3 ms·

Since you are posting from Iran, can you verify this certificate is indeed being presented? Also, how are people sure this is being perpetuated by the Iranian

by dhbanes 15y ago

Since you are posting from Iran, can you verify this certificate is indeed being presented? Also, how are people sure this is being perpetuated by the Iranian government? I'm asking because I see no evidence in the pastebin dumps, yet many people here seem sure the Iranian government is behind this. There was another indecent earlier this year for which Iran was assumed responsible. This turned out to be false (http://www.computerworld.com/s/article/9215245/Solo_Iranian_hacker_takes_credit_for_Comodo_certificate_attack http://www.computerworld.com/s/article/9215245/Solo_Iranian_...)

emilsedgh 15y ago
Yes. I can confirm that without using a proxy, DigiNotar's CA is being used. Who might/could do this except for the goverment?
- dhbanes 15y ago
  Thanks for checking. Could you run the following? Thanks in advance. tracert mail.google.com
  - sepent 15y ago
    I did traceroute google.com/mail.google.com. nothing unusual happened: [1-7 are ISP routers] 8. 78.38.255.89 9. 78.38.245.17 10. 213.248.76.5 11. 80.91.248.94 12. 80.91.253.118 13. 213.155.130.243 14. 213.248.83.94 15. 72.14.238.232 16. 209.85.251.88 17. 209.85.255.234 18. 209.85.255.231 19. 64.233.175.98 I used mtr and the route to google is changing every several seconds, but I thinks it's normal. All I know is that internet blocking happens in LCT [78.38.255.] or KAMYARAN [78.38.245.].
sepent 15y ago
I can confirm it, too. My brother works in a company that produces spying software for government. Days ago, he told me he himself has written several programs to spy on yahoo, hotmail and gmail but he thought they couldn't deploy the gmail program because of https. I guess, he should think again. I am scared. My only hope was SSL and I can't trust that anymore?
- lawnchair_larry 15y ago
  You should tell your brother not to do that, very sternly. Your brother is killing people. This is not a joke.

by dhbanes 15y ago

emilsedgh 15y ago

Yes. I can confirm that without using a proxy, DigiNotar's CA is being used. Who might/could do this except for the goverment?

dhbanes 15y ago
Thanks for checking. Could you run the following? Thanks in advance. tracert mail.google.com
- sepent 15y ago
  I did traceroute google.com/mail.google.com. nothing unusual happened: [1-7 are ISP routers] 8. 78.38.255.89 9. 78.38.245.17 10. 213.248.76.5 11. 80.91.248.94 12. 80.91.253.118 13. 213.155.130.243 14. 213.248.83.94 15. 72.14.238.232 16. 209.85.251.88 17. 209.85.255.234 18. 209.85.255.231 19. 64.233.175.98 I used mtr and the route to google is changing every several seconds, but I thinks it's normal. All I know is that internet blocking happens in LCT [78.38.255.] or KAMYARAN [78.38.245.].

sepent 15y ago

I can confirm it, too. My brother works in a company that produces spying software for government. Days ago, he told me he himself has written several programs to spy on yahoo, hotmail and gmail but he thought they couldn't deploy the gmail program because of https. I guess, he should think again. I am scared. My only hope was SSL and I can't trust that anymore?

lawnchair_larry 15y ago
You should tell your brother not to do that, very sternly. Your brother is killing people. This is not a joke.