Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kazakhstan to MitM all HTTPS traffic starting Jan 1

telecom.kz

Post reply on HN
Print view View original

71–80 of 378 posts

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#71

Post by dspillett »

majke wrote: post #4
egeozcan wrote: post #2

> The national security certificate will secure protection of Kazakhstan users when using coded access protocols to foreign Internet resources. How is this protecting users? They are outright lying here, if I understand correctly. Also why are they asking for my location? http://i.imgur.com/fYKHRK1.png

Remember they have your location anyway from your IP address.

The location associated with the IP address they see may not be your physical location by quite some margin.

If you are connecting via a mobile phone the address is likely to be registered as at one of the phone company's locations which could potentially be in a different state. For many home/office serving ISPs this is similar. Also, if you are using a VPN of some sort the address you present to the web server is quite disconnected from your physical location.

If on the other hand they request your location via your web access client and you agree, it will be using localisation APIs that may well know your location with some precision: using GPS if your device has it and has it turned on, or via wireless AP availability based lookups otherwise.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#72

Post by davidu »

Google, Facebook, Yahoo, Microsoft, Salesforce, Box, Dropbox, Twitter, etc. could have a very strong influence on changing this if they banded together to respond to this in some way.

The government might be doing what they think is right, but public backlash can change policy almost overnight. We saw this in the US recently with SOPA/PIPA. The "Internet" response was unprecedented.

The people of Kazakhstan can achieve the same outcome.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#74

Post by dragonwriter »

egeozcan wrote: post #2

> The national security certificate will secure protection of Kazakhstan users when using coded access protocols to foreign Internet resources. How is this protecting users? They are outright lying here, if I understand correctly. Also why are they asking for my location? http://i.imgur.com/fYKHRK1.png

> How is this protecting users?

Its protecting users from getting visits from Kazakhstan's security services for covertly communicated with foreign entities. That is, presuming that the content of their traffic isn't unwelcome by the security services, since otherwise, even with the use of the MitM certificate, they'll still get visits.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#77

Post by toast0 »

cookiecaper wrote: post #54
cwyers wrote: post #19

Earlier quoted context omitted.

They're unlikely using plain HTTPS for sensitive traffic, as that still divulges what sites you're visiting.

Technically it only divulges which IP addresses you're accessing. The URL, including domain name, in the request is encrypted.

Server Name Identification divulges the hostname (in the clear) during the key exchange.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#78

Post by brohee »

exelius wrote: post #57

While there are probably 100 different ways to avoid this and retain secure traffic, I would venture to guess that the average Internet savvy-ness of Kazakhstan is pretty low, so using any of them would single you out for additional government attention (whether you're actually doing anything illegal or not). That said, there's a remarkable tendency in countries as corrupt as Kazakhstan for a "shadow" telecom network…

Kazakhstan is possibly more democratic than all its neighbours save maybe Kirghizstan (I'm not up do date on the current government position). More democratic as in I can't make up who's more of a despot between Putin and Nazarbayev, after all they both win open elections, albeit with an iron grip on medias... But then Kirghizstan is likely depending on its neighbours for connectivity (also landlocked).

The other neighbours are shining beacons of democracy such as Russia, China and Uzbekistan...

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#80

Post by 1ris »

davidu wrote: post #72

Google, Facebook, Yahoo, Microsoft, Salesforce, Box, Dropbox, Twitter, etc. could have a very strong influence on changing this if they banded together to respond to this in some way. The government might be doing what they think is right, but public backlash can change policy almost overnight. We saw this in the US recently with SOPA/PIPA. The "Internet" response was unprecedented. The people of Kazakhstan can achie…

What should these companies responses be? And why should the kazach goverment care? They'd prefer if the poeple used russian (or kazach) copy cats like vkontakte anyway.
Post reply on HN