5 ms·

I think China's government requires websites to give them their private keys. HTTPS is useless then.

throw0101a 7y ago
Not with (perfect) forward security: > In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if the private key of the server is compromised.[1] Forward secrecy protects past sessions against future compromises of secret keys.[2][3][3] * https://en.wikipedia.org/wiki/Forward_secrecy https://en.wikipedia.org/wiki/Forward_secrecy There's still the risk of MITM identity spoofing of course.
- oconnor663 7y ago
  Forward secrecy only helps you if the server private key is comprised in the future. If it's compromised already, and an active attacker can modify traffic between you and the server, forward secrecy doesn't help. Ultimately, if an attacker has all your keys and controls all your traffic, there's nothing left that distinguishes the attacker from you. No security is possible in that scenario.
turk73 7y ago
I suspect my company is MITM-ing SSL, so China is here Jack.
gruez 7y ago
And what do you think happens to sites caught serving malware? They get put on safebrowsing blacklists. That problem solves itself.
- giggles_giggles 7y ago
  If the Chinese government wants to man in the middle traffic to foreign sites they can just force PC vendors to install a CCP controlled CA root on systems and make it illegal and/or very difficult to remove it. Shit, they can require vendors include a hardware backdoor, especially since so much of that hardware is produced domestically. Then they can view the traffic even going to and from foreign sites who would not comply with an order to share private keys and no safe browsing blacklist (like that would be accessible from inside the regime anyway) will help you.
  - eric-hu 7y ago
    The Chinese government can do this for systems sold within China. They don't have the authority to do it for computers globally. If I'm understanding other comments correctly, browser vendors installing HTTPSEverywhere cuts down the potential for this Great Cannon attack from 7.7 billion users to 1.4 billion. An 80% reduction seems significant.
    - giggles_giggles 7y ago
      I was under the impression that the other commenters were referring to HTTPS as a solution for those in China to protect themselves from their own government. Perhaps I was wrong.
      - mlyle 7y ago
        No. It's to protect users outside China visiting Chinese sites from being coopted to participate in DDoS.
  - gruez 7y ago
    >If the Chinese government wants to man in the middle traffic to foreign sites they can just force PC vendors to install a CCP controlled CA root on systems and make it illegal and/or very difficult to remove it. Addressed here: https://news.ycombinator.com/item?id=21721843 https://news.ycombinator.com/item?id=21721843 >Shit, they can require vendors include a hardware backdoor, especially since so much of that hardware is produced domestically. If they're only doing it for local computers, the consequences/response is the same as the previous paragraph. If they're doing it for foreign computers on a mass scale required for a DDoS attack, if discovered will torpedo their entire electronics sector. All the "ban huawei" politicians will have a field day with that.

Not with (perfect) forward security: > In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if the private key of the server is compromised.[1] Forward secrecy protects past sessions against future compromises of secret keys.[2][3][3] * https://en.wikipedia.org/wiki/Forward_secrecy https://en.wikipedia.org/wiki/Forward_secrecy There's still the risk of MITM identity spoofing of course.

oconnor663 7y ago
Forward secrecy only helps you if the server private key is comprised in the future. If it's compromised already, and an active attacker can modify traffic between you and the server, forward secrecy doesn't help. Ultimately, if an attacker has all your keys and controls all your traffic, there's nothing left that distinguishes the attacker from you. No security is possible in that scenario.

turk73 7y ago

I suspect my company is MITM-ing SSL, so China is here Jack.

gruez 7y ago

And what do you think happens to sites caught serving malware? They get put on safebrowsing blacklists. That problem solves itself.

giggles_giggles 7y ago
If the Chinese government wants to man in the middle traffic to foreign sites they can just force PC vendors to install a CCP controlled CA root on systems and make it illegal and/or very difficult to remove it. Shit, they can require vendors include a hardware backdoor, especially since so much of that hardware is produced domestically. Then they can view the traffic even going to and from foreign sites who would not comply with an order to share private keys and no safe browsing blacklist (like that would be accessible from inside the regime anyway) will help you.
- eric-hu 7y ago
  The Chinese government can do this for systems sold within China. They don't have the authority to do it for computers globally. If I'm understanding other comments correctly, browser vendors installing HTTPSEverywhere cuts down the potential for this Great Cannon attack from 7.7 billion users to 1.4 billion. An 80% reduction seems significant.
  - giggles_giggles 7y ago
    I was under the impression that the other commenters were referring to HTTPS as a solution for those in China to protect themselves from their own government. Perhaps I was wrong.
    - mlyle 7y ago
      No. It's to protect users outside China visiting Chinese sites from being coopted to participate in DDoS.
- gruez 7y ago
  >If the Chinese government wants to man in the middle traffic to foreign sites they can just force PC vendors to install a CCP controlled CA root on systems and make it illegal and/or very difficult to remove it. Addressed here: https://news.ycombinator.com/item?id=21721843 https://news.ycombinator.com/item?id=21721843 >Shit, they can require vendors include a hardware backdoor, especially since so much of that hardware is produced domestically. If they're only doing it for local computers, the consequences/response is the same as the previous paragraph. If they're doing it for foreign computers on a mass scale required for a DDoS attack, if discovered will torpedo their entire electronics sector. All the "ban huawei" politicians will have a field day with that.