The best solution would be to blacklist rouge SSL certs.
MITM on HTTPS traffic in Kazakhstan
51–60 of 471 posts
Re: MITM on HTTPS traffic in Kazakhstan
#52Earlier quoted context omitted.
No, as the certificates are user installed. The Bugzilla and other threads are about distrusting that user certificate.
VPN with endpoint on affected ISP + Installing the cert (which is linked in the issue on Bugzilla) should be the same as just using the affect ISP directly, shouldn't it?
Yeah, it should, unless this is only for residential ISPs, which I strongly doubt. I can't appear to find a Kazakhstan-hosted VPN however, did you find one?
Re: MITM on HTTPS traffic in Kazakhstan
#53I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…
This is why I'm always advocating for political engagement for fighting these kind of issues. It's not exactly hard for a government to ban or forbid circumventing their monitoring. It does take time, but they're about to catch up.
It’s far harder if you have a major tech industry to push back and the whole massive security risk this exposes big corporations to. Which is something Kazakhstan must not have much of.
This is also terrible for foreign investment and attracting business. It also makes foreign intelligence’s job easier.
Re: MITM on HTTPS traffic in Kazakhstan
#54I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…
We need new measures to not allow these certificates to be installed unless they're verified, or at least the OS shows a massive giant warning "DO NOT DO THIS unless you accept this cert gives $identity access to all your data". Seems a very solvable problem.
I mean, the choice being presented is to install the MITM cert, or to not use the internet at all. The latter is an answer, certainly, but not what I would call a very good solution.
Re: MITM on HTTPS traffic in Kazakhstan
#55Question to local readers: Is Kazakhstan also blocking VPNs and SSH?
Not a local reader. I am from Russia.
ZaTelecom Telegram channel (https://t.me/zatelecom) claims that that not all ISPs have rolled out the MITM attack. For now, a good solution would be to switch to a different ISP (it's not like in the US, each home has access to 2-5 different ISPs).
Also, users ask everyone to use a VPN. So, I think that they have access to VPNs.
Re: MITM on HTTPS traffic in Kazakhstan
#56hmm, certificate pinning will not allow this gov-ca to work for a lot of high profile web sites. i wonder if these sites with cert pins are whitelisted by the kz gov? -- somehow i missed that HPKP is dead and will be removed from chromium and all the derivative browsers. now google is focusing on Expect-CT
Although pinned certificates have gone out of favor on the web, they are still very frequently used by iOS and Android apps. Last time I checked, the Facebook Messenger app refused to work when being MitM'ed.
Re: MITM on HTTPS traffic in Kazakhstan
#57[deleted]
Re: MITM on HTTPS traffic in Kazakhstan
#58I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…
But we are in a better place than before. Without HTTPS everywhere and governments needing to ask people to install new root certs, we would not have learned about this Kazakhstan MITM issue.
Yep - without HTTPS everywhere, governments would have been silently able to snoop on Internet traffic without anyone knowing.
Re: MITM on HTTPS traffic in Kazakhstan
#59Earlier quoted context omitted.
We need new measures to not allow these certificates to be installed unless they're verified, or at least the OS shows a massive giant warning "DO NOT DO THIS unless you accept this cert gives $identity access to all your data". Seems a very solvable problem.
Corporations also do this so they can scan traffic for data exfil.
Is that a new word I should know?
Re: MITM on HTTPS traffic in Kazakhstan
#60Earlier quoted context omitted.
That would help people who already know what a root cert is, but it's well known that most people ignore any indicator in a URL bar. Even "smart people" ignore them. Do you actually check the lock status of every site you visit?
Most browsers have made the lack of a "lock" quite evident to end users.
If they look and care. The comment you replied to asserts that most people don't. I certainly don't.
If HN didn't have the lock in the url bar (no https), it would have zero impact on my behavior. I had to look just now to even know if there was one.