4 ms·

Well they don't have to break TLS if they can man in the middle everything and force browsers to use a CA they control.

School-Cotton 4y ago
That’s hypothetically possible but there’s no evidence that China does that. Nor is there any reason to believe that starting to do so would be “not very difficult”.
- dec0dedab0de 4y ago
  https://en.wikipedia.org/wiki/Great_Firewall https://en.wikipedia.org/wiki/Great_Firewall I thought it was common knowledge that China has been doing exactly that for decades. I mean, I guess it's possible I've fallen for anti-China propaganda, but I really don't think so. The only hypothetical part on my part is how easy it would be to block a specific video. I know that blocking a single URL, or keyword matching on the title are common features in off the shelf proxy servers. Add some coding from a competent screen scraper, and you should be able to identify every way a specific video is being sent. I wouldn't be surprised if this functionality was already built in to some products.
  - brian_cloutier 4y ago
    "force browsers to use a CA they control" is an essential ingredient. The article you linked mentions they have performed some CA trickery but does not mention anything about them having done it "for decades" and does not indicate that it is a widespread phenomenon. More explicitly: blocking individual YouTube videos requires control of the routers all traffic flows through AND control over the encryption of that traffic. If they cannot read the encrypted traffic then they do not know when a banned video is being watched. To date they have not exercised that level of control, they have not implemented a way of banning individual videos and it would be difficult for them to implement.
    - dec0dedab0de 4y ago
      Using a CA they control is only essential if they don't want to be caught. However, I would assume most webrowsers in China are using CINIC certs. At that point it would be trivial. Just return a different DNS entry, and have your CA verify it. Sure, pinning might alert some people that something is going on, but what are they going to do about it? I could have done it 10 years ago with WCCP and a bluecoat. But yes, I was wrong about them openly breaking SSL for decades. Doesn't mean it would be difficult.
  - School-Cotton 4y ago
    > Great Firewall From the page you linked: “The Chinese firewall is made of transparent proxies filtering web traffic. These proxies scan the requested URI, the "Host" Header and the content of the web page (for HTTP requests) or the Server Name Indication (for HTTPS requests) for target keywords.” This directly implies that they are NOT breaking TLS. Filtering by the SNI would not allow you to block one YouTube video; it’d only allow you to block entire domains. > I know that blocking a single URL, or keyword matching on the title are common features in off the shelf proxy servers Not if the site is delivered over TLS.
    - dec0dedab0de 4y ago
      I was thinking of part that says "Man-in-the-middle attacks with TLS" The Chinese National Intelligence Law theoretically allows the Chinese government to request and use the root certificate from any Chinese certificate authority,[55] such as CNNIC, to make MITM attacks with valid certificates. Multiple TLS incidents have occurred within the last decade, before the creation of the law. On 26 January 2013, the GitHub SSL certificate was replaced with a self-signed certificate in China by the GFW.[56] On 20 October 2014, the iCloud SSL certificate was replaced with a self-signed certificate in China.[57] It is believed that the Chinese government discovered a vulnerability on Apple devices and was exploiting it.[58] On 20 March 2015, Google detected valid certificates for Google signed by CNNIC in Egypt. In response to this event, and after a deeper investigation, the CNNIC certificate was removed by some browsers.[59] Due to the removal being based on proof and not suspicion, no other Chinese certificate authority has been removed from web browsers, and some have been added since then.[60] This type of attack can be circumvented by websites implementing Certificate Transparency and OCSP stapling or by using browser extensions.[61]

That’s hypothetically possible but there’s no evidence that China does that. Nor is there any reason to believe that starting to do so would be “not very difficult”.

dec0dedab0de 4y ago
https://en.wikipedia.org/wiki/Great_Firewall https://en.wikipedia.org/wiki/Great_Firewall I thought it was common knowledge that China has been doing exactly that for decades. I mean, I guess it's possible I've fallen for anti-China propaganda, but I really don't think so. The only hypothetical part on my part is how easy it would be to block a specific video. I know that blocking a single URL, or keyword matching on the title are common features in off the shelf proxy servers. Add some coding from a competent screen scraper, and you should be able to identify every way a specific video is being sent. I wouldn't be surprised if this functionality was already built in to some products.
- brian_cloutier 4y ago
  "force browsers to use a CA they control" is an essential ingredient. The article you linked mentions they have performed some CA trickery but does not mention anything about them having done it "for decades" and does not indicate that it is a widespread phenomenon. More explicitly: blocking individual YouTube videos requires control of the routers all traffic flows through AND control over the encryption of that traffic. If they cannot read the encrypted traffic then they do not know when a banned video is being watched. To date they have not exercised that level of control, they have not implemented a way of banning individual videos and it would be difficult for them to implement.
  - dec0dedab0de 4y ago
    Using a CA they control is only essential if they don't want to be caught. However, I would assume most webrowsers in China are using CINIC certs. At that point it would be trivial. Just return a different DNS entry, and have your CA verify it. Sure, pinning might alert some people that something is going on, but what are they going to do about it? I could have done it 10 years ago with WCCP and a bluecoat. But yes, I was wrong about them openly breaking SSL for decades. Doesn't mean it would be difficult.
- School-Cotton 4y ago
  > Great Firewall From the page you linked: “The Chinese firewall is made of transparent proxies filtering web traffic. These proxies scan the requested URI, the "Host" Header and the content of the web page (for HTTP requests) or the Server Name Indication (for HTTPS requests) for target keywords.” This directly implies that they are NOT breaking TLS. Filtering by the SNI would not allow you to block one YouTube video; it’d only allow you to block entire domains. > I know that blocking a single URL, or keyword matching on the title are common features in off the shelf proxy servers Not if the site is delivered over TLS.
  - dec0dedab0de 4y ago
    I was thinking of part that says "Man-in-the-middle attacks with TLS" The Chinese National Intelligence Law theoretically allows the Chinese government to request and use the root certificate from any Chinese certificate authority,[55] such as CNNIC, to make MITM attacks with valid certificates. Multiple TLS incidents have occurred within the last decade, before the creation of the law. On 26 January 2013, the GitHub SSL certificate was replaced with a self-signed certificate in China by the GFW.[56] On 20 October 2014, the iCloud SSL certificate was replaced with a self-signed certificate in China.[57] It is believed that the Chinese government discovered a vulnerability on Apple devices and was exploiting it.[58] On 20 March 2015, Google detected valid certificates for Google signed by CNNIC in Egypt. In response to this event, and after a deeper investigation, the CNNIC certificate was removed by some browsers.[59] Due to the removal being based on proof and not suspicion, no other Chinese certificate authority has been removed from web browsers, and some have been added since then.[60] This type of attack can be circumvented by websites implementing Certificate Transparency and OCSP stapling or by using browser extensions.[61]