5 ms·

I think they'll go the simple route: They;ll install a root CA that signs all other CAs going through to mitm. People will get warnings and just install the roo

I think they'll go the simple route: They;ll install a root CA that signs all other CAs going through to mitm. People will get warnings and just install the root CA. The government will probably be helpful by giving you links to browser binaries that already have the root CA installed. Of course their systems will be hacked by the americans, russians, israelis and chinese, at which point all of these entities will be able to mitm the mitm - mitm-ception!

Canada 10y ago
I think that it will be just like the single gateway in general - there's some technically incompetent talk about it and absolutely no action.
- geomark 10y ago
  Word is that the single gateway is moving forward toward implementation. They just stopped talking about it. My guess is that they will attempt to do what is being talked about. If it breaks the internet in Thailand they don't care. The junta and their masters don't really understand and don't use it. It's just a toy to them and a place that is used to spread speech they don't like. The royalist elites that the junta are focused on protecting have their private bankers and underlings to take care of things so they don't care if internet banking is broken or if social media breaks. All that matters to the junta is protecting their core interest group of royalists.
PeterisP 10y ago
Cert pinning doesn't just give warnings, it simply refuses connect over MITM, period. Just a few days ago I was at some airport wifi hotspot that was MITM'ing things, my android phone simply refused to go to https://google.com https://google.com with a warning about this and no option to accept the cert signed by their fake CA.
- Klathmon 10y ago
  But locally installed certs can bypass that restriction in all major browsers.
- robryk 10y ago
  Well, so they will helpfully supply browser binaries that have cert pinning disabled? Though I don't see how they will manage that for mobile browsers.
- fulafel 10y ago
  Unfortunately browsers exempt locally installed CAs from MITM countermeasures, to support employer/school mandated domestic surveillance in the USA.
  - pcl 10y ago
    Do those bypasses apply for HSTS-preloaded certs as well? My understanding is that the intention of HSTS preloading is to address this sort of attack, but haven't dug through the browser code to see what's happening in standard distributions.
    - ikeboy 10y ago
      Yes. It's explicitly not part of their threat model: https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq...
    - gruez 10y ago
      The point of HSTS (and preloading) is to protect clients from sslstrip (and similar attacks). as in, client types in a http url, and the attacker prevents the http connection from being upgraded.
      - pcl 10y ago
        That's one of the goals of HSTS itself, but preloading designed to allow secure-only communications when establishing a connection to a hitherto-unused site, so that MITM attacks can't simply provide their own certs on first connect.
    - niij 10y ago
      If you have a Root Cert installed on your system, and they are MITMing traffic to a HSTS site with that Cert then your browser will give no warnings (for HSTS or non-HSTS sites).
ikeboy 10y ago
Is there a way to leverage such access into secure browsing? Some kind of "secure https" over "mitm https", where they only see the encrypted layer even with their mitm access?
- Natanael_L 10y ago
  You can easily do double tunneling, sure. Or even tunnel over DNS. Or over ping packets.
- matthewaveryusa 10y ago
  You can go over a VPN. I use the VPN my corporation provides as I deem them trustworthy. Before this I used an AWS EC2 instance and did a poor man's VPN using sshuttle[1] . I've also done it using sshuttle to a NAS I have sitting in my living room. [1] http://www.unixmen.com/sshuttle-poor-mans-vpn-ssh/ http://www.unixmen.com/sshuttle-poor-mans-vpn-ssh/
  - geomark 10y ago
    When you connect to a VPN doesn't it do key exchange in the same way as making a https connection to a website? They would just MITM that as well, right?

Canada 10y ago

I think that it will be just like the single gateway in general - there's some technically incompetent talk about it and absolutely no action.

geomark 10y ago
Word is that the single gateway is moving forward toward implementation. They just stopped talking about it. My guess is that they will attempt to do what is being talked about. If it breaks the internet in Thailand they don't care. The junta and their masters don't really understand and don't use it. It's just a toy to them and a place that is used to spread speech they don't like. The royalist elites that the junta are focused on protecting have their private bankers and underlings to take care of things so they don't care if internet banking is broken or if social media breaks. All that matters to the junta is protecting their core interest group of royalists.

PeterisP 10y ago

Cert pinning doesn't just give warnings, it simply refuses connect over MITM, period. Just a few days ago I was at some airport wifi hotspot that was MITM'ing things, my android phone simply refused to go to https://google.com https://google.com with a warning about this and no option to accept the cert signed by their fake CA.

Klathmon 10y ago
But locally installed certs can bypass that restriction in all major browsers.
robryk 10y ago
Well, so they will helpfully supply browser binaries that have cert pinning disabled? Though I don't see how they will manage that for mobile browsers.
fulafel 10y ago
Unfortunately browsers exempt locally installed CAs from MITM countermeasures, to support employer/school mandated domestic surveillance in the USA.
- pcl 10y ago
  Do those bypasses apply for HSTS-preloaded certs as well? My understanding is that the intention of HSTS preloading is to address this sort of attack, but haven't dug through the browser code to see what's happening in standard distributions.
  - ikeboy 10y ago
    Yes. It's explicitly not part of their threat model: https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq...
  - gruez 10y ago
    The point of HSTS (and preloading) is to protect clients from sslstrip (and similar attacks). as in, client types in a http url, and the attacker prevents the http connection from being upgraded.
    - pcl 10y ago
      That's one of the goals of HSTS itself, but preloading designed to allow secure-only communications when establishing a connection to a hitherto-unused site, so that MITM attacks can't simply provide their own certs on first connect.
  - niij 10y ago
    If you have a Root Cert installed on your system, and they are MITMing traffic to a HSTS site with that Cert then your browser will give no warnings (for HSTS or non-HSTS sites).

ikeboy 10y ago

Is there a way to leverage such access into secure browsing? Some kind of "secure https" over "mitm https", where they only see the encrypted layer even with their mitm access?

Natanael_L 10y ago
You can easily do double tunneling, sure. Or even tunnel over DNS. Or over ping packets.
matthewaveryusa 10y ago
You can go over a VPN. I use the VPN my corporation provides as I deem them trustworthy. Before this I used an AWS EC2 instance and did a poor man's VPN using sshuttle[1] . I've also done it using sshuttle to a NAS I have sitting in my living room. [1] http://www.unixmen.com/sshuttle-poor-mans-vpn-ssh/ http://www.unixmen.com/sshuttle-poor-mans-vpn-ssh/
- geomark 10y ago
  When you connect to a VPN doesn't it do key exchange in the same way as making a https connection to a website? They would just MITM that as well, right?