5 ms·

But I, as an user, want to be able to block domains, inject scripts and see what Chrome is sending to Google on my own devices (which is what Google doesn't wan

by zb3 9y ago

But I, as an user, want to be able to block domains, inject scripts and see what Chrome is sending to Google on my own devices (which is what Google doesn't want me to do). That's why I can't support these protocols...

JoshTriplett 9y ago
You, as a user, absolutely can. An ISP or network administrator who does not control the endpoints, on the other hand, cannot, by design. That's a feature.
- fiddlerwoaroof 9y ago
  What if I want to use my router to block telemetry domains? Or other malware sites? It’s looking like the only way forward is running my own CA to mitm all encrypted traffic.
  - JoshTriplett 9y ago
    > It’s looking like the only way forward is running my own CA to mitm all encrypted traffic. Correct. Middleboxes should be presumed hostile; if you control the endpoints you can install a MITM CA, but it's safer to put what you want directly on the endpoint.
  - aoeusnth1 9y ago
    That seems superior anyway - you could keep blocking domains even when you're on the go.
    - kuschku 9y ago
      Can I? On Android, apps now can decide if they want to accept user-installed CAs, or not. So if an app is hostile (say, all the Google apps), then I have no way to intercept their traffic anymore.
      - pas 9y ago
        You can decide to install the app or not. And you can put your CA into the system CA store if you have root. (You can make an Android image, so technically the requirement is unlocked - unlockable - bootloader.)
        kuschku 9y ago
        Unlocking the bootloader makes the device permanently fail the strictest SafetyNet category. Apps can and will refuse to run in that situation. Modifying /system will make every SafetyNet check fail, as result Netflix, Snapchat, Google Play Movies, and most banking apps will refuse to run. I can decide to install the app or not? How do I go about replacing Google's system apps with my own, without preventing above mentioned apps from running? I can't. And I can't buy reasonable devices withou Google Android, due to the non-compete clause in the OEM contracts.
        pas 9y ago
        Then don't buy it. Or support efforts like Librem (and LineageOS and Magisk). http://www.androidpolice.com/2017/07/16/safetynet-can-detect-magisk-fix-works/ http://www.androidpolice.com/2017/07/16/safetynet-can-detect... You can walk into your bank and access the services. Or call them. Or use their browser based service, right? Google and a lot of developers made the choice to restrict user freedom for more security. I don't agree with it, but it's what it is. A trade off. Of course, you can sign your own images and put the CA into the recovery DB and relock the bootloader on reasonable devices. ( https://mjg59.dreamwidth.org/31765.html https://mjg59.dreamwidth.org/31765.html ) Or at least you used to be able to.
      - zb3 9y ago
        You can patch the app using apktool/smali or even use JTM[0], but I prefer just blocking their traffic using iptables. [0] - https://github.com/Fuzion24/JustTrustMe https://github.com/Fuzion24/JustTrustMe
        kuschku 9y ago
    - vbezhenar 9y ago
      Easier approach is to use your own DNS server and blacklist those domains.
  - zb3 9y ago
    Which will fail if apps check public keys manually, and is also not very efficient. I think we'll need to patch applications directly, but the good news is that since many people will need this, those patches will probably be developed.
  - slrz 9y ago
    What? You control the endpoint. No need to MITM when you can just make your browser do what you want.
    - fiddlerwoaroof 9y ago
      Then I only solve the issue on my browser: what about my phone, and all the random other programs that phone home?
jacksmith21006 9y ago
Incorrect. You can on your end but Google stops the people in the middle which is what we want.
- zb3 9y ago
  How can I decrypt QUIC traffic then? Do Wireshark and mitmproxy support QUIC? Will DOH respect /etc/hosts files?
  - slrz 9y ago
    Patch your program to dump the keys or traffic?
    - zb3 9y ago
      I know that I could edit the source code and recompile the program. I know I could disassemble the binary, find out addresses of functions and then use things like uprobes to dump/modify registers/memory. I know that in theory I could write my own version of mitmproxy that supports QUIC. But I don't have time to do all that, and that's why I speak against those protocols (which changes nothing anyway)

by zb3 9y ago

JoshTriplett 9y ago

You, as a user, absolutely can. An ISP or network administrator who does not control the endpoints, on the other hand, cannot, by design. That's a feature.

fiddlerwoaroof 9y ago
What if I want to use my router to block telemetry domains? Or other malware sites? It’s looking like the only way forward is running my own CA to mitm all encrypted traffic.
- JoshTriplett 9y ago
  > It’s looking like the only way forward is running my own CA to mitm all encrypted traffic. Correct. Middleboxes should be presumed hostile; if you control the endpoints you can install a MITM CA, but it's safer to put what you want directly on the endpoint.
- aoeusnth1 9y ago
  That seems superior anyway - you could keep blocking domains even when you're on the go.
  - kuschku 9y ago
    Can I? On Android, apps now can decide if they want to accept user-installed CAs, or not. So if an app is hostile (say, all the Google apps), then I have no way to intercept their traffic anymore.
    - pas 9y ago
      You can decide to install the app or not. And you can put your CA into the system CA store if you have root. (You can make an Android image, so technically the requirement is unlocked - unlockable - bootloader.)
      - kuschku 9y ago
        Unlocking the bootloader makes the device permanently fail the strictest SafetyNet category. Apps can and will refuse to run in that situation. Modifying /system will make every SafetyNet check fail, as result Netflix, Snapchat, Google Play Movies, and most banking apps will refuse to run. I can decide to install the app or not? How do I go about replacing Google's system apps with my own, without preventing above mentioned apps from running? I can't. And I can't buy reasonable devices withou Google Android, due to the non-compete clause in the OEM contracts.
        pas 9y ago
        Then don't buy it. Or support efforts like Librem (and LineageOS and Magisk). http://www.androidpolice.com/2017/07/16/safetynet-can-detect-magisk-fix-works/ http://www.androidpolice.com/2017/07/16/safetynet-can-detect... You can walk into your bank and access the services. Or call them. Or use their browser based service, right? Google and a lot of developers made the choice to restrict user freedom for more security. I don't agree with it, but it's what it is. A trade off. Of course, you can sign your own images and put the CA into the recovery DB and relock the bootloader on reasonable devices. ( https://mjg59.dreamwidth.org/31765.html https://mjg59.dreamwidth.org/31765.html ) Or at least you used to be able to.
    - zb3 9y ago
      You can patch the app using apktool/smali or even use JTM[0], but I prefer just blocking their traffic using iptables. [0] - https://github.com/Fuzion24/JustTrustMe https://github.com/Fuzion24/JustTrustMe
      - kuschku 9y ago
  - vbezhenar 9y ago
    Easier approach is to use your own DNS server and blacklist those domains.
- zb3 9y ago
  Which will fail if apps check public keys manually, and is also not very efficient. I think we'll need to patch applications directly, but the good news is that since many people will need this, those patches will probably be developed.
- slrz 9y ago
  What? You control the endpoint. No need to MITM when you can just make your browser do what you want.
  - fiddlerwoaroof 9y ago
    Then I only solve the issue on my browser: what about my phone, and all the random other programs that phone home?

jacksmith21006 9y ago

Incorrect. You can on your end but Google stops the people in the middle which is what we want.

zb3 9y ago
How can I decrypt QUIC traffic then? Do Wireshark and mitmproxy support QUIC? Will DOH respect /etc/hosts files?
- slrz 9y ago
  Patch your program to dump the keys or traffic?
  - zb3 9y ago
    I know that I could edit the source code and recompile the program. I know I could disassemble the binary, find out addresses of functions and then use things like uprobes to dump/modify registers/memory. I know that in theory I could write my own version of mitmproxy that supports QUIC. But I don't have time to do all that, and that's why I speak against those protocols (which changes nothing anyway)