7 ms·

If your site does not use HTTPS, Rostelecom will insert pro-war propaganda in it

36 points by anonymfus 4y ago

PaulHoule 4y ago
Good way to make people switch.
- norhi999 4y ago
  Given its previous history of breaking and slowing connectivity in favor of harder blocking of government-critical sites, I'd say they should've done it way before this. The routes through their nets remind me a black hole.
jordemort 4y ago
This sort of thing is why I look askance at the "you don't need certificates" crowd. In the US, at least both Comcast and AT&T have a long and well-documented history of injecting advertisements into websites when the lack of a certificate lets them get away with it. Maybe you don't care about eavesdroppers, but you should care about a malicious network tampering with your content in-flight.
spaceheater 4y ago
Author himself links to articles how said ISP was injecting news ads, since 2020. Current news is about Ukraine, thus must be propaganda.
- pessimizer 4y ago
  Therefore pro-war propaganda cannot be referred to as pro-war propaganda? This is bizarre logic. If the ads started showing nootropic propaganda, would you not be allowed to call it nootropic propaganda?
memen 4y ago
In cryptography there is the clear difference between encrypting and signing (Confidentiality and Integrity). Is this distinction possible on a webserver/browser? I.e. No encryption, no signing -> HTTP Encryption and signing -> HTTPS No encryption, signing -> ? What about public information (not confidential) that needs verification (yes integrity)?
- paulhodge 4y ago
  Don’t think it exists for the HTML document. HTTPS works fine for public & unconfidential things. For verifying page resources there is a newish feature: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... .
- norhi999 4y ago
  Something like this maybe: https://tools.ietf.org/id/draft-hallambaker-httpintegrity-02.html https://tools.ietf.org/id/draft-hallambaker-httpintegrity-02... although it's an unimplemented draft.
vfclists 4y ago
Mobile providers have been doing this crap for ages. That is why in the past I run my mobile connection through a VPN as much was possible. FWIW this has nothing to do with pro-war propaganda, just the sketchy behaviour telecoms providers have been doing and still do.
- netsharc 4y ago
  In the early days of 3G USB modems, an ISP I was using would notice JPEGs being downloaded and recompress them with lower quality. I guess they used a transparent HTTP proxy to do so, to save their cellular bandwidth.
  - vfclists 4y ago
    Yes, I remember this.
MarkusWandel 4y ago
How easy is it, in practice, for a nation state level authority to add a root certificate to people's devices? Adding letsencrypt to my personal server made me realize that if I'm MITM'd by a proxy, the padlock still shows up; merely clicking on it and going down a couple of menu levels (in Chrome "Connection is secure -> Certificate is valid" will reveal that the MITM proxy's root certificate is in use. If an employer can do this to its laptops, and presumably a cell phone maker to the cell phones it sells, just much protection does https really give you against a nation state level propaganda machine?
- remuskaos 4y ago
  Hm, I think you're mixing some things. A nation state could be embedding root certificates via a vendor, see Lenovo superfish (I know this wasn't done by the government, but that somehow makes it even worse). But a nation state actor also could simply buy the latest exploit from HackingTeam/Cellebrite/GrayKey/<current exploit vendor>. Let's encrypt is secure against MITM as far as I know because you still have to verify you own a given domain somehow. I cannot get a let's encrypt certificate for google.com for example.
- RealStickman_ 4y ago
  Someone has to first import the certificate into you systems trust store. With employers that's usually done by joining their active directory. If you're not in the active directory, but using your employers proxy, you will see a warning about an untrusted CA on every https site you visit.
mikecoles 4y ago
Even with HTTPS, are any pinning techniques still viable to warn users the traffic is being, possibly legitimately, MITM-ed? HPKP was an option, but the footgun reason was given for dropping support. Has anything taken its place? Is there anyway to determine a MITM server-side without relying on x-forwarded-for or via headers?

36 points by anonymfus 4y ago

PaulHoule 4y ago

Good way to make people switch.

norhi999 4y ago
Given its previous history of breaking and slowing connectivity in favor of harder blocking of government-critical sites, I'd say they should've done it way before this. The routes through their nets remind me a black hole.

jordemort 4y ago

This sort of thing is why I look askance at the "you don't need certificates" crowd. In the US, at least both Comcast and AT&T have a long and well-documented history of injecting advertisements into websites when the lack of a certificate lets them get away with it. Maybe you don't care about eavesdroppers, but you should care about a malicious network tampering with your content in-flight.

spaceheater 4y ago

Author himself links to articles how said ISP was injecting news ads, since 2020. Current news is about Ukraine, thus must be propaganda.

pessimizer 4y ago
Therefore pro-war propaganda cannot be referred to as pro-war propaganda? This is bizarre logic. If the ads started showing nootropic propaganda, would you not be allowed to call it nootropic propaganda?

memen 4y ago

In cryptography there is the clear difference between encrypting and signing (Confidentiality and Integrity). Is this distinction possible on a webserver/browser? I.e. No encryption, no signing -> HTTP Encryption and signing -> HTTPS No encryption, signing -> ? What about public information (not confidential) that needs verification (yes integrity)?

paulhodge 4y ago
Don’t think it exists for the HTML document. HTTPS works fine for public & unconfidential things. For verifying page resources there is a newish feature: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... .
norhi999 4y ago
Something like this maybe: https://tools.ietf.org/id/draft-hallambaker-httpintegrity-02.html https://tools.ietf.org/id/draft-hallambaker-httpintegrity-02... although it's an unimplemented draft.

vfclists 4y ago

Mobile providers have been doing this crap for ages. That is why in the past I run my mobile connection through a VPN as much was possible. FWIW this has nothing to do with pro-war propaganda, just the sketchy behaviour telecoms providers have been doing and still do.

netsharc 4y ago
In the early days of 3G USB modems, an ISP I was using would notice JPEGs being downloaded and recompress them with lower quality. I guess they used a transparent HTTP proxy to do so, to save their cellular bandwidth.
- vfclists 4y ago
  Yes, I remember this.

MarkusWandel 4y ago

How easy is it, in practice, for a nation state level authority to add a root certificate to people's devices? Adding letsencrypt to my personal server made me realize that if I'm MITM'd by a proxy, the padlock still shows up; merely clicking on it and going down a couple of menu levels (in Chrome "Connection is secure -> Certificate is valid" will reveal that the MITM proxy's root certificate is in use. If an employer can do this to its laptops, and presumably a cell phone maker to the cell phones it sells, just much protection does https really give you against a nation state level propaganda machine?

remuskaos 4y ago
Hm, I think you're mixing some things. A nation state could be embedding root certificates via a vendor, see Lenovo superfish (I know this wasn't done by the government, but that somehow makes it even worse). But a nation state actor also could simply buy the latest exploit from HackingTeam/Cellebrite/GrayKey/<current exploit vendor>. Let's encrypt is secure against MITM as far as I know because you still have to verify you own a given domain somehow. I cannot get a let's encrypt certificate for google.com for example.
RealStickman_ 4y ago
Someone has to first import the certificate into you systems trust store. With employers that's usually done by joining their active directory. If you're not in the active directory, but using your employers proxy, you will see a warning about an untrusted CA on every https site you visit.

mikecoles 4y ago

Even with HTTPS, are any pinning techniques still viable to warn users the traffic is being, possibly legitimately, MITM-ed? HPKP was an option, but the footgun reason was given for dropping support. Has anything taken its place? Is there anyway to determine a MITM server-side without relying on x-forwarded-for or via headers?