4 ms·

I think this requires some prior knowledge. From https://palant.info/2023/01/02/south-koreas-online-security-dead-end/ https://palant.info/2023/01/02/south-kor

I think this requires some prior knowledge. From https://palant.info/2023/01/02/south-koreas-online-security-dead-end/ https://palant.info/2023/01/02/south-koreas-online-security-... : > I’ve heard about South Korea being very “special” every now and then. I cannot claim to fully understand the topic, but there is a whole Wikipedia article on it. Apparently, the root issue were the US export restrictions on strong cryptography in the 90ies. This prompted South Korea to develop their own cryptographic solutions. > It seems that this started a fundamental distrust in security technologies coming out of the United States. So even when the export restrictions were lifted, South Korea continued adding their own security layers on top of SSL. All users had to install special applications just to use online banking. > Originally, these applications used Microsoft’s proprietary ActiveX technology. This only worked in Internet Explorer and severely hindered adoption of other browsers in South Korea. Wowsa!

hosteur 4y ago
> Originally, these applications used Microsoft’s proprietary ActiveX technology. This only worked in Internet Explorer and severely hindered adoption of other browsers in South Korea. This basically reveals that the pretext of this being primarily about increasing security of the connection is not really what it is about. From having read about this, I think it is completely fair to classify this as spyware.
- mathieuh 4y ago
  If at any point a government tells you they are doing something to increase security, or to be tough on crime, or to protect children, it is almost certain they are lying to your face and in fact just want more ways to spy on people.
- numpad0 4y ago
  More likely a massive and internally unrecognized incompetence than some black project from sneaky agencies. I remember some experts in 2000s fighting months to convince banks that TLS with self signed certificate is the way to get customers scammed.
  - actionfromafar 4y ago
    But isn't that sort of true? How can I know what self signed certs to accept and which ones to reject as scam attempts?
lifthrasiir 4y ago
I'm not sure if there was such a "fundamental distrust" ever. It is more easily and adaquately explained that they simply followed the path of the least resistance, which is a status quo.
oefrha 4y ago
ActiveX-based plug-ins for online banking weren’t exactly SK-specific in the 2000s. I’m surprised these (I mean the no longer ActiveX-based successors) are a still a thing, though.
goranmoomin 4y ago
I’ve also wrote a comment on the context of how these ugly programs got adopted on [0]. To quote myself… > Everybody knows that the systems are absurd. This is basically a countrywide legacy that we’re figuring our way out for ~30yrs. > When the idea was first proposed, it was when IE didn’t have a yes/no dialog to ask whether to load native code or not. > When IE first added ActiveX confirmation dialogs, banks instructed customers to press yes. When IE deprecated ActiveX, banks didn’t remove their 20-yr old code straight away; people were advised to turn on ActiveX support from advanced settings (they added step-by-step instructions to help people). When MS finally ripped out ActiveX, banks copied their ActiveX components into a separate executable that runs a localhost server. I’m sure that if it wasn’t iPhones, South Korea would have been locked into this legacy for a lot longer. (In fact, we once had versions of these programs for Android as well! iOS didn’t allow this (thankfully).) [0]: https://news.ycombinator.com/item?id=34313137 https://news.ycombinator.com/item?id=34313137
- grishka 4y ago
  What about people using Apple computers? Were they simply advised to borrow something capable of running Windows from a friend?
  - actionfromafar 4y ago
    That situation was pretty normal if you used Macs back in the day, for many workflows. Virtual PC on PPC Macs were a godsend in many situations in the late 1990s.
    - dr-detroit 4y ago
      [dead]
  - jinseokim 4y ago
    Some softwares: Yes. People with Mac are advised/forced to use Windows. For instance, Uwayapply, a college admission application service, doesn't support macOS. Or: they provide .pkg file to install similar program. Most of them want sudo. They use root permission for various purpose, but the most impressive one for me was registering their CA certificate on Firefox root store, to support WebSocket over TLS to localhost on Firefox.
jinseokim 4y ago
Well... SSL was unsafe then. The problem came from U.S. cryptography export regulation which makes exportable cryptographic algorithm feasible to crack. Bundled Internet Explorer didn't support good algorithms on SSL. So, South Korea government wanted to add another security layer. They wanted to state "good to go" algorithm (just like FIPS did), so they built and recommended the encryption algorithm, SEED. And it required ActiveX, because 128 bits cryptography on JavaScript was infeasible then. The real problem of South Korea is, the slowness of deprecation. They deprecated ActiveX (and created NPAPI or WebSocket on localhost) in 2014. After Microsoft deprecated Windows XP, they established "Windows XP Task Forse" to respond security issues with Windows XP computers on government agencies. Yeah, this was fairly late, considering MS declared the Windows XP deprecation schedule in 2007. IE/ActiveX/Java Applet/etc algorithms aren't still completely deprecated in Korea. NEIS, a giantic service used by every K-12 school to record and manage education-related information, still uses the technology based on Internet Explorer by using IE compatibility mode of MS Edge. Repeat, EVERY K-12 school teacher and staff uses this service, with IE compatibility mode. I want South Korea to adapt new technology and deprecate old one more in due course. I mean, they should accept TLS provides decent end-to-end encrpytion, and they should recognize Triple DES is deemed unsafe algorithm.
matheusmoreira 4y ago
> All users had to install special applications just to use online banking. This happened here in Brazil as well, perhaps for similar reasons. Most banks require users to install a "security module" in their computers in order to even log into the bank website. Everyone does this unquestioningly, there's even packages for Linux. In my experience, this software caused massive performance issues. I tried to figure out why by reverse engineering one of these things and it turned out it had a Windows driver that intercepted every single network connection. Literally indistinguishable from malware but this is apparently considered acceptable because banks have a "legitimate interest" in preventing fraud or whatever. We have a GDPR-like law in effect now, not sure if banks can get away with this anymore. I certainly hope not.

hosteur 4y ago

> Originally, these applications used Microsoft’s proprietary ActiveX technology. This only worked in Internet Explorer and severely hindered adoption of other browsers in South Korea. This basically reveals that the pretext of this being primarily about increasing security of the connection is not really what it is about. From having read about this, I think it is completely fair to classify this as spyware.

mathieuh 4y ago
If at any point a government tells you they are doing something to increase security, or to be tough on crime, or to protect children, it is almost certain they are lying to your face and in fact just want more ways to spy on people.
numpad0 4y ago
More likely a massive and internally unrecognized incompetence than some black project from sneaky agencies. I remember some experts in 2000s fighting months to convince banks that TLS with self signed certificate is the way to get customers scammed.
- actionfromafar 4y ago
  But isn't that sort of true? How can I know what self signed certs to accept and which ones to reject as scam attempts?

lifthrasiir 4y ago

I'm not sure if there was such a "fundamental distrust" ever. It is more easily and adaquately explained that they simply followed the path of the least resistance, which is a status quo.

oefrha 4y ago

ActiveX-based plug-ins for online banking weren’t exactly SK-specific in the 2000s. I’m surprised these (I mean the no longer ActiveX-based successors) are a still a thing, though.

goranmoomin 4y ago

I’ve also wrote a comment on the context of how these ugly programs got adopted on [0]. To quote myself… > Everybody knows that the systems are absurd. This is basically a countrywide legacy that we’re figuring our way out for ~30yrs. > When the idea was first proposed, it was when IE didn’t have a yes/no dialog to ask whether to load native code or not. > When IE first added ActiveX confirmation dialogs, banks instructed customers to press yes. When IE deprecated ActiveX, banks didn’t remove their 20-yr old code straight away; people were advised to turn on ActiveX support from advanced settings (they added step-by-step instructions to help people). When MS finally ripped out ActiveX, banks copied their ActiveX components into a separate executable that runs a localhost server. I’m sure that if it wasn’t iPhones, South Korea would have been locked into this legacy for a lot longer. (In fact, we once had versions of these programs for Android as well! iOS didn’t allow this (thankfully).) [0]: https://news.ycombinator.com/item?id=34313137 https://news.ycombinator.com/item?id=34313137

grishka 4y ago
What about people using Apple computers? Were they simply advised to borrow something capable of running Windows from a friend?
- actionfromafar 4y ago
  That situation was pretty normal if you used Macs back in the day, for many workflows. Virtual PC on PPC Macs were a godsend in many situations in the late 1990s.
  - dr-detroit 4y ago
    [dead]
- jinseokim 4y ago
  Some softwares: Yes. People with Mac are advised/forced to use Windows. For instance, Uwayapply, a college admission application service, doesn't support macOS. Or: they provide .pkg file to install similar program. Most of them want sudo. They use root permission for various purpose, but the most impressive one for me was registering their CA certificate on Firefox root store, to support WebSocket over TLS to localhost on Firefox.

jinseokim 4y ago

Well... SSL was unsafe then. The problem came from U.S. cryptography export regulation which makes exportable cryptographic algorithm feasible to crack. Bundled Internet Explorer didn't support good algorithms on SSL. So, South Korea government wanted to add another security layer. They wanted to state "good to go" algorithm (just like FIPS did), so they built and recommended the encryption algorithm, SEED. And it required ActiveX, because 128 bits cryptography on JavaScript was infeasible then. The real problem of South Korea is, the slowness of deprecation. They deprecated ActiveX (and created NPAPI or WebSocket on localhost) in 2014. After Microsoft deprecated Windows XP, they established "Windows XP Task Forse" to respond security issues with Windows XP computers on government agencies. Yeah, this was fairly late, considering MS declared the Windows XP deprecation schedule in 2007. IE/ActiveX/Java Applet/etc algorithms aren't still completely deprecated in Korea. NEIS, a giantic service used by every K-12 school to record and manage education-related information, still uses the technology based on Internet Explorer by using IE compatibility mode of MS Edge. Repeat, EVERY K-12 school teacher and staff uses this service, with IE compatibility mode. I want South Korea to adapt new technology and deprecate old one more in due course. I mean, they should accept TLS provides decent end-to-end encrpytion, and they should recognize Triple DES is deemed unsafe algorithm.

matheusmoreira 4y ago

> All users had to install special applications just to use online banking. This happened here in Brazil as well, perhaps for similar reasons. Most banks require users to install a "security module" in their computers in order to even log into the bank website. Everyone does this unquestioningly, there's even packages for Linux. In my experience, this software caused massive performance issues. I tried to figure out why by reverse engineering one of these things and it turned out it had a Windows driver that intercepted every single network connection. Literally indistinguishable from malware but this is apparently considered acceptable because banks have a "legitimate interest" in preventing fraud or whatever. We have a GDPR-like law in effect now, not sure if banks can get away with this anymore. I certainly hope not.