government response is and it's turning citizen one another, that applied with the gestapo back then and it's happening today with the "social credit system"

why do all the random sampling work if all you need is one "regime believer" among a hundred person or so to maintain full awareness of dissident activities.

Re: MITM on HTTPS traffic in Kazakhstan

#369

Post by arpa »

vbezhenar wrote: post #219
arpa wrote: post #170

Actually, a dns caa record could be of use in this scenario to at least alert the client that the traffic has been intercepted. Then again it is trivial to intercept and rewrite plain DNS requests and dns over https would also be subject to the same https mitm intercept... Maybe certificate pinning was a right idea.

CAA is for issuers, not for browsers. And yes, without DNSSEC it's easily spoofed.

That is true, however it could be used for CA verification also, could it not?

Edit: RFC 6844 very unambigously states that it can be used for additional verification:

CAA records MAY be used by Certificate Evaluators as a possible indicator of a security policy violation. Such use SHOULD take account of the possibility that published CAA records changed between the time a certificate was issued and the time at which the certificate was observed by the Certificate Evaluator.

Re: MITM on HTTPS traffic in Kazakhstan

#370

Post by arpa »

arpa wrote: post #164
yholio wrote: post #126

Can we, endpoints outside Kazakhstan, detect when a MITM client is connected and serve a boiler plate message "Untrusted connection"? If enough high level sites do this (Google, Cloudflare, Wikipedia etc) it might force the hand of the government since they are the ones effectively breaking the internet.

No, mitm is not easily detected on server side. It's a transparent proxy. You could start serving these messages to whole KZ ip range, though.

If someone could enlighten me where i'm wrong, it'd be much more constructive than simply downvoting.
Post reply on HN