9 ms·
I really appreciate how they're doing this. The Chinese built up an amazing infrastructure for the Great Firewall; the Kazakhs just say "install our cert!" The
by kaizendad 11y ago
I really appreciate how they're doing this. The Chinese built up an amazing infrastructure for the Great Firewall; the Kazakhs just say "install our cert!" The Chinese spend billions and have to stay ahead of all of their citizens' clever new ideas at all times; the Kazakhs spend a few hundred and just need to point guns at their citizens until they install a cert.
Sure, it's going to be difficult to enforce, but it should also be quite cheap.
- egeozcan 11y ago> it's going to be difficult to enforce I guess it's just a matter of dropping every connection that you can't MITM, no?
- Elhana 11y agoYou don't have to. Proxy handles the request and just gives response back to you signed with national cert. If you don't install it, your browser will just start complaining about every site. At least that is how Bluecoat ProxySG[1] works at my employee. [1] https://bto.bluecoat.com/webguides/proxysg/security_first_steps/Content/Solutions/SSL/ssl_solution.htm https://bto.bluecoat.com/webguides/proxysg/security_first_st...
- voltagex_ 11y agoFunny story, most of the machines / servers at my workplace weren't vulnerable to Heartbleed - but ProxySG was. AFAIK they built their own OS from scratch, too.
- cortesoft 11y agoFor SSL traffic, yes, but that wouldn't stop someone from using a different encryption protocol.
- mil0 11y agocountry wide, this is a loud call for a cloud, distributed proxy provider with a better track record than the telco, to offer tor-like tunnels to at least exit the MITM zone.
- barkingcat 11y agoeasy to enforce inside the country. Just set it so that there's no https if you don't have the cert! It is becoming a legal requirement for all telcos in the country so even if you're roaming (with a data plan from a foreign provider, for example) - you're still using the local telcos. Only way to avoid is to use some kind of foreign satellite internet or maybe private / non government / non telco dark fibre.
- rogeryu 11y agoI guess VPN is the only way to avoid it. Or sshuttle or something over port 80. But then again, how long will it take before they can detect that and then block it?! Or you can use non-standard ports, and change them continuously.
- ta0o0o0 11y agoThey can just block everything by default and only enable what they can decrypt. Maybe you could try tunelling encrypted data over HTTP, but heuristics could probably pick that up too.
- ansible 11y agoIf I had the free time, I'd create a cryptographic protocol running on top of telnet that looked like someone playing a MUD. For email, you'd encrypt data to have it look like regular prose. So you'd only get a few bits per English word, but that would be sufficient for short messages. Could also make use of extra spaces in between words. The real trick with that would be to take an existing document, and alter it to encode a message. So you'd be doing things like using synonym choice to get your bits.
- metalliqaz 11y agoThere aren't enough MUD players to make it inconspicuous.
- 11y ago
- dujiulun2006 11y agoChinese govt is also capable of doing this. Best part? We even have our trusted* root certificate! Could this get any "better"? Sure! We can even MITM all the OUTGOING https traffic if we want! #GitHubDDoS * Recently un-trusted by Apple and Mozilla. https://support.apple.com/en-us/HT204938 https://support.apple.com/en-us/HT204938
- orf 11y agoTo be fair they really fucked up a couple of stages of that GitHub DDOS and made it trivial to stop.
- jacquesm 11y agoAnd they managed to shine the spotlight on a project in need of some tlc.
- duncan_bayne 11y agoI really don't understand how that sort of behaviour doesn't constitute an act of war. Imagine if China sent saboteurs in-country to physically destroy infrastructure being used by American businesses. That would Not Be Taken Lightly.
- cortesoft 11y agoWhich sort of behavior? Having their own root certificate?
- duncan_bayne 11y agoI meant China's behaviour, e.g. orchestrating a DDOS attack against GitHub for political reasons. The root certificate thing is 'merely' a violation of the rights of their own subjects.
- cortesoft 11y agoAh, ok that makes more sense.
- nathan_f77 11y agoIt's not even difficult to enforce. If you don't install their cert, you don't have access to the internet. Or you just have to force Chrome to ignore all SSL errors, which is the same thing.