Windows SSL Interception Gone Wild • Hacker News Board

Re: Windows SSL Interception Gone Wild

#61

Post by anon1385 » Sat, Feb 21, 2015, 5:46 AM UTC

mbrubeck wrote: post #35

timothya wrote: post #25

Earlier quoted context omitted.

Side note: click-to-play is a usability feature, not a security feature. It's still possible for Flash code to run before the user "clicks to play".

Click-to-play in Firefox at least is a security feature. It's enabled automatically for known-insecure plugins like old versions of Java and Flash. You can enable it manually by setting a plugin to "Ask to activate" in the Firefox add-on manager: https://blog.mozilla.org/security/2012/10/11/click-to-play-p... Click-to-play prevents Firefox from running any plugin code without explicit user action. I am 99% certain th…

>Click-to-play prevents Firefox from running any plugin code without explicit user action. I am 99% certain this is also the case for Chromium-based browsers.

Wrong: https://code.google.com/p/chromium/issues/detail?id=174963

Re: Windows SSL Interception Gone Wild

#62

Post by userbinator » Sat, Feb 21, 2015, 5:54 AM UTC

pilif wrote: post #49

GauntletWizard wrote: post #47

Earlier quoted context omitted.

(3) Google; Chrome has a rather sophisticated mechanism for detecting MITM attacks, in that it's distributed with pinned certs for several Google properties, and phones home with reports of errors it receives. This is how the DigiNotar leak[1] was discovered. Perhaps because it was persistent and on the TCP stack level the phonehomes never succeeded? The retry logic should be robust enough to try to deliver the fraud…

Chrome does not warn if the non-official root certificate is custom installed on the local machine. It needs to do this because of the various corporate web filters and anti virus tools that MITM connections too. Maybe this is a practice that needs to stop. Malware scanners can scan on the local machine after the browser has decrypted the communication and web filtering, I think, is nothing but a sign of mistrust aga…

web filtering, I think, is nothing but a sign of mistrust against the users.

What if it's the user who wants this filtering?

I run a local proxy that MITMs to filter out ads, tracking scripts, and other undesirable things. It works in all the browsers I use regularly, and any browsers that happen to be embedded in apps, because this way the stuff I want filtered out never even reaches the browser.

Re: Windows SSL Interception Gone Wild

#63

Post by userbinator » Sat, Feb 21, 2015, 6:02 AM UTC

dredmorbius wrote: post #44

mentat wrote: post #4

Earlier quoted context omitted.

I'm not sure why a normal user would ever need to add CAs to their root store. Can you clarify?

Adding (or removing) CAs is a fully legitimate activity. Your own site, work, or vendor / client sites could be added. Or you could want to remove a Comodo (or Honest Achmed's Used Cars and Certificates). http://www.livehacking.com/2011/04/25/honest-achmeds-used-ca... https://bugzilla.mozilla.org/show_bug.cgi?id=647959 Just because your OS / browser vendor "trusts" a cert doesn't mean you should.

Just because your OS / browser vendor "trusts" a cert doesn't mean you should.

In other words, users should always have the right to control who they (indirectly) trust. That's what the comment above is referring to - it will be even worse if Superfish is used as an excuse to take away this right.

Re: Windows SSL Interception Gone Wild

#64

Post by swhipple » Sat, Feb 21, 2015, 6:27 AM UTC

guelo wrote: post #53

aosmith wrote: post #40

Earlier quoted context omitted.

No, if you wipe the hd and reinstall it's not an issue. I run linux because I like it. Stuff like this doesn't happen with mainstream distros.

I know at least Mint does DNS and browser plugin ad injection.

Is this documented somewhere? I tried searching for a couple combinations of "linux mint dns ad injection", but couldn't find anything relevant.

Re: Windows SSL Interception Gone Wild

#65

Post by rnnr » Sat, Feb 21, 2015, 6:33 AM UTC

timothya wrote: post #58

timothya wrote: post #25

Earlier quoted context omitted.

Side note: click-to-play is a usability feature, not a security feature. It's still possible for Flash code to run before the user "clicks to play".

Since people are disagreeing with my comment, I'll add some extra information (apparently I missed the editing time window, but I stand by my original comment). I should note though that I was talking about Chrome (I don't know what the deal is with Firefox). If you go through the Chrome bug tracker, you can find several instances where Chrome engineers point out that Click-to-Play is not meant to be a security featu…

In recent chrome builds, they changed the behavior to right-click->Run Plugin which to my knowledge makes it immune to these attacks.

Re: Windows SSL Interception Gone Wild

#66

Post by bsdetector » Sat, Feb 21, 2015, 6:53 AM UTC

nugget wrote: post #2

Just to be clear, Facebook and Google hate any software that allows users to modify content within their walled gardens (whether that's an adblock, ad injector, or other). These companies want a totally controllable user experience in order to maximize their own user metrics and monetization. My fear is that these companies will use this Superfish debacle to attack and restrict the ability for users to download legit…

> My fear is that these companies will use this Superfish debacle to attack and restrict the ability for users to download legitimate software which leverages these technologies.

They already have, with HTTP/2. Encryption is mandated for HTTP/2 so something like Privoxy (or even just a caching proxy) has to use a Superfish-like method to bypass the encryption. The only alternative is to modify the browser, which they are also locking down with unchangeable ChromeOS and limiting plugins to only officially sanctioned ones.

...and you won't really even be able to just not use HTTP/2 because the web will be much slower as pipelining is not even implemented in Chrome, and Firefox will no doubt drop it soon. Websites optimized for HTTP/2 could take minutes to load without pipelining.

The real irony is that neither Google nor Mozilla determined what software caused pipelining problems, so guess what, it was Superfish and its like. Instead they made a new protocol that requires Superfish-like MITM interception, to work around problems caused by Superfish-like MITM malware.

Re: Windows SSL Interception Gone Wild

#67

Post by guelo » Sat, Feb 21, 2015, 6:55 AM UTC

swhipple wrote: post #64

guelo wrote: post #53

Earlier quoted context omitted.

I know at least Mint does DNS and browser plugin ad injection.

Is this documented somewhere? I tried searching for a couple combinations of "linux mint dns ad injection", but couldn't find anything relevant.

I was referring to their use of OpenDNS http://forums.linuxmint.com/viewtopic.php?f=90&t=128529

And hijacking Google search on Firefox, http://blog.linuxmint.com/?p=142

Re: Windows SSL Interception Gone Wild

#68

Post by dfox » Sat, Feb 21, 2015, 6:59 AM UTC

ademarre wrote: post #24

Is it just me, or is the Superfish fiasco being covered disproportionately against the other big security story this week, the NSA/GCHQ SIM heist? https://news.ycombinator.com/item?id=9076351

Superfish has more severe practical implications.

The SIM heist confirms that few entities have capabilities that almost everyone assumed they have.

Superfish enable anyone to attack significant percent of internet users.

Re: Windows SSL Interception Gone Wild

#69

Post by hobarrera » Sat, Feb 21, 2015, 7:36 AM UTC

mkjones wrote: post #15

reedloden wrote: post #6

Ah, so this is why Facebook tries to load Flash on almost every page... Allows them to gather data like this. Always wondered why Flash was "needed". (another reason to put Flash behind click-to-play and/or push for HTML5 video)

I suspect flash is generally used to play sounds from chat messages - the https man-in-the-middle detection is heavily sampled, as referenced in https://www.linshunghuang.com/papers/mitm.pdf . [I work at FB, but not on sounds or directly on https man-in-the-middle detection.]

Nope, without flash you still get the chat sound messages. I've no flash on my system and the only thing that's different on facebook is that I can't watch user-uploaded videos. Only their mobile site supports HTML5 last I checked.

Re: Windows SSL Interception Gone Wild

#70

Post by SixSigma » Sat, Feb 21, 2015, 8:08 AM UTC

robbintt wrote: post #52

I recently bought one of these and didn't even boot it into windows before ripping out the drive and tossing in a linux installation on my SSD. Never been more grateful to be technologically competent. Also, I am wiping that drive.

You're the Chuck Norris of HN