9 ms·

Kazakh here. Fuck, what do we do? Any suggestions other than trying to raise awareness? To give some context, the reason why they are getting away with such br

by kazakh 11y ago

Kazakh here. Fuck, what do we do? Any suggestions other than trying to raise awareness? To give some context, the reason why they are getting away with such brute methods is that the most people wouldn't understand the full implication. I would be surprised if this would prove difficult to enforce - the first thing an ordinary person would do when, say, Facebook wouldn't load is to call up the Kazakhtelecom's support and the support guy would tell them to "press that button that says 'I trust this certificate'" and they would comply. There also hasn't been an uproar re government snooping into private citizens' communication, the kind that US had with Snowden etc., so a lot of people are likely to accept the "for your own security" talk at face value without much skepticism. It's also unlikely that even heightened awareness will inspire much backlash, as there is no real track record of grassroots organizing, even when the government tightens the screws. To its credit, the government has been quite skillful at balancing at just below the limit of pissing people off enough to make them go to the streets for the last twenty years (soaring oil prices in the last decade helped as well).

DenisM 11y ago
I'm afraid there are only two options here: - A life-long educational program for the people, starting with study of basic logic, rhetoric, and obscurantism. Consider collaborating with people trying to do the same in e.g. Russia. - Joining the burgeoning autocratic bureaucracy and playing by its rules to bring change from within. If you don't feel like you have the energy or skills, consider supporting a like-minded, but more capable person in their career. It's never a crime to support a growing bureaucrat. The biggest challenge you're going to face is defining a common idea to unite the people with whom you want to collaborate. "Like-minded" should mean something specific, or else. This idea should paint a picture compelling enough to motivate people to act, even if only a smallish number, and big enough to eclipse the lesser differences among the collaborators. The only easy option is emigration.
nfd 11y ago
Raise awareness, spread the word about Tor. If they start running attacks against Tor, start an uproar. And pitch Tor as an elementary security measure; say "do this to make your communications more secure." It isn't perfect, but maybe it's better than nothing?
- jtome 11y ago
  I suspect Kazakhstan doenst have the resources to mount attacks against tor unless they can pay some western company to do it for them. Blocking it is a somewhat different matter.
  - mnx 11y ago
    De-anonymisation attacks may be non-trivial, but does TOR have any real resiliency to DDoSes?
- vbezhenar 11y ago
  Kazakhstan already blocks Tor website and its bootstrap nodes. Also I heard that it has DPI hardware and made an attempts to block Tor traffic (but last time Tor worked for me with my private bridge). No uproars here :) Most citizens are not educated to understand what Tor is and will trust government, who'll tell them that Tor is for criminals and must be forbidden.
a12y 11y ago
>Kazakh here. Fuck, what do we do? Any suggestions other than trying to raise awareness? Revolution or leaving the country are your only choices. There is no democracy so there is probably no way to resolve this grievance, and I doubt it would be anywhere near the top of list for most citizens. You can speak english and probably have computer skills, so I hope it would be possible for you to get out.
- sukulaku 11y ago
  > There is no democracy so there is probably no way to resolve this grievance Just for the record, look to the US for a good example of how well democracy works for "resolving grievances". Occupy Wall Street protesters aired some grievances, and were beaten and tased into submission. The same happens anywhere, every time the citizenry actually demands something. It's kind of amazing how people still hold democracy as some sort of 'value' to strive for, when in reality it's just a PR-facade.
  - marvy 11y ago
    Beaten into submission? Maybe they tried that, but eventually what worked was that they were legislated into submission. They found some technicality for why they couldn't legally occupy that space, and everything went downhill fast after that. (I could be wrong. I wasn't paying much attention at the time.)
    - sukulaku 11y ago
      We can rest assured there were plenty of beatings and tasings involved - that's a big part of why some "people" become police officers in the first place. But the point is that the same thing happens everywhere. Not that long ago, Hong Kong's people protested against China appointing their rulers. They were beaten and maced etc. Brazilians protested against a massive waste of their money on The World Cup (or some such), and got swiftly brutalized by the police. Venezuelans protested economic destruction etc, and got brutalized. You see, as long as people just endure whatever bullshit their rulers are inflicting on them, the rulers don't have to give a fuck about them. But when people actually resist, they are violently repressed. Otherwise the masses might start entertaining the notion that maybe they don't have to just take all the bullshit bureaucracy, massive looting/exploitation, surveillance and abuse they're subjected to after all, and their rulers definitely don't want that to happen. The whole point of being a ruler is exploiting your subjects. Surveillance and brutality are mostly just a part of what it takes to maintain your rule over them.
patcheudor 11y ago
What do you do? You immediately reach out to Apple, Google, Facebook, Twitter, Box, Dropbox, Tumblr, and any other popular platform which has mobile apps. You ask, or down-right demand they implement certificate pinning in their apps so they will fail when middled with the government provided certificate. This will in turn break access to those platforms via mobile apps which will result in very real and direct impact to citizens who will then hopefully wake up and pressure the government to roll-back the program or at least put exceptions in place. You continue this strategy with banks, etc., until it becomes clear to the government that this plan will not work. Note that cert pinning for mobile and desktop apps should have happened long ago & this might be the perfect opportunity to drive it to happen.
- RKearney 11y ago
  Certificate pinning does not work with certificates that are installed in the devices trusted certificate store.
  - infinity0 11y ago
    You are confused. This is exactly what pinning defends against.
    - cbr 11y ago
      Sorry, no: Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. -- https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq...
      - deleted 11y ago
        [deleted]
      - mil0 11y ago
peteretep 11y ago
> most people wouldn't understand the full implication So attack that. Tell a story. What does this allow the government to do? Could a jealous ex-lover who works for the government read their ex's messages? Could the local mayor find out if you've got a medical problem? Get an illustrator to draw these up as little comics. Make images that people can understand. This is a great example: http://www.wordstream.com/images/what-is-net-neutrality-isp-package-diagram.jpg http://www.wordstream.com/images/what-is-net-neutrality-isp-...
- kazakh 11y ago
  Thanks. That's a solid idea.
  - quink 11y ago
    I created the above image. Just to give you an idea of how important it is to make sure that the message is easy to absorb, a few years ago this made it into the WCIT leaks: http://files.wcitleaks.org/public/WCIT12%20-%20ITRs%20and%20QoS.pdf http://files.wcitleaks.org/public/WCIT12%20-%20ITRs%20and%20... Check out the fifth to last page, which is basically identical to what I created, if presented a bit worse. Did anyone give a shit? Nope. Is that a genuine logo of the fucking ITU, the international body probably most obliged to prevent this kind of shit globally, and was this put together by a "senior staff member of the ITU" rather than /u/quink on reddit? Yup. Did anything of that presentation make it to the media or public discussion? Nope. Meanwhile, my PNG has been posted here on HN 6 years after I first created it. Let me know if you need my help, but I'm not at all sure how to best broadcast that message. Keeping away the MITM (who is here employed by an "elected" government with executive powers and "judicial oversight" acting "in the interest of public security" rather than a bogeyman or a corporation) is harder than protecting the ability to consume. Maybe the answer lies in making people afraid for their money. Anyone with access to the private key for the certificate, which includes anyone with access to the multitude of servers that relay traffic for the entire country, could technically drain everyone's bank accounts and give away your shares at their discretion, if you've ever used online banking or trading in Kazakhstan. A single bad memory or whatever bug in some software somewhere and the number that's the private key is in the open. In all honesty, make investors and bankers afraid and any government will shut up. As for ordinary lives of people, PRISM has shown us that they don't really care about this security stuff.
necessity 11y ago
Raise awareness but also provide a solution, i.e. "gov. is spying on you here is how to avoid it: guide on how to use a VPN or something".
deleted 11y ago
[deleted]

by kazakh 11y ago

DenisM 11y ago

I'm afraid there are only two options here: - A life-long educational program for the people, starting with study of basic logic, rhetoric, and obscurantism. Consider collaborating with people trying to do the same in e.g. Russia. - Joining the burgeoning autocratic bureaucracy and playing by its rules to bring change from within. If you don't feel like you have the energy or skills, consider supporting a like-minded, but more capable person in their career. It's never a crime to support a growing bureaucrat. The biggest challenge you're going to face is defining a common idea to unite the people with whom you want to collaborate. "Like-minded" should mean something specific, or else. This idea should paint a picture compelling enough to motivate people to act, even if only a smallish number, and big enough to eclipse the lesser differences among the collaborators. The only easy option is emigration.

nfd 11y ago

Raise awareness, spread the word about Tor. If they start running attacks against Tor, start an uproar. And pitch Tor as an elementary security measure; say "do this to make your communications more secure." It isn't perfect, but maybe it's better than nothing?

jtome 11y ago
I suspect Kazakhstan doenst have the resources to mount attacks against tor unless they can pay some western company to do it for them. Blocking it is a somewhat different matter.
- mnx 11y ago
  De-anonymisation attacks may be non-trivial, but does TOR have any real resiliency to DDoSes?
vbezhenar 11y ago
Kazakhstan already blocks Tor website and its bootstrap nodes. Also I heard that it has DPI hardware and made an attempts to block Tor traffic (but last time Tor worked for me with my private bridge). No uproars here :) Most citizens are not educated to understand what Tor is and will trust government, who'll tell them that Tor is for criminals and must be forbidden.

a12y 11y ago

>Kazakh here. Fuck, what do we do? Any suggestions other than trying to raise awareness? Revolution or leaving the country are your only choices. There is no democracy so there is probably no way to resolve this grievance, and I doubt it would be anywhere near the top of list for most citizens. You can speak english and probably have computer skills, so I hope it would be possible for you to get out.

sukulaku 11y ago
> There is no democracy so there is probably no way to resolve this grievance Just for the record, look to the US for a good example of how well democracy works for "resolving grievances". Occupy Wall Street protesters aired some grievances, and were beaten and tased into submission. The same happens anywhere, every time the citizenry actually demands something. It's kind of amazing how people still hold democracy as some sort of 'value' to strive for, when in reality it's just a PR-facade.
- marvy 11y ago
  Beaten into submission? Maybe they tried that, but eventually what worked was that they were legislated into submission. They found some technicality for why they couldn't legally occupy that space, and everything went downhill fast after that. (I could be wrong. I wasn't paying much attention at the time.)
  - sukulaku 11y ago
    We can rest assured there were plenty of beatings and tasings involved - that's a big part of why some "people" become police officers in the first place. But the point is that the same thing happens everywhere. Not that long ago, Hong Kong's people protested against China appointing their rulers. They were beaten and maced etc. Brazilians protested against a massive waste of their money on The World Cup (or some such), and got swiftly brutalized by the police. Venezuelans protested economic destruction etc, and got brutalized. You see, as long as people just endure whatever bullshit their rulers are inflicting on them, the rulers don't have to give a fuck about them. But when people actually resist, they are violently repressed. Otherwise the masses might start entertaining the notion that maybe they don't have to just take all the bullshit bureaucracy, massive looting/exploitation, surveillance and abuse they're subjected to after all, and their rulers definitely don't want that to happen. The whole point of being a ruler is exploiting your subjects. Surveillance and brutality are mostly just a part of what it takes to maintain your rule over them.

patcheudor 11y ago

What do you do? You immediately reach out to Apple, Google, Facebook, Twitter, Box, Dropbox, Tumblr, and any other popular platform which has mobile apps. You ask, or down-right demand they implement certificate pinning in their apps so they will fail when middled with the government provided certificate. This will in turn break access to those platforms via mobile apps which will result in very real and direct impact to citizens who will then hopefully wake up and pressure the government to roll-back the program or at least put exceptions in place. You continue this strategy with banks, etc., until it becomes clear to the government that this plan will not work. Note that cert pinning for mobile and desktop apps should have happened long ago & this might be the perfect opportunity to drive it to happen.

RKearney 11y ago
Certificate pinning does not work with certificates that are installed in the devices trusted certificate store.
- infinity0 11y ago
  You are confused. This is exactly what pinning defends against.
  - cbr 11y ago
    Sorry, no: Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. -- https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq...
    - deleted 11y ago
      [deleted]
    - mil0 11y ago

peteretep 11y ago

> most people wouldn't understand the full implication So attack that. Tell a story. What does this allow the government to do? Could a jealous ex-lover who works for the government read their ex's messages? Could the local mayor find out if you've got a medical problem? Get an illustrator to draw these up as little comics. Make images that people can understand. This is a great example: http://www.wordstream.com/images/what-is-net-neutrality-isp-package-diagram.jpg http://www.wordstream.com/images/what-is-net-neutrality-isp-...

kazakh 11y ago
Thanks. That's a solid idea.
- quink 11y ago
  I created the above image. Just to give you an idea of how important it is to make sure that the message is easy to absorb, a few years ago this made it into the WCIT leaks: http://files.wcitleaks.org/public/WCIT12%20-%20ITRs%20and%20QoS.pdf http://files.wcitleaks.org/public/WCIT12%20-%20ITRs%20and%20... Check out the fifth to last page, which is basically identical to what I created, if presented a bit worse. Did anyone give a shit? Nope. Is that a genuine logo of the fucking ITU, the international body probably most obliged to prevent this kind of shit globally, and was this put together by a "senior staff member of the ITU" rather than /u/quink on reddit? Yup. Did anything of that presentation make it to the media or public discussion? Nope. Meanwhile, my PNG has been posted here on HN 6 years after I first created it. Let me know if you need my help, but I'm not at all sure how to best broadcast that message. Keeping away the MITM (who is here employed by an "elected" government with executive powers and "judicial oversight" acting "in the interest of public security" rather than a bogeyman or a corporation) is harder than protecting the ability to consume. Maybe the answer lies in making people afraid for their money. Anyone with access to the private key for the certificate, which includes anyone with access to the multitude of servers that relay traffic for the entire country, could technically drain everyone's bank accounts and give away your shares at their discretion, if you've ever used online banking or trading in Kazakhstan. A single bad memory or whatever bug in some software somewhere and the number that's the private key is in the open. In all honesty, make investors and bankers afraid and any government will shut up. As for ordinary lives of people, PRISM has shown us that they don't really care about this security stuff.

necessity 11y ago

Raise awareness but also provide a solution, i.e. "gov. is spying on you here is how to avoid it: guide on how to use a VPN or something".

deleted 11y ago

[deleted]